question.mediaContact the desk

question.media · the press desk of the question.* family · Powered by question.technology

Every claim, printed next to the line that proves it.

A press page exists to be quoted, and a quote travels without its scope. So this one prints every claim beside the exact constraint, symbol or migration comment you can check it against — including the ones that cut against us.

Read the claims register See what cuts against us →

There is no press kit to download, no logo pack, no press-release archive, and no embargo programme on this page, and each of those is named plainly below rather than left as a missing menu item. Money is off here. Nothing here is AI.

Four columnsa stored response row has an id, an owner, an hour, and a moderation state, and nothing that names a person

Hour-coarseneda named database check rejects a precise timestamp rather than storing it

Founder-only todaythe migration records that exactly one owner exists, and this page repeats it rather than implying scale

No press kitno download, no logo pack, no release archive; an email address a person reads

One engine, several front doors, one press desk

The question.* family is one shared response engine with front doors aimed at different readers, all built by one team, on one security model, one support operation, and one platform.

question.technology is the engine: the shared question-authoring and response-collection surface the whole family runs on.

question.software is the classroom front door: where a teacher writes questions, runs them with a class, and reviews the responses.

question.company is the venture behind the family: who builds it, how it operates, and its honest stage.

question.management is the district-operations facet, for an administrator standing the engine up across more than one building.

question.media — this page — is the press desk: the register of what we claim and what settles it, the limits we publish against ourselves, and the words we will not confirm if a draft uses them about us.

Powered by question.technology. One engine underneath means a claim checked on this page holds for the other front doors too, which is why the register lives here rather than being restated five times.

The claims register

What we claim, and the exact line that settles it

This is the spine of the page. Each card states a claim in plain language and then names the database constraint, the migration, or the shared-library symbol that decides whether it is true. The point is not that you take our word for it; the point is that you do not have to, because a claim printed beside its own constraint can be checked by anyone who can read a schema.

A stored response has no column that names a person

Checkable in the database or the shared library today

The table a response is written to has exactly four columns: an id, an owner column, the time it arrived, and a moderation state. There is no field for a name, an email address, an IP address, an account, a session, or a device fingerprint. This is worth more than a policy promise, because a column that does not exist cannot be quietly filled in by a later bug.

CheckCREATE TABLE qt_submission (id, owner_org_id, submitted_at, moderation_state) -- migration 1103_question_technology.

The response time is coarsened to the hour by the database, not by a route

Checkable in the database or the shared library today

A stored response keeps only the hour it arrived. This is not a convention that a future route could forget: it is a named CHECK constraint, so a route that tries to write a precise timestamp is rejected by the database outright. The migration comment states the intent in the same terms.

Checkck_qt_submission_submitted_at_hour_coarse CHECK (submitted_at = date_trunc('hour', submitted_at)); DEFAULT date_trunc('hour', now()).

An individual answer carries no timestamp at all, on purpose

Checkable in the database or the shared library today

The answer row deliberately has no time column of its own. If it had one, a precise per-answer timestamp would sit directly beside a deliberately coarsened submission time and quietly undo it. The migration says exactly that, which is why this is a design decision on the record rather than an omission.

Checkqt_answer has no created_at column -- migration 1103: a precise per-answer created_at would silently defeat the coarsening on the row next to it.

A flagged response is labelled, never deleted

Checkable in the database or the shared library today

Moderation state is a two-value constraint. A response that trips moderation is marked as flagged and kept; it is not silently dropped. That matters for a reporter because it means the moderation story is about labelling and review, not about disappearing responses.

Checkck_qt_submission_moderation_state CHECK (moderation_state IN ('accepted','flagged')).

Moderation runs on the server before a response is stored

Checkable in the database or the shared library today

The moderation decision is made in a server-side function on the write path, not in the browser where a determined submitter could skip it. There is one function that produces the verdict, so there is one place to read to know what the rule actually is.

CheckmoderateQtSubmission(texts) in apps/api/src/moderation/question-technology-moderation.ts.

