Privacy Policy

Prolific Tea (prolifictea.com, "the Platform") is operated from Egypt by Basel Ashraf as sole operator, who is the data controller for the personal data described here. The website and its database are hosted by Hetzner on servers in Germany. Contact: privacy@prolifictea.com. Prolific Tea is independent and is not affiliated with Prolific.

We collect the minimum data needed to operate the Platform:

• Our application does not store visitors' IP addresses in its database, except an IP address that we ban for abuse. IP addresses are used briefly, in memory only, to limit abuse. Cloudflare and our hosting provider process IP addresses to deliver and protect the website.
• No data is sold to third parties. Ever.
• We do not collect your Prolific ID, your Prolific login details, or any other information about your Prolific account. The only exception is the outcome of a study, and only if you press Share on that one study after seeing exactly what will be sent.

Your data is used only to:

• Display your reviews, comments, and ratings on the Platform.
• Calculate and display aggregate researcher ratings and study statistics.
• Prevent spam and abuse (rate limiting, duplicate detection and moderation of your account).
• Send you account-related emails (verification, password resets) and the alerts or notifications you ask for.
• Answer privacy requests and complaints, and keep a record that we did.
• Measure site traffic and usage with Google Analytics and Umami, to improve the service.
• Show advertising through Mediavine, which pays for running the Platform.

We rely on the following lawful bases:

• Contract (Article 6(1)(b)): to create and run your account and provide the features you use, under our Terms of Service.
• Legitimate interests (Article 6(1)(f)): to publish participant reviews and study information so participants can make informed decisions, to keep the Platform secure and prevent abuse, and to measure how the Platform is used. We have weighed these interests against the rights of the people concerned and keep a written assessment, which is why individual researchers' names are not published. Anyone can object at any time (see "Your Rights").
• Consent (Article 6(1)(a)): for non-essential cookies and similar technologies used for analytics and advertising, where the law requires consent. You give or refuse this through the consent banner and can change it at any time.

We use the following service providers:

• Hetzner (hosting): runs the website and its database on servers in Germany.
• Cloudflare: provides DNS and sits in front of the website as a proxy, runs Turnstile bot checks on the login and registration pages, and stores our database backups (Cloudflare R2).
• Backblaze B2: stores a second copy of our database backups.
• Resend (email delivery): sends verification, password reset and other account emails on our behalf.
• Google Sign-In: if you choose to sign in with Google, Google shares your email address and basic profile details with us. We keep only your email address and Google account identifier.
• Google Analytics (GA4): measures aggregate traffic (such as page views, session duration and region). Google may set cookies (such as _ga) to distinguish visitors. For visitors in the UK and EEA, Google Analytics is meant to follow the choice you make in the consent banner. Google states that GA4 does not log or store IP addresses. We do not use Google Analytics advertising features, user-ID tracking or remarketing.
• Umami Analytics: a cookie-free analytics tool that we host ourselves. Its data stays on our own server and is not shared with anyone.
• Mediavine: our advertising partner. Its script displays ads and may set cookies and use local storage to serve and personalise ads, subject to your consent choices. See the Mediavine section below.
• Telegram: if you link Telegram to the extension, study alerts are sent to your Telegram chat through Telegram's Bot API. Each alert includes the study's researcher name as shown on Prolific; we forward it and do not store it.
• Browser push services: if you turn on push notifications, notifications are delivered through your browser maker's push service (for example Google, Mozilla or Apple).

If you buy a Supporter membership (it is not on sale yet), Paddle (Paddle.com Market Limited) is the seller of record and an independent controller for your payment details, billing address, tax data and fraud checks; see Paddle’s privacy notice. We receive from Paddle, and store, only your Paddle customer id, your Paddle subscription id, your tier, the status of the subscription and its renewal and cancellation dates. We never receive card or bank details and we do not store a billing e-mail address. We use this data to give you what you paid for (turning advertising off and showing your badge) and to manage cancellation. The legal basis is performance of the contract (UK GDPR Article 6(1)(b)). It is deleted with your account; when you delete your account we first cancel your subscription with Paddle. Paddle keeps its own transaction records under its own legal obligations. The terms of sale and the refund policy are at /supporter/terms.

