question.foundationTalk to us

question.foundation · the education-foundation address of the question.* family · Powered by question.technology

Ask your community. Do not end up holding a list of who said what.

A foundation’s hardest survey is the one about its own programs. This is what the response engine actually stores when you run one — four columns, none of them a person — and what it flatly does not do.

Talk to us See what a response row holds →

This engine takes no money: there is no donation, pledge, payment or checkout path in it, and no donor, grant or pledge record. There is no form on this page. Money is off here. Nothing here is AI.

Four columnsa stored response holds id, owning organization, hour, and a moderation verdict — nothing else

Hour-coarseneda database check refuses any response row that carries a more precise time

Row-level security, forcedthe response table admits only the system role, so isolation does not depend on the query

No money pathno donation, pledge, payment or checkout code exists in this engine

One engine, several front doors, one foundation facet

The question.* family is one shared response engine with front doors aimed at different readers, built by one team, on one security model, one support operation, and one roadmap. You are not buying four products that happen to share a logo.

question.technology is the engine: the shared question-authoring and response-collection surface the whole family runs on.

question.software is the classroom front door: the place a teacher writes questions, runs them with a class, and reads the responses.

question.management is the district-operations facet: how a district stands the engine up across buildings, and what an administrator still does by hand.

question.company is the venture behind the family: who builds it, how it operates, and its honest stage.

question.foundation — this page — is the education-foundation facet: for the organization alongside a district, funding programs and needing to ask the community about them without collecting a record of who answered.

Powered by question.technology. A foundation pays for the underlying platform and the capabilities it selects, not repeatedly for the same engine wearing different brands.

Provable now

What a response row actually holds

A promise about privacy is worth what its enforcement is worth. Everything in this section is a property of the response engine running today, read off the real database schema and the real route code, and each card names the exact table, column, constraint or policy that enforces it so a board member or a district counsel can check it rather than take our word.

A response row has four columns, and none of them is a person

Enforced in the running system today

When somebody answers a foundation's question set, the row that gets written holds an opaque id, the organization that owns the question set, the hour it arrived, and a moderation verdict. That is the entire row. There is no name field, no email field, no address field, no account field, and no share-token field for a later query to join back to a person, because none of those columns exists to be filled in.

EvidenceCREATE TABLE qt_submission (id, owner_org_id, submitted_at, moderation_state) -- migration 1103_question_technology. No identity column of any kind.

The time is coarsened to the hour by the database, not by a policy

Enforced in the running system today

A board member who wants to know who complained can usually get most of the way there from a precise timestamp and the moment a link went out. That reconstruction is unavailable here: the stored time keeps only the hour, and a database check refuses any row that carries more precision than that. A bug in a route cannot store a precise moment, because the row is rejected.

Evidencesubmitted_at DEFAULT date_trunc('hour', now()) with CONSTRAINT ck_qt_submission_submitted_at_hour_coarse CHECK (submitted_at = date_trunc('hour', submitted_at)).

The owning organization is set by the server, never by the sender

Enforced in the running system today

A foundation's responses belong to its organization because the server resolves the owner from the question set being answered. The value is never read off the payload the responder submits, so a crafted request cannot write into another organization's data, and the column is a real foreign key rather than a loose string.

Evidenceowner_org_id inherited server-side from the resolved question set; CONSTRAINT qt_submission_owner_fkey FOREIGN KEY (owner_org_id) REFERENCES partner_org(id) ON DELETE RESTRICT.

Row-level security is on, and forced

Enforced in the running system today

Isolation between organizations is not left to whichever query somebody writes next. The response table has row-level security enabled and forced, with a policy that admits only the system role, so an application bug that forgets a WHERE clause still does not hand one organization another organization's rows.

EvidenceALTER TABLE qt_submission ENABLE ROW LEVEL SECURITY; FORCE ROW LEVEL SECURITY; POLICY qt_submission_system_only USING (is_system()) WITH CHECK (is_system()).

Three answer shapes, and the database enforces which three

Enforced in the running system today

A listening round, a grant-feedback form and a program review all compose from the same three shapes: open text, a one-to-five scale, and single choice. The type column is constrained to exactly those three, and a scale question is required to say in words what its low end and its high end mean, so a board never has to guess whether a 4 was good.

