Set privacy and retention options

Use Settings to control saved progress, participant navigation, automatic collection, and the removal of personally identifiable information (PII), such as names, email addresses, or participant IDs.

Participant settings

• Resume progress retention sets how many hours unfinished progress remains available for resuming a session.
• Participant back button allows participants to return to earlier pages.
• Prevent copy and paste blocks copying, cutting, and pasting in the published survey. Preview remains unrestricted.

Set these options in the draft before publishing.

Session recording

Under Settings → Automatic data collection, choose which information the published survey collects:

Scanner collection and replay are independent. You can keep browser checks while turning off interaction recording. Turning off the scanner also disables variables.get("fpscanner") collection in JavaScript and Preview; it returns {status: "disabled", result: null}. See scanner results.

With replay enabled, choose whether to collect mouse movement, pointer buttons, keyboard events, entered values, scrolling, focus, viewport changes, device information, clipboard events, and device motion. These categories start enabled.

Input values controls replay copies of typed answers, selected options, and checkbox states. Turning it off does not change the participant's form or the answers saved in their survey response. The browser clears these values from its replay copy of the page. For additional protection, stored recordings omit page snapshots entirely under this setting, so a visual reconstruction of the page is unavailable; navigation and the other enabled events remain. Keyboard events can still reveal typed characters. Disable both Input values and Keyboard events to avoid recording text entry.

The settings are fixed for a published version. Change the draft and publish a new version to use different collection settings. Existing versions keep their settings. Existing drafts and versions start with IP collection off and scanner and replay collection on.

Enabled collection starts when the participant opens the survey, including before an in-survey consent question. Optional analytics cookie preferences do not control these settings. If your study requires consent before collection, arrange consent before opening the survey link.

Use Results → Replay sessions to inspect the available recordings and scanner results. The PII deletion schedule below removes automatically collected data for the selected version.

Remove identifying data

Mark identifying questions and URL parameters as PII when creating them. This includes them in the retention policy; it does not hide them from collaborators who can view results.

Automatic deletion affects the selected version. It removes:

• Answers and URL values marked as PII.
• All stored Flow variables and additional JavaScript data.
• IP addresses, browser scanner results, all session recordings, and saved unfinished progress.

Non-PII answers remain. It also closes that version to participation. Check these effects before enabling it under Settings → PII removal:

1. Set a Reminder deadline if you need a reminder to review the stored data.
2. Enable Automatically delete PII after when deletion should happen automatically.
3. Set the Deletion deadline. Check the timezone printed beside the field.

The schedule applies to the selected version and can be changed after publication. A reminder alone does not enable automatic deletion. The owner and current collaborators receive the reminder by email at their account addresses. With automatic deletion enabled, they also receive a warning when deletion is within two days.

The deadline makes the version eligible for deletion; it is not a guaranteed completion time. Deletion waits while any unfinished saved progress remains unexpired, even if that participant has closed the browser. Resume progress retention controls expiry after the last saved change. Saving more progress extends that period; submitting a completed response removes its unfinished progress. The worker checks again later, and participation closes when deletion succeeds. New entries can therefore extend the wait. A newer version published at the same URL has its own schedule.

For example, with 24-hour resume retention, progress saved an hour before the deletion deadline can delay deletion until 23 hours after it, or longer if more progress is saved.

Example: Collect an email address for follow-up, mark the question as PII, then schedule deletion after follow-up ends. Keep the reminder earlier so the research team can review the deadline.

Mark data deliberately: Studio cannot infer every identifying answer. Deletion in Studio does not remove CSV files or recording archives you have already downloaded. See results and recordings.