Privacy Policy

Last updated: June 15, 2026

Psychology Dictionary Lab ("we", "us", "the App") helps psychology students and researchers design rigorous studies, collect survey responses, and generate APA-formatted papers. This Privacy Policy explains what data we collect, how we use it, and the choices you have. We designed the app to collect as little personal data as possible.

1. The short version

• We collect: your email address (or Apple ID), the research project content you create, your survey configurations, your in-app purchase status, and limited diagnostic data needed to keep the service running.
• We do NOT collect: survey participant names, emails, location, contacts, photos, advertising identifiers, or browsing history. We do not run third-party analytics or advertising trackers.
• Survey participants stay anonymous by default: only a one-way hash of the IP address is stored for fraud prevention and rate limiting.
• We never sell your data, your project content, or your participants' responses to anyone.

2. Information we collect

2.1 Account information (you)

• Email address — when you register, or your private-relay email from Sign in with Apple. Used as your login identifier and for transactional messages (password reset, billing).
• Password — stored only as a bcrypt hash; we cannot recover or read it.
• Apple user identifier (apple_sub) — if you sign in with Apple, we store the opaque identifier Apple assigns; we do not receive your name unless you grant it.
• Plan — whether you are on the free tier or a Pro subscription.

2.2 Research content (you)

Everything you enter in the eight-step research wizard — research question, variables, hypothesis, sample plan, methods, instruments, analysis plan, ethical considerations — is stored under your account. Same for the surveys you create, the statistical analyses you run, and the APA documents you generate.

2.3 Survey participant data (your respondents)

When someone responds to a survey you've shared, we store:

• Their answers as you defined them in the survey configuration.
• The timestamp of submission.
• A SHA-256 hash of the responding IP address, used to throttle abuse and prevent duplicate submissions. The hash is one-way; we cannot recover the original IP from it.

We never collect a participant's name, email, location, device identifier, or any other personally identifying information unless YOU explicitly add a question for it in your survey. If you do, you become responsible for handling that information under your institutional IRB and applicable law.

2.4 Subscription & payment

If you upgrade to Pro, the payment itself is processed by Apple. We never see your credit card or Apple ID password. We receive a subscription receipt confirmation from RevenueCat (our subscription service provider) including your subscription status and expiration date. See RevenueCat's privacy policy at revenuecat.com/privacy.

2.5 Push notifications (optional)

If you grant notification permission, we store your Apple Push Notification (APNs) device token to send you alerts when your surveys receive new responses. You can revoke this at any time in iOS Settings → Psychology Dictionary Lab → Notifications.

2.6 Diagnostic data

To keep the service running we record minimal server logs (timestamps, HTTP status codes, response times). These logs do not contain your password, your account email, or survey participant content. Logs are retained for 30 days.

3. How we use this information

4. AI processing of your content

When you ask the app for guided suggestions (in the research wizard), or for an APA interpretation of a statistical result, or to generate a full APA paper, the relevant portion of your research project is sent to Anthropic for processing by their Claude language model. Anthropic processes the request, returns the output to our server, and does not retain or train on your data under our enterprise agreement. See Anthropic's commercial terms at anthropic.com/legal/commercial-terms.

Survey participants' raw responses are never sent to any AI service; statistical analyses run locally on our server using scipy / statsmodels, and only the AGGREGATE result (statistic, p-value, effect size) is forwarded to Claude for the APA paragraph.

5. Data sharing

We share the minimum data necessary with the following service providers, each bound by their own privacy and security obligations:

• DigitalOcean — hosting (App Platform + managed Postgres + Spaces object storage). Data stays in the United States (NYC3 region).
• Anthropic — AI processing of wizard prompts and APA generation (see Section 4).
• RevenueCat — subscription status verification.
• Apple Push Notification service — delivery of survey-response notifications.

We do not sell, rent, or share your data with advertisers or data brokers. We have no third-party analytics SDKs in the app.

6. Data retention

• Account, projects, surveys, responses, analyses, APA documents — retained as long as your account is active. Deleting your account (Settings → Delete Account in the app) removes all of it within 30 days, except where law requires otherwise.
• Subscription records — retained for 7 years after the subscription ends for tax / audit purposes.
• Server logs — 30 days, then rotated.

7. Your rights

Depending on where you live, you have some or all of the following rights:

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate data.
• Deletion — delete your account and the data above; you can do this yourself in Settings.
• Portability — receive your data in a structured format.
• Objection / restriction — limit how we process your data.
• Withdraw consent — revoke push notification permission in iOS Settings.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

8. Security

• All traffic between the app and our servers is encrypted with TLS 1.2+.
• Passwords are stored only as bcrypt hashes; we cannot read or recover them.
• Authentication tokens are stored on your device in iOS Secure Enclave–backed Keychain.
• Survey participant IP addresses are hashed before storage; the raw IP is never written to disk.
• Our infrastructure is hosted on DigitalOcean's managed services, with database backups and at-rest encryption.

9. Children

Psychology Dictionary Lab is intended for psychology students and researchers aged 17 and older. The app is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child has provided data to us, contact [email protected] and we will delete it.

10. International transfers

Our servers are located in the United States. If you access the app from outside the US, your data will be transferred to and processed in the US. By using the app you consent to this transfer.

11. Changes to this policy

We may update this policy as the app evolves. We will post the new version here and update the "Last updated" date. Material changes will be communicated in-app or by email.

12. Contact

Questions? Email [email protected]. We answer everything personally.