Declared roles are self-declared and unverified, and we call them that

Checkable in the database or the shared library today

A respondent may tag themselves with roles when answering. Those tags are not checked against any roster or directory, and the schema documentation is explicit that they are a claim about a role rather than a fact about a person. We do not describe them as verified, and neither should a story about us.

Checkqt_submission_realm -- migration 1103: self-declared, NOT verified, NOT an identity; a claim about a ROLE, never about a person.

There are three answer shapes, and the database enforces the list

Checkable in the database or the shared library today

Everything the engine can ask composes from three answer shapes: open text, a numeric scale, and a single choice. The list is enforced as a database constraint rather than as application convention, and the scale bound lives in one shared constant so it cannot drift between the client and the server.

Checkqt_question.type CHECK IN ('text','scale','choice'); SCALE_RANGE in packages/shared/src/question-technology.ts is the single fallback bound.

Question sets have an enforced lifecycle, not a free-text status

Checkable in the database or the shared library today

A question set is draft, published, or archived, and the database refuses anything else. Keys and titles are shape-checked too. This is small, but it is the difference between a product with a real state machine and a screen that stores whatever it is handed.

Checkck_qt_question_set_status CHECK IN ('draft','published','archived'); ck_qt_question_key_shape; ck_qt_question_text_nonempty.

If a claim you need is not on this list, it is not because we ran out of room. Email the desk and we will either add it with its evidence line or tell you we cannot support it.

Published against ourselves

The limits our own engineering notes record

A press page usually stops at the claims. These are the caveats, quoted from the migration comments where our own engineers wrote them down at the time. They are here because a limit a reader discovers on their own costs far more than a limit we printed first, and because the fact that these notes exist at all is a more useful signal about how this is built than any adjective we could offer.

A rare combination of self-declared roles can still single someone out

A limit we publish against ourselves

This is the caveat that stops us using a single comfortable word for the property above. No identity column and an hour-coarsened time are real, but if a respondent tags themselves with an unusual combination of roles, that combination can itself narrow the field to one person. Our own migration note raises this rather than leaving a reader to discover it, and records that it was reported rather than quietly resolved.

a rare realm COMBINATION is itself quasi-identifying (a lone “superintendent + studio” respondent stands out)
migration 1103_question_technology, noted as reported, not silently resolved

The engine is founder-only today, and the owner column is not a tenancy wall yet

A limit we publish against ourselves

It would be easy to present the owner column on every table as proof that one organization’s data is walled off from another’s. Today that would overstate it. The migration records that exactly one owner exists, that the column always resolves to it, and that the column is deliberately not named as a tenancy anchor because it is not one yet. The column exists so the product can serve more than one owner later without a rewrite, and that is the honest version of the claim.

TODAY exactly one owner exists ... so owner_org_id ALWAYS resolves to the founder and the MVP is founder-only ... it is NOT a tenancy anchor today
migration 1103_question_technology, ownership section

Read access is currently narrower than a per-tenant rule, not broader

A limit we publish against ourselves

The direction of this caveat matters, so we state it plainly: the current row-level policy is stricter than a per-tenant policy, not looser. Nothing but the system lane reads these rows at all today. We flag it because a reader deserves to know the posture is a placeholder for a real per-owner rule, not because it is a hole.

the system-only policy is STRICTER than tenant_iso –– nothing but the system lane reads at all
migration 1103_question_technology, ownership section

We changed a column and wrote down what it broke

A limit we publish against ourselves

A later migration made the owner column nullable on this spine, which quietly removed uniqueness protection for rows owned by a school rather than an organization, because a database treats nulls as distinct. The follow-up migration exists specifically to close that, and its header describes the bug in full. We would rather a reporter see that we write these down than discover we do not.

for a school-owned row owner_org_id IS NULL, and Postgres treats NULLs as DISTINCT ... school-owned rows LOSE key-uniqueness
migration 1145_qt_owner_school_unique, header

Each quotation above is from a migration file in the product repository, not from a marketing document written afterwards. That is deliberate: an engineering note recorded before anyone needed it for a press page is harder to have shaped for one.

Radically legible about our stage

What this page does not offer, and why not

A press page is judged as much by its missing menu items as by its copy, so here is the inventory out loud. The left column is what a press page usually offers. The right column is what this one actually does, and in every row the absence is a decision rather than a gap somebody forgot to fill.

