Privacy Policy for Okthanks

Last updated: October 3, 2025

Introduction

Okthanks is an organization focused on conducting product and user research, as well as facilitating workshop and participatory design activities. Our research participants are at the core of what we do, and we strive to handle your data responsibly and transparently.

Each research engagement procured by Okthanks will be accompanied by consent forms specific to the study, which explain how the information shared during the engagement will be used and by whom. Our consent forms encourage participant rights and flexibility. For more information on consent forms, refer to Section 7: Participant Choice. This privacy policy outlines our standard operating procedures which are applied across all research engagements.

For the purposes of this document ‘research engagements’ include, yet are not limited to, interviews, surveys, focus groups, asynchronous conversations and workshops.

Section 1: The Data We Collect

We may collect the following types of data:

Contact information such as name, email address or Signal username

Information shared by participants during a research engagement. This can include organizational details, affiliations, information specific to the topic of the study, relevant demographic information (e.g., age, gender, region or country, etc.).

Section 2: Security Measures

We will prioritize contacting participants through secure communication channels. If contact information is not available, and unencrypted channels are the only option, we will provide participants with the option to move the conversation to a secure channel.
Some participants operate in more sensitive contexts than others. When reaching out to potential participants, we are mindful of how we contact them—ensuring that we are using secure channels and/or not introducing harm in our outreach messages on public or unencrypted channels.
During outreach, we may not know if a participant is located inside a sensitive region or outside. If they are operating in a repressive country, we need to be aware of the risks they face. We will take special care in these situations, and as needed, develop tailored communication plans.
We take working with at-risk individuals and individuals supporting at-risk individuals very seriously. Upon request, we will use alias names to protect the identity of participants.

Section 3: Information Security

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction.

Personally identifiable information (PII) is stored in secure systems where access is restricted to approved Okthanks project collaborators. This information is kept confidential.
PII is not associated with the research data itself. Codes are assigned to each research participant. As we document interview notes to be shared internally, these codes will be used to reference participants. This technique ensures additional privacy for participants. The codes are linked to participants' names in a separate restricted document.
Raw notes are documented on local computers and stored using Resilio or Basecamp. Both systems offer strict access control and end-to-end encryption both at rest and in-transit. We take special care of interview and workshop notes. Before notes are shared with the project team, they are ‘sanitized’ to ensure that any personal information is removed.
Sometimes sensitive information is shared in interview conversations to provide further context for the researcher, but participants request that the information be left out of the notes or generalized. In this case, the lead researcher will follow up directly with the participant to review a sanitized version of the notes that can be shared with the project team.

Section 4: Participant Safety

If the engagement is virtual, participants will have the option to use the video conferencing platform they are most comfortable with. By default we prioritize the secure conferencing platform that best fits the project needs.
Video or audio recording is beneficial for some research engagements, as they are helpful for reviewing and clarifying details shared. However, the safety and comfort of research participants is our top priority. If a participant is uncomfortable with a session being recorded, they are welcomed to decline. Recordings are deleted immediately on the closure of a research project. Refer to Section 6: Data Storage & Retention for additional details on data storage and retention.
If the engagement is in-person, we work closely with our local partner on the ground, to create a safe physical environment leveraging threat modeling frameworks to assess and reduce risks.

Section 5: How We Use Your Data

The data we collect during research are strictly for the purposes of the specific research goals, and more broadly to align with our mission to push technology to reach its highest potential for humanity. Our aim is to improve the lives of beneficiaries and research participants. The choices we make regarding how research insights are shared is unique to a research engagement, but will always be aligned with this core value.

We do not engage in the following activities:

Buying or selling marketing lists
Entering into data-sharing agreements with unrelated third parties
Telephone or postal marketing

We do not share your contact information without your permission. If there is a study being conducted by a partner organization that has an opportunity that relates to your work, we will ask them for a write up that can be shared directly with you or seek your direct consent for an introduction.

Section 6: Data Storage & Retention

Access

Many research studies we host are on behalf of another company or organization. Depending on the study, additional stakeholders may be involved. If external partners have access to the raw data, they will be named in the consent form. Contracted researchers working as a vendor of Okthanks are required to adhere to the policies and practices stated here within.

Storage & Tools

We use a variety of tools and platforms for notetaking and information sharing to meet the needs of a research engagement. They include:

Text Editor
Local Storage
Resillio Sync
Basecamp
Google Documents

For surveys, we generally use one of the platforms listed below.

BlockSurvey
Google Forms
Typeform

Specific tools are selected based on the threat model and needs of the research engagement. Refer to Section 3: Information Security for information on safe handling of notes that may contain personally identifiable information (PII).

Retention

We retain your personal data only for as long as necessary. Contact information is kept confidential within our systems so that you can be contacted for future research opportunities. If you prefer to be removed, contact the lead researcher for the engagement you participated in or contact hello@okthanks.com.
Recordings from interviews and workshops are deleted upon the completion of a project. During a project term, they are stored on secured local computers, using Resillio Sync for sharing or Google drive with access restricted.
Sanitized notes, reports and presentations are archived with the research project.

Section 7: Participant Choice

Each research engagement is accompanied by a tailored consent form. Our consent forms are a common agreement between Okthanks, as the research facilitator, and the participant. It clearly outlines the purpose of the study, a description of involvement, who will have access to the data, and how the data will be used. It gives participants options within their participation:

If they want the session recorded
If they agree for the data to be used in articles and reports

For research engagements that contribute to public facing publications, participants will be given an opportunity to review upon request.

As a research participant, you have the following rights:

Opt-Out: You may opt out of participating in our research at any time. If you withdraw your consent, the primary researcher will securely destroy any data you shared.
Access: You have the right to request access to the personal data we hold about you.
Correction: You can request corrections to your personal data if it is inaccurate or incomplete.
Deletion: You can request that we delete your personal data, subject to legal or contractual obligations.

To exercise these rights, please contact us your lead researcher or our team lead at hello@okthanks.com.