Privacy Policy

Last updated: 30 October 2026

This policy explains which personal data is processed when you use supinion, what we use it for and how long we keep it. The German version of this policy is legally binding; this English version is provided for convenience.

It has three parts:

• Part A – the website supinion.com with its public pages and templates,
• Part B – the app for everyone who has an account and creates presentations,
• Part C – audience members who join a poll, quiz or Q&A via QR code or access code.

After that come the sections that apply to all parts: recipients, transfers to third countries, retention, security and your rights.

1. Controller

TELEPANO, owner: Noel Weinberg
operating the brand 1337 Studios; supinion is a service of 1337 Studios.
Eurotec-Ring 15
47445 Moers
Germany
Phone: +49 2841 8887410
Email: hi@supinion.com

We have not appointed a data protection officer because we are not required to (Section 38 BDSG). Please send data protection questions to hi@supinion.com.

2. The short version

• We use no trackers in your browser, no third-party scripts and no advertising cookies. We measure the reach of our public pages on the server with Matomo, without cookies and without IP addresses (A.7).
• The website loads nothing from third-party servers: no external fonts, no third-party scripts, no content delivery network. A Content Security Policy (script-src 'self') only allows scripts from our own server.
• We do not store IP addresses and keep no access logs.
• All data is stored on our own virtual server operated by Hetzner Online GmbH in its Falkenstein (Germany) data centre.
• Audience members need no account. They only have to give a name if the presenter requires it; a nickname is enough (C.2).
• AI features only run when you press the button and without names or identifiers, at Mistral AI in France (B.12).

3. When we are the controller – and when we act as a processor

We are the controller for the website (Part A), for accounts, sign-in and payment (Part B) and for handling reports (section C.7).

Presentations, slides, images and audience responses are processed on behalf of whoever uses supinion – for example a school, a company or an event organiser. That organisation is the controller within the meaning of Art. 4(7) GDPR. The data processing agreement under Art. 28 GDPR is part of our terms and conditions and terms of use and available at www.supinion.com/avv; if you wish, we also sign it (hi@supinion.com). If you have questions about a specific poll, please contact the person or organisation that ran it; we forward requests we receive to them.

Part A – Website

A.1 Visiting the website

When you visit the website, your browser transmits technically necessary information to our server, including your IP address, the requested address and browser details. We need this information to deliver the page.

• No logs: The web server writes no access logs. IP addresses are not stored.
• Protection against overload: To slow down abuse (such as mass requests), we derive a key from the IP address that is hashed with a random value (salt) that changes daily; for IPv6 only the /64 address block is used. This key exists only in memory and is never written to disk.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable delivery of the website.

A.2 No trackers in your browser, no embedded third-party content

We do not load any analytics or marketing services into your browser, load no third-party scripts and embed no third-party content (no videos, maps, fonts or social media buttons from other servers). We measure the reach of our public pages exclusively on the server, without cookies and without your IP address (A.7). That is why there is no cookie banner: we only set strictly necessary cookies (see B.3).

A.3 Referral links (?ref= parameter)

Some links to supinion contain an addition such as ?ref=… indicating where a visit came from (for example a template or a recommendation). We count these sources on the server, without a cookie and without storing anything on your device.

• A mere visit only increases a counter per source; no link to you as a person is created.
• If you then start a trial or create an account, we link the source to the account ID so that we can see which paths lead to new accounts.
• Legal basis for this link: Art. 6(1)(f) GDPR. Our legitimate interest is understanding how people find supinion without using tracking tools in your browser. You may object (section 8).
• Retention: counters and links are deleted after 180 days. If you delete your account before then, we remove the link to the account ID immediately; only the number remains.

A.4 Storage in your browser

Besides cookies (B.3), supinion keeps a few entries in your browser's storage. Entries in local storage (localStorage) remain until you delete the website data in your browser; entries in session storage (sessionStorage) disappear as soon as you close the tab. None of these entries is transmitted to us; they are only read in your browser.