The left column is what a press page usually offers. The right column is what this one actually does, stated so an absence never reads as an oversight.
What a press page usually offers	What this page does
A downloadable press kit with logos, headshots and boilerplate	There is no press-kit download and no brand-asset pack on this page. If you need a mark, a description, or a founder photograph for a story, email the address below and a person will send what exists rather than point you at a folder that does not.
A press-release archive and a newsroom subscription	There is no press-release archive and no subscription list here, because we have not issued press releases. A page of empty categories would imply a publishing cadence that does not exist.
A wall of press mentions, awards and analyst logos	There are none to show. We will not fill that space with a placeholder, a stock badge, or a mention of a directory listing dressed up as coverage.
An embargo programme and an exclusive on request	There is no embargo programme. We do not offer exclusives, and we do not ask to review copy before publication. If you send a claim to check, we will confirm or correct it and say which.
A customer count, a user number, or an adoption statistic	We publish none, because the engine is founder-only today by the migration’s own account, and any number we printed would be measuring something other than what a reader would assume it meant.
A privacy claim summarised in one reassuring word	We avoid the single-word version deliberately. The precise properties are listed in the claims register, and the residual risk that stops us reaching for the comfortable word is printed in the caveats section directly above.
A media-relations contact form that routes into a ticket queue	There is no form on this page and no ticketing system behind the address. It is an email address that a person on the team reads.

Naming these plainly is what keeps the claims register above believable. A page that offered a logo wall it had to invent would give you no reason to trust the constraint citations either.

For a fact-checker with a draft

Words we will not confirm, and what we will say instead

If you send us a draft, these are the phrases we will ask you to change, with the reason and the replacement we will confirm on the record. This section exists because the most common way a story about a small product goes wrong is not a fabricated fact; it is a true fact compressed into a word that promises more than the fact does.

Words we will not confirm if a draft uses them about us, why, and the checkable phrasing we will confirm instead.
Word	Why we will not confirm it	What we will confirm
The one-word privacy claim	The stored row has no identity column and the time is hour-coarsened, but a rare combination of self-declared roles can still narrow a field to one person, as our own migration note records.	Say what is true: no identity column is stored, and the response time is coarsened to the hour by a database check.
Any phrasing that makes this a model	Nothing in this family uses a model. No model writes a question, scores a response, ranks an answer, or grades a student.	Say the engine collects and scores responses with plain, readable rules.
Tenancy language	The migration states that exactly one owner exists today and that the owner column is deliberately not a tenancy anchor yet.	Say the schema is built so a second owner can be added later without a rewrite, and that today it is founder-only.
A compliance certificate	Neither law certifies products, so no honest vendor holds such a certificate, and we hold none.	Say the product is designed to support a school’s obligations, and that its data practices are written down for review.
Enterprise-ready or battle-tested	We have not run the kind of load or the kind of audit that would let us stand behind either phrase if a reader leaned on it.	Say the engine runs in production and describe the constraints that are enforced.
Secure, or any absolute privacy word	An absolute is not checkable, and the moment it is quoted it becomes a promise nobody measured.	Name the specific mechanism: the column that does not exist, the check that rejects a precise timestamp, the policy that limits reads.

The replacements are longer than the words they replace. That is the trade: a checkable sentence costs a few more words than a comfortable one, and it survives being quoted out of context.

The second reader of this page

For a school media programme thinking about a reader survey

A student newspaper, a broadcast programme, or a yearbook staff sometimes wants to ask its readers a question and print what came back. The engine can do that, within limits worth knowing before the idea reaches a story meeting. These five steps describe the real shape of it, including the two places where the answer is no.

Step 1

You are asking readers, not sources

The engine is built for asking a group a set question and collecting the answers, with no identity column on the stored row. That fits a reader survey or an audience poll. It is not a source-management tool and does not track who told you what, so do not plan to use it as one.

Step 2

Three shapes to write in

A student editor composes from open text, a numeric scale, and single choice. That is the whole vocabulary, enforced by the database, so a survey design conversation is short and there is no hidden question type to discover later.

