Response Collection

When a respondent opens a survey, the runtime first resolves the privacy mode declared by the survey author. In anonymous mode no user_id is persisted; the response is stored against a session token and only aggregate contributions remain. In pseudonymous mode the system computes sha256(survey_id + user_id) and stores the hash, which lets analytics deduplicate one-response-per-respondent without ever exposing identity.

In attributed mode the full user_id is recorded together with a frozen demographic snapshot (age band, region, license type, discipline) so segment breakdowns remain stable even if the member's profile later changes. The runtime renders questions one section at a time on small screens and as a continuous scroll on desktop, evaluates branching rules client-side, and posts answers to the API every ten seconds for autosave. If the respondent drops off, a continue-later magic link can be emailed or surfaced in the in-app inbox; the link rehydrates the partial draft including unsubmitted text and selected branches.

A configurable progress bar indicates completion based on reachable questions under the current branch path, recalculated as answers change. Public surveys are served by a server-rendered Astro page tuned for fast first paint, indexable metadata, and Cloudflare Turnstile challenge to deter automated submissions; the same runtime is exposed as an embeddable iframe with postMessage events so federation and club websites can host surveys inline and react to completion. All submissions pass through validation that enforces required fields, range checks, and choice integrity, and quality signals (timing per question, straight-lining, drop-off coordinates) are emitted to F20.05 for downstream filtering.

Submissions are idempotent on the (session, question) key so retries from flaky networks never produce duplicates.