The legal basis for storing and reading these entries is Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act): they are strictly necessary for supinion to work the way you use it.

A.5 Contact by email

If you email us, we process your address and the content of your message to answer you. The legal basis is Art. 6(1)(b) GDPR where your request concerns a contract or its preparation, otherwise Art. 6(1)(f) GDPR (answering enquiries).

A.6 Enquiries from schools and universities, EDU verification

For school and campus licences you can send an enquiry using a form. We process your name, organisation, email address, size and message.

For the EDU plan we check eligibility as follows: if the email address of your account clearly belongs to a school or university, we unlock EDU automatically and only store this note with your workspace. Otherwise you tell us your school and, if you like, add a note, and we check manually. For this we also process the name and email address from your account. You do not upload any files.

• Purpose: handling the enquiry, checking eligibility for the EDU plan.
• Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps).
• Retention: 12 months in the database, then deleted automatically. Each enquiry is also sent by email to our mailbox; there we delete it once it has been handled, after 12 months at the latest. The EDU note remains until the account is deleted.

A.7 Audience measurement with Matomo

To understand how often the public pages of the website are visited and which channels visitors come from, we use the open-source software Matomo. Measurement happens exclusively on the server: our server reports a page view directly to our Matomo installation at stats.telepano.de. No script runs in your browser for this, no cookies are set and nothing is stored on or read from your device.

• Which pages: only the public pages of the website (home page, pages for schools, events and universities, comparisons with Mentimeter and Kahoot!, templates, imprint, privacy policy, point of contact and reports, terms and conditions, terms of use, data processing agreement and withdrawal information). The app, joining a poll by access code or QR code and all live views are never measured.
• Which requests: only page views sent by a browser when opening the page. We recognise them by technical details that browsers send with every page view (type of request, accepted formats, language). Automated requests such as search engines, monitoring services or prefetching by the browser are not counted. We evaluate these details only at the moment of the request and do not store them; the server log only records, once an hour, how many page views were counted and how many were not counted for which reason.
• Data transmitted: the address of the page visited, keeping only the campaign parameters ref, utm_… and mtm_… from any additions; the referring page (referrer), shortened to the domain and only if you come from another website; the language (German, English or not specified); a rough device class (smartphone, tablet or computer). We do not transmit your full browser identifier but a generic sample identifier per device class. Browser and operating system figures in the statistics are therefore not meaningful.
• No IP address: your IP address is not transmitted. We replace it with the placeholder 0.0.0.0; no location is determined.
• No recognition: every page view receives a new random identifier. Several page views by the same person cannot be linked; Matomo counts each page view as a separate visit.
• Events: we also count when a trial is started, an account is created or a plan is purchased – only with the source from the referral link (A.3) or the plan purchased, without email address, account ID or any other identifier.
• Purpose: measuring the reach of the website and the effectiveness of our channels.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is improving the website and our communication. We do not access your device for this. Since we do not transmit any identifier, we can neither attribute individual page views nor remove them afterwards.
• Recipients: we operate Matomo ourselves. The server of stats.telepano.de is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (data centres in Germany), acting as our processor.
• Retention: raw data is deleted after 180 days; after that only aggregated reports without individual page views remain.

Part B – App (accounts)

B.1 Account and sign-in by code

supinion works without passwords. To sign in, you enter your email address and receive a 6-digit code by email.