Step 3

What you can honestly print from the results

You can report the distribution of answers and the hour a response arrived. You cannot report who answered, and you should not describe respondents as unidentifiable without reading the caveat above about rare role combinations first.

Step 4

Moderation is on the write path

Responses run through a server-side moderation function before they are stored, and a flagged response is marked rather than removed. A newsroom advisor should know that flagged material still exists and is reviewable, not silently gone.

Step 5

Getting access is a conversation, not a signup

The engine is founder-only today, so there is no self-serve route for a school media programme to stand this up alone. Email the address below and we will tell you honestly whether what you want to run is something the engine does today.

The most important line above is step three: what you can honestly print from the results. A survey is only as good as the sentence a reader can safely write about it.

Which reader are you?

A press desk is read by a reporter on deadline, an editor deciding whether there is a story at all, a fact-checker holding a draft, a student journalist, an analyst, and a parent who arrived from something they read. They do not want the same thing, so here is where each should start.

Who you are, where to start on this page, and why that section is the right door.
You are	Start with	Because
A reporter checking a claim before filing	The claims register, then Caveats	Each claim names the constraint or symbol that settles it, and the caveats section lists what we will not let you print unchallenged.
An editor deciding whether there is a story	What this page does not offer	See the honest inventory first, so you know there is no logo wall, no funding announcement, and no adoption number waiting behind a form.
A fact-checker with a draft in hand	Words we will not confirm	Find the phrase your draft uses and the checkable sentence we will confirm in its place.
A student journalist or media advisor	For a school media programme	Understand what the engine does for a reader survey and, more importantly, what it is not built to do.
An analyst sizing the category	Caveats, then Trust and data	The founder-only posture and the read policy are stated plainly, which is the part a category model usually gets wrong.
A parent or school administrator who found this page from a story	Trust and data	See how a response and a minor’s record are actually handled, without the marketing compression.

Trust & data

How a response is actually treated

This is the custody register, stated as scoped facts rather than as an absolute promise. Every line here corresponds to something in the claims register or the caveats above, so a reporter can move between the plain-language version and the constraint that backs it without leaving the page.

A response row has no identity column

Four columns: an id, an owner, an hour-coarsened time, and a moderation state. No name, email, IP address, account, session, or fingerprint field exists on the row to be filled in later.

The stored time is coarsened by a database check

Only the hour a response arrived is stored, and a named CHECK constraint rejects a precise timestamp rather than accepting it quietly. The answer row has no time column of its own, deliberately.

Declared roles are unverified claims about a role

Self-declared role tags are never checked against a roster, and we describe them as claims about a role rather than facts about a person. A rare combination of them can still be quasi-identifying, which is why we avoid an absolute word for this property.

Flagged responses are labelled, not destroyed

Moderation marks a response as flagged and keeps it. There is no silent deletion path, so a moderation decision is reviewable rather than invisible.

Data is stored on infrastructure we run

Responses and question sets are held inside the estate on infrastructure we operate. We hold them to run the service; they are not sold, and they are not brokered to a third party.

A minor’s record is consent-gated

A minor’s name, face, and record are consent-gated and not publicly browsable, and consent can be withdrawn. That is the standing rule across the estate and it is not relaxed for a press enquiry.

No certification claim

FERPA does not certify products and we claim no certification under it or COPPA. The product is designed to support a school’s obligations, and its data practices are documented so they can be reviewed rather than taken on faith.

What about export or deletion? Both are handled by a person on the team on direct request rather than by a self-serve button, and we describe it that way because that is what exists today.

This describes the intended data model and the constraints that enforce parts of it. It does not promise certified compliance, zero logging, or automatic deletion, and it claims no FERPA or COPPA certification.

Money, said plainly

Money is off on this page

There is no price on this page and no checkout on it. Nothing here takes a payment, captures a card, or moves anyone onto a paid plan. A press desk is an especially bad place for a pricing table, because a price quoted in a story outlives the page it was read from.

No published tier or payment action is offered here. The contact link is an inquiry route; it does not create a quoted subscription or a charge on this page.