EvidenceCONSTRAINT ck_qt_question_type CHECK (type IN ('text','scale','choice')); SCALE_RANGE = {min:1,max:5} exported from packages/shared/src/question-technology.ts.

Moderation runs on the server before anything is stored

Enforced in the running system today

Open-text community feedback is where a survey gets ugly. The engine screens free text server-side before the row is written: hate, sexual content and spam are refused outright and never stored, while a borderline response is stored with a flag on it rather than thrown away, so a foundation reviewing its own results is not quietly having them edited.

EvidencemoderateQtSubmission() in apps/api/src/routes/question-technology.ts -- reject verdicts are never stored; a flag writes moderation_state 'flagged' under CHECK IN ('accepted','flagged').

The column set is pinned by a test against the real table

Enforced in the running system today

The promise above is only worth as much as the thing that stops it drifting. The exact column set is asserted against the applied database schema by a test in the estate, so adding an identity column to this table turns a test red instead of shipping quietly on a Tuesday.

Evidencepackages/db/src/migration-1103-zero-pii.test.ts asserts the qt_submission column set against information_schema.

These are storage-layer properties, not settings. Changing one means a migration and a red test, which is the point of stating them this way.

Radically legible about our stage

What this is, and what it flatly is not

A page with the word foundation in its name is the easiest place in this estate to imply a donate button, a donor database, or a grant tracker. So here is the ledger, out loud. The left column is what a page like this usually implies. The right column is the honest version for Question.

The left column is what a foundation-facing page usually implies. The right column is the honest version for Question, stated so an absence never reads as an accident.
What this kind of page usually implies	The honest version for Question
A donate button, a gift form, or a preset giving level	There is none, and there is no code behind one. The question engine has no donation, pledge, payment or checkout path in it at all. If you want a giving page, we are not the thing you are looking at right now, and we would rather say that than put a button here that goes nowhere.
Donor management, a pledge ledger, or grant tracking	Not built for Question. This engine collects and stores responses to question sets. It does not hold a donor record, a pledge, a grant deadline, or an acknowledgement letter, and no screen in it does.
A benchmark against other foundations	The data model isolates your organization from every other organization on the engine, which is the opposite of a benchmark. There is no cross-organization comparison view, and building one would mean deliberately weakening the isolation this page is selling.
A self-serve signup, a free trial, or a plan picker	There is no form on this page and no signup path on this host. A foundation is seated as an organization by us, directly, after an email. That is a real step performed by a person, not a wizard we are hiding.
Response counts, a foundation logo wall, or an adoption figure	There are none to show, so there are none shown. Inventing a number or a logo to fill the space is exactly the failure this page exists to avoid, and a foundation checking our claims should be able to check this one too.
A compliance badge or a certification seal	FERPA does not certify products, so we claim no certification and no blanket compliance. What we will do is describe precisely what the table stores and let a board or a district counsel read it.

One narrowing we owe you, because a flat version of it would be false: the wider school platform this team also builds does hold a real donation and receipting system. That is a different product, it is not reachable from this response engine, and it is not what this page is offering. We would rather draw that line ourselves than let you discover it.

How a listening round actually runs

Six steps, and the first one is an email to a person

There is no wizard behind a login here. This is the real sequence, in the order it happens, so a foundation can plan a timeline against what exists rather than against an assumed self-serve product.

Step 1

You email us and we seat your organization

There is no signup form here. A foundation writes to the address at the bottom of this page, tells us what it wants to ask and who it wants to ask, and we create the organization row your question sets and responses will belong to.

Step 2

You write the question set

Questions are authored as open text, a one-to-five scale, or single choice. A scale question has to state what its ends mean before it can be used, which is the difference between a board reading a number and a board arguing about one.

Step 3

You share a link with your community

A responder opens the link and answers. They are not asked to make an account, and the row that is written for them has no column that could hold one, so there is nothing to reconcile afterwards and nothing to leak.

Step 4

The server screens free text before it stores anything

Hate, sexual content and spam are refused and never written. A borderline response is written with a flag on it so a human can look, rather than being silently dropped out of a result a foundation is about to report on.