• Data: email address; optionally name and role (teacher, trainer, event or company); chosen language; timestamps (such as creation, last sign-in, last use of the app and sending of a warning under B.8).
• Sign-in codes are not stored in plain text, only as an HMAC (a check value computed with a server key). A code is valid for 10 minutes and only in the browser in which you requested it (cookie youpi_lc, B.3); the check value is kept for one day and then deleted.
• Protection against guessing: For every wrongly entered code we store the email address, the time and the end of any block it triggers, without an IP address. After 10, 20 and 30 failed attempts within 24 hours we temporarily block sign-in for the address (1 hour, 4 hours, 24 hours). Once 30 failed attempts have accumulated within 30 days, reaching 10 failed attempts within 24 hours already triggers a 24-hour block. During a block you can still request a code, which then works for exactly one attempt. We delete these entries after 31 days. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting your account against access by others.
• Known browser: After a successful sign-in we set the cookie youpi_kb (B.3) and store a hash of it together with your email address. From this browser you can request sign-in codes even if someone else has used up the daily quota for your address. We delete the entry after 400 days without a sign-in from this browser, when you use “Sign out on all devices” and together with your account. The legal basis is Art. 6(1)(f) GDPR (protecting your access).
• Session tokens are stored only as a SHA-256 hash.
• Purpose: providing the account and the app.
• Legal basis: Art. 6(1)(b) GDPR. We use the role to suggest suitable templates; the legal basis for this is Art. 6(1)(f) GDPR. Name and role are optional.
• Retention: until the account is deleted (B.8); accounts without a contract are deleted automatically after 24 months without signing in, with a warning six weeks beforehand (B.8).

B.2 Trying supinion without an account

You can try supinion without creating an account. For this we create a guest account with a placeholder address – we do not need your email address.

• If you sign up within 7 days, the content of your trial is moved into your account.
• Otherwise we delete the guest account after 7 days together with all content.
• Legal basis: Art. 6(1)(b) GDPR.

B.3 Cookies

We only set strictly necessary cookies. They cannot be read by scripts (HttpOnly) and are not sent along to other websites (SameSite=Lax).

The legal basis for setting them is Section 25(2) no. 2 TDDDG; for the subsequent processing Art. 6(1)(b) GDPR (account) or Art. 6(1)(f) GDPR (participation, see C.2).

B.4 Presentations, images and results

Whatever you create in supinion – presentations, slides, uploaded images (for example from a PDF import), logos and the results of your live sessions – is stored so that we can provide the app. Where an organisation uses supinion, we do this as its processor (section 3).

• Results of a session are kept for 12 months after the session ends. You can delete them earlier at any time with one click.
• Deleted presentations stay in the bin for 30 days and are then permanently deleted.
• Metadata such as location data is removed when an image is uploaded.
• Images no longer used by any slide or logo are deleted after 30 days.
• Legal basis, where we are the controller: Art. 6(1)(b) GDPR.

B.5 Teams and invitations

If you invite others to your workspace, we process their email address to send the invitation. Invitations that are not accepted are deleted after 30 days. The legal basis is Art. 6(1)(b) GDPR towards the inviting workspace and Art. 6(1)(f) GDPR towards the invited person (legitimate interest in working together as a team).

B.6 Payment

Paid plans can be purchased by organisations and – with a billing address in the EU – by private individuals. For organisations we process the organisation's name, address, country, VAT ID and billing email for invoicing.

Buying as a private individual. If you buy as a private individual, we process your first and last name instead of an organisation name, plus address and email address. For each purchase we also keep as evidence: contract number, plan, price including VAT, time of the order and of the conclusion of the contract, the end of the withdrawal period and – if you ticked it – the date and time of your request that we begin before the withdrawal period ends. After a withdrawal, the time, the compensation for the service provided and the refund amount are added. Refunds go back to your payment method via Stripe.

Cancellations and withdrawals. When you submit a statement via "Cancel contracts here" or "Withdraw from contract", we store its content (type of cancellation, reason and requested date where given), your name, your email address, what you stated about the contract, the date and time of receipt and the outcome. No sign-in is required; we match the statement to your contract by email address and contract number. We send the acknowledgement of receipt to the address given. The confirmation of a cancellation contains a link with which it can be undone until the end of the contract; of this link we only store a check value (hash) until it is used, at most 30 days beyond the end of the contract. If the address given differs from that of the account the contract belongs to, we send the account's email address a notice with the name, address and receipt number of the cancellation and the same link, so that nobody can cancel other people's contracts unnoticed. We do not store IP addresses. To prevent mass requests we count requests in memory only, with a key that changes daily (see rate-limit keys).

