Privacy
This is an awareness project, not a business. It has no accounts, no advertising and nothing to sell. The short version: the calculator keeps a copy of completed questionnaires, and may publish them — individually or in aggregate — because that is the point of gathering them. No name, email, address or personal identifier of any kind is attached to a questionnaire, so there is nothing in one that can be published back to you.
Last updated 8 August 2026.
What is stored
When you press See my estimateat the end of the calculator, the answers you gave are sent once to this project’s database and kept there. That is:
- the country and age band you selected, and the region if you chose one;
- your answers about drinking water, hot drinks, food frequencies, kitchen habits, indoor hours and the optional extras;
- the estimate those answers produced, so the figure can be read back later even after the underlying studies are updated;
- the date and time the questionnaire was completed;
- a randomly generated submission identifier, so a single questionnaire can be referred to without referring to a person.
What is not stored
No personal information is collected at any point, because none is ever asked for. Specifically, a stored questionnaire does not include, and is never joined to:
- a name, email address, phone number or postal address;
- an account — the calculator has no sign-in;
- your IP address, browser user-agent string, device identifier or any cookie or fingerprint;
- anything that links one submission to another, so repeat visits cannot be recognised or joined together.
A stored row therefore describes a questionnaire, not a person. The country and age band are there because the model needs them to pick the closest available study and serving sizes — a country and an age band do not identify anybody.
There is no analytics service, no tag manager, no advertising network and no third-party tracking script anywhere on this site.
What stays on your device
Your answers are also held in your browser’s session storage so you can move between the questionnaire and your result, and they are cleared when you close the tab. The estimate itself is computed in your browser — the 10,000 simulations behind your result run on your own device, not on a server.
If you share a result link, the answers travel inside the link’s fragment — the part after the #. Browsers do not send a fragment to the server, so sharing a link does not create another stored copy here. It does mean that anyone you send the link to can read the answers in it.
Publishing
The point of collecting questionnaires is to be able to say something about them in public, so submissions may be published. That may be aggregate figures — how often people report bottled water, how estimates differ by country — and it may be an individual questionnaire, published in full, where a particular combination of habits is worth showing on its own.
A published questionnaire carries only the answers, the estimate they produced, and a random submission identifier such as 3f0c8a12-…. That identifier is generated at random when the row is created; it is not derived from anything about you, and it is not a login, a session or an account. It exists so a published example can be referred to and corrected, not so anyone can be found.
Nothing else can be attached to a published questionnaire, because nothing else was ever collected. There is no name, address, IP address or device to withhold — the anonymity does not depend on a promise to redact something later.
This is a not-for-profit project. Questionnaires are not sold, licensed, rented or handed to advertisers, data brokers or any other commercial party, and publishing them earns nothing. Completing the calculator gives the project permission to publish your answers on those terms; the terms of use set out that permission precisely.
Who can see it
Before anything is published, stored questionnaires are readable only through a sign-in-protected page used to maintain the project.
Two services process data on this project’s behalf: the database host that stores the questionnaires, and Clerk, which handles sign-in for the maintenance page. Clerk only ever sees the maintainer’s sign-in — never a visitor’s, because visitors never sign in.
Your choices
If you would rather not contribute a questionnaire, simply do not complete the last step — nothing is sent until you ask for your estimate. You can also read the sample result instead, which sends nothing at all.
Once sent, a submission cannot be traced back and withdrawn on request: nothing recorded connects a row to the person who filled it in, so there is no way to tell which one was yours. That is the same property that makes it anonymous. The exception is a published questionnaire — if you can point to its submission identifier and explain the problem, it can be taken down. If you have a concern about the dataset as a whole, please get in touch.
Children
The calculator offers child and infant age bands so that a parent or teacher can model a child’s exposure. Choosing one of those bands stores an age band and nothing else — no information about a child is requested or retained.
Changes
If what is collected ever changes, this page changes with it and the date above is updated. See also the terms of use.