Step 5

You read the results, scoped to your organization

Results are read back inside your own organization. Row-level security is forced on the table, so the isolation between your foundation and every other organization on the engine holds at the database, not only in the query somebody wrote.

Step 6

You report to your board, and the raw rows stay boring

The strongest thing a foundation can tell a nervous respondent is what the record physically contains. Here that is four columns and an hour. A board report can quote that sentence and a district counsel can verify it against the schema.

Step one is a person doing a real setup task. We name it as a step rather than hiding it behind a button, because a foundation planning a board deadline needs to know a human is in the loop.

Which reader are you?

A foundation page gets read by a director, a board member, a grantmaker, a privacy officer, a parent, and somebody who arrived looking for a donate button. They do not want the same paragraph. Here is where each should start.

Who you are, where to start on this page, and why.
You are	Start with	Because
A foundation director planning a listening round	How a round runs, then What we are honest about	See the six real steps and the five things this engine flatly does not do before you scope the project.
A PTO or booster-club board member	What is actually running	Read the four columns a response actually contains, so you can answer the parent who asks whether it is traceable.
A grantmaker or program officer reading a report	What is actually running, then Trust and data	Check the constraint that makes the timestamp coarse, so a reported finding is not resting on a claim you cannot verify.
A district counsel or privacy officer	Trust and data	The custody register is scoped and specific, and every line of it names the constraint or policy that enforces it.
A parent or community member being asked to answer	What is actually running	See exactly what the record physically holds about you, which is an hour and nothing else.
Somebody looking for a donation page	Money, said plainly	This engine takes no money and has no giving path in it. That section says so directly rather than making you find out later.

Trust & data

The custody register, scoped and specific

Rather than an absolute promise, here is the same scoped register the rest of the family states, applied to a foundation collecting community feedback. Each line is narrow enough to be checked, which is the only kind of privacy claim worth printing.

No identity column exists on a response

The response row has no field for a name, email address, IP address, account, device fingerprint, or session. This is a property of the table, not a setting somebody could change in a config file without a migration and a red test.

The stored time cannot be made precise

Only the hour a response arrived is kept, and a database check refuses a row that carries more than that. The usual re-identification path -- match a precise second against the second a link was opened -- is closed at the storage layer.

One organization, one wall, forced at the row

Every response carries the organization that owns it, and row-level security is enabled and forced on the table with a system-only policy. A foundation is walled off from every other organization on the engine before any application check runs.

Data is stored on infrastructure we run

Question sets and responses are held on infrastructure inside our own estate. A foundation retains control of its own records; we hold them to run the service, and we do not sell them or hand them to an advertising network.

A minor's record is consent-gated

A minor's name, face and record are consent-gated and not publicly browsable across this estate, and consent can be withdrawn. That rule does not loosen because the survey was commissioned by a foundation instead of a school.

No certification claim, and no absolute promise

We do not claim a FERPA or COPPA certification, because FERPA does not certify products. We also refuse the absolute form of the promise -- the sentence that claims your data is permanently beyond every hand including ours -- because nobody can honestly guarantee it. What we state instead is what the table stores, which you can check.

What if a foundation wants an export, or wants everything deleted? Both are handled today by direct request: a foundation can ask for a full export of its organization's question sets and responses, or for the organization's data to be deleted, and a person on the team does it rather than a self-serve button doing it silently.

This describes the data model as it is enforced; it does not promise certified compliance, zero logging, or automatic deletion, and it claims no FERPA or COPPA certification.

Money, said plainly

This engine does not take money, and this page has no price

If you came here for a giving page, this is not one. The question engine has no donation path, no pledge record, no payment integration and no checkout in it. That is an absence in the code, not a switch somebody turned off, and we checked it rather than assumed it.

Here is the narrowing we owe you, because the flat sentence would be false about our estate: the wider school platform this team also builds does have a real donation and receipting system for schools. It is a different product on a different surface, it is not wired to this response engine, and nothing on this page reaches it. We are drawing that line ourselves because you would otherwise be right to suspect it.