• Legal basis: Art. 6(1)(b) GDPR (the contract and its termination), Art. 6(1)(c) GDPR (obligations under Sections 312f, 312k and 356a of the German Civil Code: confirming contracts, cancellations and withdrawals) and Art. 6(1)(f) GDPR (proof that we handled cancellations and withdrawals correctly; legitimate interest in establishing and defending legal claims).
• Retention: cancellation and withdrawal statements together with our confirmation until the end of the sixth calendar year after receipt (business letters, Section 147 (1) nos. 2 and 3, (3) German Fiscal Code (AO)). Purchase records with payment and refund until the end of the eighth calendar year after the contract ends (accounting records, Section 147 (1) no. 4, (3) AO). These records remain even if you delete your account (Art. 17(3)(b) and (e) GDPR). Orders that were never paid are deleted after 30 days.

The payment itself is handled by Stripe Payments Europe, Ltd. (Ireland) – for example by credit or debit card, SEPA Direct Debit or PayPal. The payment methods offered at checkout are listed on the plans page and in the order summary before you order. You enter payment details (such as card number or IBAN) directly with Stripe; we do not receive them. Stripe describes its own role as acting as controller or processor depending on the activity, including as controller for fraud detection and legal compliance. More information: https://stripe.com/privacy and https://stripe.com/legal/privacy-center.

If you choose PayPal at checkout, Stripe redirects you to PayPal. There, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, processes your data as an independent controller (PayPal login, payment processing, fraud prevention). We do not receive any account details from PayPal, only the payment confirmation via Stripe. More information: https://www.paypal.com/de/legalhub/privacy-full

The same applies to Amazon Pay and Satispay: if you choose one of these payment methods, Amazon Payments Europe S.C.A., 38 avenue J.F. Kennedy, L-1855 Luxembourg, or Satispay Europe S.A., 53, Boulevard Royal, L-2449 Luxembourg, processes your data for login and payment processing as an independent controller. We do not receive any account details from them, only the payment confirmation via Stripe. More information: https://pay.amazon.de/help/201212490 and https://www.satispay.com/en-lu/legal-hub/privacy-policy/general/. Link, which stores payment details for later purchases, is a Stripe service; the paragraph on Stripe above applies.

To process each payment event from Stripe reliably exactly once, we keep a marker per event for 90 days.

• Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (retention obligations under tax and commercial law).
• Retention: billing data for as long as the contract exists; afterwards for another 3 months for queries. Invoices and other accounting records are retained under Section 147 of the German Fiscal Code (AO) (currently eight years for accounting records).

B.7 Sending emails

Sign-in codes, invitations and account notices are sent via SMTP from noreply@supinion.com. Delivery is handled on our behalf by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (data centres in Germany). The legal basis is Art. 6(1)(b) GDPR.

B.8 Deleting your account

You can delete your account yourself in the app; for safety you confirm this by typing in your email address. This deletes your own workspaces with all their content, including plans unlocked with redeemed codes.

Two exceptions: deletion is blocked while a subscription that has not been cancelled is running or while other members are still in your team. In that case, cancel the subscription first or transfer or empty the team. Invoice records that must be kept by law remain until the retention periods expire (B.6). Deleted data disappears from server backups after 14 days at the latest, and from the second off-site backup after 30 days at the latest (section 6). Backups are not edited individually; they expire on their own at these times.

Automatic deletion after 24 months without signing in: We do not keep data that nobody uses indefinitely (Art. 5(1)(e) GDPR). If you do not sign in for 24 months, we delete your account as if you had deleted it yourself. Six weeks beforehand you receive a warning by email with the deletion date. Signing in once is enough to keep the account; using an existing sign-in in the app also counts. We never delete without a delivered warning. Exempt are accounts with a running contract or one that has been cancelled but is still running (subscription, unlocked plan, event pass), accounts with open consumer contracts, cancellations, withdrawals or refunds, and accounts that share a team with other members. The records that must be kept by law under B.6 remain here too until their retention periods expire.

