Privacy policy

Who holds the data

Joripo is software that a survey organisation uses to collect data, either on Joripo's hosted service or on a server it runs or has chosen. Interview data belongs to that organisation. The organisation decides what its forms ask, who on its team can see the answers and how long the data is kept. Whoever operates the server you connect to is responsible for the data on it, and the survey organisation's own privacy notice to respondents applies.

If you were interviewed in a survey, or you collect data for one, contact the organisation running the survey about your data.

What Joripo Collect collects

• Answers to survey forms that you, as an enumerator, enter, including any personal information the survey asks for.
• Photos, video, audio recordings, signatures and files, only when a form question asks for one and you take, record or choose it.
• Audio audits and text audits, only when the survey organisation adds them to a form. An audio audit records sound during part of the interview, between points the form sets; a text audit records how long each question was on screen. The survey organisation should tell respondents when interviews are recorded.
• Location, only when a form asks for it: a GPS question you answer, or a reading the form takes as it opens. The app does not track location in the background.
• The account or device key you connect with: the server name, your email or username, and the phone's model, Android version and app version, so the server can tell which phone sent a submission and the organisation can approve or revoke it.

The app has no advertising, no analytics and no third-party tracking.

Where it goes

Finished forms are sent only to the Joripo server you connected the app to, over HTTPS. Nothing is sent anywhere else. Until they are sent, forms and drafts are kept in the app's private storage on the phone; they are excluded from Android cloud backups and device-to-device transfer. Sign-in credentials are sealed with the Android Keystore. Joripo Collect does not add its own encryption to answers stored on the phone: they are protected by Android's private app storage and the phone's own encryption.

After a form is sent, the app keeps a backup copy on the phone for the number of days the server sets: 30 days by default, anywhere from 0 to 365, where 0 turns backups off. This lets a form be recovered if something goes wrong. No backup is kept for forms with garbled sensitive questions, or when the server tells the app to delete forms once they are sent.

Permissions

• Camera: to answer photo, video and barcode questions, and to scan a QR code with a server address or a device key.
• Location: to answer GPS questions.
• Microphone: to record audio questions and, when a form has one, an audio audit.
• Network: to sign in, download forms and send submissions.

Each permission is requested when a form first needs it. A form can be filled without granting it if the survey does not require that question.

How data is protected, and where it is hosted

On Joripo's hosted service, collected data (submissions and their attachments, server datasets and the answers stored in the database) is encrypted at rest with AES-256-GCM, and every connection uses HTTPS. Each organisation's data is kept separate from every other organisation's. The hosted service runs on Railway, a cloud hosting platform. Organisations that run Joripo on their own server decide how it is hosted and protected.

Within an organisation, people see only what their role allows, and identifying answers can be masked for anyone without identity access. The Security page describes these safeguards, and their limits, in detail.

Joripo Desktop

Joripo Desktop, the Windows app, keeps a copy of a workspace's forms, submissions and attachments in a study folder on the computer, so data can be exported offline. It applies the same masking as the server. The folder is not encrypted by Joripo, so it should be kept on a computer the organisation protects. The app keeps its sign-in in Windows Credential Manager.

Keeping and deleting data

On the server, data is kept until the survey organisation removes it. Deleting a form moves it to Deleted forms, from where it can be restored; it is not erased. To delete submissions permanently, an owner or manager purges them (Purge form data), which removes the submissions and their attachments. By default a purge first writes a backup of what it removes, which stays on the server, encrypted at rest on the hosted service. People's accounts can be deactivated, which signs them out and revokes their phones. If you need data, backups or accounts removed entirely, contact us.

On the phone, sent forms stay as backups for the number of days the server sets, as described above. Delete all data on this phone, in the app's settings, deletes everything the app holds, including drafts and anything not yet sent, and so does uninstalling the app or clearing its data.

On a computer running Joripo Desktop, study folders stay until someone deletes them. Purging data on the server does not remove copies already on phones or in Desktop study folders.

This website and its contact form

When you send a message through the contact form, we store what the form asks for (your name, email address, organisation, role, what you would like to talk about and your message) with the time it arrived. It is kept on Joripo's server, encrypted at rest, and read only by the Joripo team so that we can reply to you. We do not share it with anyone else, and we delete it when it is no longer needed. Your network address is used only to limit repeated sending, and it is not stored with your message.

The website has no analytics and no advertising trackers, and it loads no scripts or fonts from other companies: fonts and images are served from Joripo's own server. The contact page sets one cookie, a session cookie that carries a security token protecting the form against forged submissions; signing in to the console uses the same cookie to keep you signed in. Links in photo credits lead to the photographers' pages on other sites, which have their own policies.

Contact

For data collected in a survey, contact the organisation running it. For questions about Joripo itself, or about this policy, write to us through the contact form. If we change this policy, we will update this page and the date at the top.