There is also no price on this page and no checkout on it. Nothing here takes a payment, captures a card, or converts anyone to a paid plan. Because there is no self-serve tier for a foundation, what it costs is a direct conversation.

Is that just a way to avoid naming a number? No. The honest reason there is no price table is that self-serve billing for a foundation has not been built, and publishing a number this page has no way to charge on would be theater.

FAQ

Questions a foundation board actually asks

Can our foundation take donations through this?

No. The question engine has no donation, pledge, payment or checkout path in it — not disabled, not hidden behind a flag: absent. It collects responses to question sets. A giving page is a different product and this page will not pretend otherwise.

Can a response be traced back to the person who wrote it?

The row that is stored has four columns — an opaque id, the owning organization, the hour it arrived, and a moderation verdict — and none of them names a person. There is no name, email, address, account or session column on it to trace, and the time is coarsened to the hour by a database check so a precise moment cannot be matched against the moment a link went out.

How do we sign up?

You email us. There is no form on this page and no signup path on this host, so nothing here collects an address or creates an account. We seat your foundation as an organization directly, and a person does that step.

Does it manage grants, donors, or pledges?

No. There is no donor record, no pledge ledger, no grant deadline tracker and no acknowledgement-letter generator in Question. If a foundation needs those, it needs a different tool, and we will say so rather than stretch this one over the gap.

Can we compare our results against other foundations?

No, and the reason is structural rather than a missing feature. Every response carries the organization that owns it and row-level security is forced on the table, so organizations are walled off from each other. A benchmark view would mean deliberately weakening the isolation this page is selling.

What happens to a nasty open-text response?

Free text is screened on the server before anything is written. Hate, sexual content and spam are refused and never stored. A borderline response is stored with a flag on it rather than discarded, so a foundation reviewing its own results can see that a human decision was made instead of finding a silent hole in the data.

Is any of this AI?

No. Nothing here is AI. No model writes a question, scores a response, summarizes your community's feedback, or decides what your board reads.

What does it cost?

There is no price on this page and no checkout on it. Money is off here. Because there is no self-serve tier for a foundation, what it costs is a direct conversation, and we would rather have that conversation than publish a table this page has no way to charge on.

How is question.foundation different from question.management?

question.management is the district-operations page: how a school district stands the engine up across buildings and what an administrator still does by hand. question.foundation is for the organization ALONGSIDE a district — a foundation, PTO, PTA or booster club — whose central problem is asking a community about programs it funds without holding a record of who answered.

Can we verify the claims on this page?

Every card in the section above names the exact table, column, constraint or policy that enforces it, so a technically minded board member or a district counsel can check the claim rather than believe it. Anything on this page that you cannot check from those names, raise with us directly.

Contact

Talk to the people who run this

Whether you are a foundation director scoping a listening round, a board member checking whether responses are traceable, a grantmaker reading a claim in a report, or a privacy officer reading the custody register, the door is the same one, and a person reads it.

Email [email protected]. There is no form on this page, no card asked for, and no student data requested — please do not send any.

You might expect this address to queue into a ticketing system nobody reads. It does not: there is no ticketing system and no bot behind it, and a person on the team reads every message sent here.

Email [email protected] Read the FAQ →

Powered by question.technology · a Stanley Studios venture · money is off · nothing here is AI.

What this page does not claim

Question's response engine runs in production today, and the strongest true thing on this page is the shape of one database row: four columns, none of them a person, with the time coarsened to the hour by a constraint and row-level security forced on the table.

This engine has no donation path, no pledge record, no payment integration, no checkout, no donor database, no grant tracker and no acknowledgement-letter generator. The wider school platform this team also builds does have a donation and receipting system; it is a different product, it is not reachable from this engine, and nothing on this page touches it.

There is no cross-organization benchmark view, no self-serve signup on this host, no form on this page, no published response-volume figure, no foundation logo wall and no adoption count, because none of those exist and none may be invented to fill the space.

Money is off: no price and no checkout. Nothing here is AI. A minor’s record is consent-gated and not publicly browsable, and we claim no FERPA or COPPA certification — the product is designed to support an organization’s obligations, which is a different and smaller claim.

Talk to us Back to what is running →