B.9 Trial only once per email address

So that the 14-day trial cannot be used repeatedly by deleting and re-creating an account, we store a pseudonymised checksum of the email address when an account is created (an HMAC with a server key, not the address itself). The checksum is kept after the account is deleted and erased after 24 months. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is preventing misuse of the free trial.

B.10 Newsletter

If you tick the box for news when getting started or in your settings, we first send you an email with a confirmation link (double opt-in). You only receive news after confirming, at most once a month.

• Data: email address, optionally your name, language, time of sign-up and of confirmation, and the wording of the consent you agreed to (as a dated version); together they serve as proof of consent. The confirmation link is stored only as a hash and is valid for 7 days.
• Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time in your settings; the subscription is then deleted immediately.
• Delivery: for now we only collect sign-ups. Before we send the first newsletter, we will add here how it is delivered.
• Retention: until you withdraw consent or delete your account; unconfirmed sign-ups are deleted after 30 days.

B.11 Feedback and ideas

With the “Feedback” button you can send us ideas, bugs or praise, optionally with a screenshot.

• Data: your text, the type of message, the page of the app you were on, your browser identifier (user agent) and an optional image, linked to your account so we can follow up. No IP address.
• Purpose: fixing bugs and improving the product. Legal basis: Art. 6(1)(f) GDPR.
• Ideas up for voting are worded by us (without your name). We store your votes so you can support each idea only once and withdraw your vote; other users only see the count.
• Retention: feedback 12 months, screenshots 30 days; immediately on account deletion, together with your votes.

B.12 AI features

At the press of a button, supinion creates a draft presentation from a description or groups the answers on a slide (word cloud, wall, Q&A) into themes. For this we use the language models of Mistral AI SAS, 15 rue des Halles, 75001 Paris, France. Mistral acts as our processor (Art. 28 GDPR).

• What is transmitted: only when you press the respective button. For a draft, your description and the chosen language; for themes, the question and the answer texts of the slide, shortened in each case. We do not transmit names, nicknames, email addresses, participant identifiers or any other identifiers. If you write names into a description yourself, they are included.
• Switching off: the AI features can be switched off for the whole workspace in the settings.
• Location: we use Mistral's European endpoint; according to Mistral, the data is processed in the European Union.
• Storage at Mistral: Mistral may store requests for a limited period under its own terms to detect abuse.
• Legal basis: Art. 6(1)(b) GDPR for your description. Audience answers are processed on behalf of the organisation using supinion (section 3).
• AI counters: for the monthly quota we count calls and usage per workspace and month, without any content. The counters are deleted after 13 months.
• No training: in our Mistral account, the use of our data for training the models is switched off. When we stop using Mistral, the data there is no longer accessible after 30 days according to the data processing agreement.

Part C – Audience members

C.1 Who is responsible

The poll you are taking part in is run by a person or organisation – for example your school, your employer or an event organiser. They are responsible for your answers. We operate the technology on their behalf. We pursue purposes of our own only when protecting against abuse (C.4) and when handling reports (C.7).

C.2 What data is processed

• You need no account.
• In quizzes you can choose a nickname. The presenter can decide for a presentation that everyone must give a name before answering; the name is then shown on the leaderboard. In that case, use a nickname, not your full name. Whether a name is required is decided by the organisation running the session (C.1).
• We store your answers: votes, words, notes, questions, scale values and quiz answers.
• To make sure a vote only counts once and you can carry on after reloading the page, we set the cookie youpi_p containing a random token, valid for 24 hours. On the server we only store a hash of it (the participant identifier).
• If the presenter groups answers into themes with AI, the answer texts of the slide are sent to Mistral AI without names or identifiers (B.12).
• Legal basis for the technical operation of participation is Art. 6(1)(f) GDPR; the legal basis for the poll itself is determined by the organisation running it (in German schools usually the respective state's school law).