Is that a way of dodging the number? No. The honest reason there is no price here is that self-serve billing for this engine does not exist, and printing a number this page has no way to charge on would be the kind of claim the rest of this page exists to avoid.

FAQ

Questions a reporter actually asks

Is there a press kit I can download?

No. There is no press-kit download, no logo pack, and no boilerplate folder on this page. Email the address below and a person will send the mark, the description, or the photograph that actually exists, rather than direct you to an empty archive.

How many schools or users are on this?

We publish no adoption number. The engine is founder-only today by the migration’s own account, so any figure we printed would be measuring something other than what a reader would assume it meant. We would rather say that than round something up.

Is there a single word I can use for the privacy property?

We would ask you not to, and the reason is in the caveats section above rather than hidden. The stored row genuinely has no identity column and the time is coarsened to the hour by a database check, but a rare combination of self-declared role tags can still narrow a field to one person. Describe the specific properties instead; they are stronger and they are checkable.

Is any part of this AI?

No. Nothing in the question.* family is AI. No model writes a question, scores a response, ranks an answer, or grades a student. If a draft describes this product as artificial intelligence, that is the one correction we will always ask for.

Will you give me an exclusive, or review my copy before it runs?

No to both. We do not offer exclusives and we do not ask for copy approval. If you send us a claim to check, we will confirm it or correct it and tell you which of the two we did.

Why does this page quote your own migration comments against you?

Because a claim a reporter cannot check is worth very little, and the limits are the part a press page usually leaves out. Quoting the engineering note that records a limit is the cheapest way to show the limit was known and written down rather than discovered by a reader.

What does it cost?

There is no price on this page and no checkout on it. Money is off here. Because the engine is founder-only today, pricing is a direct conversation rather than a published tier.

How is question.media different from question.company?

question.company is the venture behind the family: who builds it, how it operates, and its honest stage. question.media is the press desk: the claims register, the words we will not confirm, and the caveats we publish against ourselves, aimed at someone about to print a sentence about us.

Can a student newspaper use the engine for a reader survey?

That is the second reader of this page, and the section above sets out what the engine does and does not do for a media programme. The short version: it collects answers to set questions without an identity column, it is not a source-management tool, and access today is a conversation rather than a signup.

Who owns this, and who do I attribute it to?

question.media is one front door of the question.* family, which runs on the shared question.technology engine and is built inside Stanley Studios. Attribute the engine to question.technology and the venture to Stanley Studios, and email us if a story needs the relationship described more precisely.

How fast will you answer a deadline question?

We do not publish a response-time commitment, because we have not measured one we would stand behind and a press page is the worst place to invent a service level. Say in your first line that you are on deadline and when it is, and a person will tell you promptly whether they can meet it.

Contact

Contact the desk

Whether you are checking one sentence before filing, deciding whether there is a story here at all, or asking on behalf of a school media programme, it is the same address and a person reads it.

Email [email protected]. There is no form on this page, no card asked for, and no student data requested — please do not send any.

If you are on deadline, say so in the first line and give the time. We publish no response-time commitment because we have not measured one we would stand behind, and inventing a service level on a press page would be the exact failure this page is built against.

If you think something on this page is wrong, that is the most useful message you can send. We will correct it and say that we did.

Email [email protected] Back to the claims register →

Powered by question.technology · a Stanley Studios venture · money is off · nothing here is AI.

What this page does not claim

The response engine runs in production, a stored response row has no column that names a person, and the stored time is coarsened to the hour by a database check that rejects precision. Those are the strongest true things here and each one names its own constraint above.

The engine is founder-only today. The owner column on these tables is not a tenancy wall, our own migration says so in those words, and this page does not describe it as one.

There is no press kit, no logo or brand-asset pack, no press-release archive, no embargo programme, and no media-relations form on this page. There are no press mentions, awards, or adoption numbers to cite, because none exist and none may be invented to fill the space.

We avoid a single reassuring word for the privacy property, because a rare combination of self-declared role tags can still narrow a field to one person, and our own migration note records that.

Money is off: no price and no checkout. Nothing here is AI. A minor’s record is consent-gated and not publicly browsable, and we claim no FERPA or COPPA certification.

Contact the desk Back to the caveats →