We use a small number of cookies:

• Session cookie (__Secure-authjs.session-token, plus short-lived Auth.js sign-in cookies): keeps you logged in and protects sign-in. Strictly necessary.
• Language cookie (prolific-locale): remembers the language you chose. Strictly necessary for that feature.
• Browser storage (local and session storage, not cookies): remembers your light or dark choice, votes you cast before registering, banners you dismissed, how often an announcement has been shown, and which pages were already counted in this browsing session. It stays on your device and we do not use it to identify you.
• Cloudflare: Cloudflare and its Turnstile check may set strictly necessary security cookies or storage to block bots and abuse.
• Google Analytics (_ga and related cookies): distinguish visitors for traffic measurement. Set by Google, only in line with your consent choice where consent is required.
• Mediavine and its advertising partners: cookies and local storage for serving and personalising ads, only in line with your consent choice where consent is required.

For visitors in the UK and EU, a consent banner provided by Mediavine's consent tool appears on your first visit, which is meant to let you accept or reject non-essential cookies (for example with a "Reject All" option) and change your choice later. The options shown are set by that tool. Strictly necessary cookies do not need consent. We do not add social media trackers or device fingerprinting ourselves.

The Website works with Mediavine to manage third-party interest-based advertising appearing on the Website. Mediavine serves content and advertisements when you visit the Website, which may use first and third-party cookies. A cookie is a small text file which is sent to your computer or mobile device (referred to in this policy as a “device”) by the web server so that a website can remember some information about your browsing activity on the Website.

First party cookies are created by the website that you are visiting. A third-party cookie is frequently used in behavioral advertising and analytics and is created by a domain other than the website you are visiting. Third-party cookies, tags, pixels, beacons and other similar technologies (collectively, “Tags”) may be placed on the Website to monitor interaction with advertising content and to target and optimize advertising. Each internet browser has functionality so that you can block both first and third-party cookies and clear your browser’s cache. The "help" feature of the menu bar on most browsers will tell you how to stop accepting new cookies, how to receive notification of new cookies, how to disable existing cookies and how to clear your browser’s cache. For more information about cookies and how to disable them, you can consult the information at All About Cookies.

Without cookies you may not be able to take full advantage of the Website content and features. Please note that rejecting cookies does not mean that you will no longer see ads when you visit our Site. In the event you opt-out, you will still see non-personalized advertisements on the Website.

The Website collects the following data using a cookie when serving personalized ads:

• IP Address
• Operating System type
• Operating System version
• Device Type
• Language of the website
• Web browser type
• Email (in hashed form)

Mediavine Partners (companies listed below with whom Mediavine shares data) may also use this data to link to other end user information the partner has independently collected to deliver targeted advertisements. Mediavine Partners may also separately collect data about end users from other sources, such as advertising IDs or pixels, and link that data to data collected from Mediavine publishers in order to provide interest-based advertising across your online experience, including devices, browsers and apps. This data includes usage data, cookie information, device information, information about interactions between users and advertisements and websites, geolocation data, traffic data, and information about a visitor’s referral source to a particular website. Mediavine Partners may also create unique IDs to create audience segments, which are used to provide targeted advertising.

If you would like more information about this practice and to know your choices to opt-in or opt-out of this data collection, please visit National Advertising Initiative opt out page. You may also visit Digital Advertising Alliance website and Network Advertising Initiative website to learn more information about interest-based advertising. You may download the AppChoices app at Digital Advertising Alliance’s AppChoices app to opt out in connection with mobile apps, or use the platform controls on your mobile device to opt out.