C.3 Anonymisation after 24 hours

24 hours after the session ends, the participant identifier is removed from the answers. The deletion job runs every hour, so the identifier is gone 25 hours after the session ends at the latest. If the presenter does not end a session, it ends automatically once nobody has been active and no device has been connected for 12 hours; after a restart of our server, 24 hours after the last activity at the latest.

After that, no answer can be attributed to a device or cookie – including by us. The answers from one device stay linked to each other as one record, for example for quiz points.

A name you entered stays with the results until they are deleted (C.5). If you entered a recognisable name, the results are not anonymous in that respect; please contact the organisation running the session to have it deleted.

C.4 Word filter and moderation

A word filter automatically holds back posts containing offensive terms. They are not deleted, only not displayed. Presenters can also moderate posts themselves. This does not involve any automated decision with legal effect within the meaning of Art. 22 GDPR. The legal basis is Art. 6(1)(f) GDPR (protecting participants from insults).

C.5 Retention

Session results are kept for 12 months after the session ends unless the presenter deletes them earlier. After that they are deleted automatically.

C.6 Children and young people

Schools also use supinion with pupils, including minors. They take part without an account; they only give a name if the teacher requires it, and then a nickname is enough. We ask schools to remind pupils not to include personal details in free-text answers.

C.7 Reporting content

Every audience view has a “Report content” option. When you report something, we store the reason (illegal, hate/incitement, insult/bullying, personal data, spam, other), your note, the affected session and slide and – only if you wish – your name and an email address for our reply.

• Purpose: reviewing the report and informing you of our decision. If we remove content or block a workspace, we also inform the owner of the workspace, with reasons. They do not learn your name or address.
• Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 16 of Regulation (EU) 2022/2065 (Digital Services Act), and Art. 6(1)(f) GDPR.
• Retention: name, note and contact address are deleted 90 days after our decision. The report itself (reason, session, slide, decision) is deleted 12 months after receipt.

How we handle reports is described on the page “Point of contact and reports”: https://www.supinion.com/en/contact-point

4. Recipients

Both off-site backups are encrypted with the tool age before transfer. The storage locations only see encrypted data and cannot read it.

To pay, the app redirects you to a Stripe page. Stripe's privacy policy applies there; on its pages Stripe sets its own cookies and processes, among other things, your IP address (https://stripe.com/privacy).

Beyond this, we only disclose data where we are legally obliged to (for example by order of an authority).

5. Transfers to third countries

Our server is located in Germany. We ourselves do not transfer data to countries outside the EU/EEA.

Stripe states that it transfers personal data to countries outside the EEA, including the USA and India. According to Stripe, it relies on its certification under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision, and on the EU Standard Contractual Clauses. Stripe is responsible for these transfers where it acts as controller.

Email delivery, the first off-site backup and audience measurement also run at Hetzner Online GmbH in data centres in Germany. The second off-site backup is stored encrypted with Scaleway SAS in France, which is also within the EU.

The AI features use Mistral AI's European endpoint; according to Mistral, the data is processed in the European Union (B.12).

6. Retention at a glance

7. Security

Connections to supinion are encrypted with TLS (HTTPS, HSTS). Sign-in codes and session tokens are stored only as a check value or hash; IP addresses are not stored at all. Off-site backups are encrypted before transfer.

8. Your rights

You have the right to

• access the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR), where we rely on consent.

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

There is no automated decision-making, including profiling (Art. 22 GDPR); blocks following reports are decided by a human.

An email to hi@supinion.com is enough. As an audience member, please contact the organisation that ran the poll (C.1). Please note: after anonymisation (C.3) we can no longer attribute answers to anyone and therefore cannot provide information about them.

9. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority competent for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, https://www.ldi.nrw.de.

10. Obligation to provide data

For an account we need your email address, because otherwise we cannot send you a sign-in code. All other account information is optional. As an audience member you do not have to provide any information about yourself. If the presenter requires a name (C.2), you cannot answer without one; a nickname is enough.

11. Changes

When supinion changes, we update this policy. The version published here applies.