For specific information about Mediavine Partners, the data each collects and their data collection and privacy policies, please visit Mediavine Partners.

The website and database are hosted in Germany. Because the Platform is operated from Egypt, the operator reaches your data from outside the UK and EEA, over encrypted connections and with access limited to the single operator. Some of the service providers listed above are based in, or process data in, other countries outside the UK and EEA, such as the United States. Where UK or EU law requires a safeguard for a transfer, we rely on the safeguards those providers offer, such as adequacy decisions or standard contractual clauses. Email privacy@prolifictea.com if you want to know which safeguard applies to a provider.

• Reviews, comments and ratings are kept for as long as the Platform operates, unless you delete them yourself, or we remove them because they break our rules or the law, or because a researcher's objection succeeds.
• Account data (email, display name) is kept while your account is active.
• You can delete your account at any time from your profile page. If you have a password you confirm with it; if you only ever used Google we email you a one-time code to confirm. Deleting permanently removes your account, your reviews and comments (with any replies under them), your votes, the flags you filed, your push subscriptions, your Telegram link, your Prolific ID submissions and the submission history you shared through the extension. Researcher pages and study records you helped create stay, but are no longer linked to you. Bug reports you sent stay, with your email address and account link removed.
• Earlier versions of an edited review or comment are kept with it and deleted with it. When we redact a researcher page, the earlier versions of reviews about that researcher are deleted too.
• Study details shared through the extension are kept for as long as the Platform operates, because they form part of the community record about researchers.
• Push subscriptions are kept until you unsubscribe or delete your account. A Telegram link is kept until you unlink it, uninstall the extension, or delete your account; an unfinished link request is deleted when its 15-minute code expires.
• Email verification, password reset and account deletion codes are short-lived (minutes to 24 hours) and are deleted once used or expired.
• Bug reports are kept while they are open. Once a report has been resolved or dismissed for 180 days, we remove the email address and account link from it and keep the description.
• Page view counts contain no personal data and are kept for statistics. The short-period counts behind the trending list are deleted after 24 hours.
• Banned IP addresses are kept until the ban is lifted.
• Database backups are kept offsite for a limited time (our target is 30 days). Data you delete from the live site can remain in a backup until that backup expires. We use backups only to recover the site after a failure, and if we ever restore one we delete again anything that had been deleted.
• Image and GIF uploads were removed in October 2026. Images uploaded before then are no longer shown anywhere on the Platform but may still be held in storage. Email privacy@prolifictea.com and we will delete the ones you uploaded.

Depending on where you live, you may have the following rights. The right to object deserves a separate mention: where we rely on legitimate interests, you can object at any time on grounds relating to your situation, and we will stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.

• Access: request a copy of the personal data we hold about you. If you have an account you can download it yourself as a file by opening prolifictea.com/api/user/export while signed in (up to 3 times an hour).
• Rectification: ask us to correct inaccurate data.
• Erasure: ask us to delete your personal data.
• Restriction: ask us to limit how we use your data.
• Object: object to processing based on legitimate interests.
• Data portability: the download above is a machine-readable JSON file; you can also ask us to send your data to you in that format.
• Withdraw consent: change your cookie choices at any time through the consent banner.

To exercise any of these rights, contact us at privacy@prolifictea.com. We will respond within one month. For complex requests we may extend this by up to two more months, and we will tell you if we do. We may ask for the information we need to confirm who you are, and no more.

If you are a researcher on Prolific: we do not publish the names of individual researchers. You can object to our processing of your Prolific researcher ID, ask us to correct it, or ask us to review, hide or remove a page or a specific review, by emailing privacy@prolifictea.com with your Prolific researcher ID and the page concerned. Reviews are participants' own opinions. We remove them when they break our Terms of Service or the law, or when your objection outweighs our legitimate interests.

You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk), or to the data protection authority where you live. We would appreciate the chance to resolve your concern first.