Who sees what

Votes are stored linked to voter and recipient, because the reveal needs both. What matters is what reads them: no query returns votes by voter, no screen in the product displays them that way, and there is no export — no CSV, no report, no admin download, in any format, to anyone.

Reveals are free once you've answered a poll of your own, so this is a normal part of using kudoSnap rather than a rare event. It only ever runs one direction: someone can learn who praised them. There is no direction in which you can look up how somebody else voted.

These are every permission kudoSnap asks for at install. Not the important ones, not a summary: all of them.

None of them read message content. Reading messages requires a history scope, and there isn't one in this list.

Five surfaces, and it's worth being specific because “a dashboard” is exactly the kind of word people fill in with the worst version:

• Pulse — how many people got recognized, how many are answering, how quickly, over time. Counts and rates, workspace-wide.
• Culture — which kinds of strengths this workspace notices most. Four categories, no names.
• Departments — the same counts grouped by the department field in Slack, and how recognition moves between teams. This exists, it is not hidden, and it is visible to everyone rather than to managers. It shows team-level totals and never who voted for whom.
• People — profile cards, and only ones their owner chose to publish. Nothing appears here because someone else decided it should.
• Questions — which questions have been asked and how often they get answered.

What isn't there: any view scoped to one manager's reports, any ranking or “most recognized” list, any individual's votes, and any export. There is no manager view — not a setting someone left switched off, but a screen and a query that don't exist. The reasoning is that the moment recognition can be filtered to one person's team, it becomes something you can be measured with, and then nobody answers honestly.

Adding that dashboard required zero additional Slack permissions. It's built entirely from votes people chose to cast inside kudoSnap.

Not your messages — we can't read them. Not your email address — we don't request the scope that returns it, though we do store your workspace's email domain from install. Not anything you typed, because there is nothing to type: every answer is a tap on one of four names.

Timezone is used to send questions during your working hours rather than at 3am. Channel membership is used to work out who you actually work with, so the four names are people you know. Department, when your Slack admin has defined that field, is what makes the team-level view possible.

Subprocessors, retention, and how deletion actually works are on /security.

Being honest about the shape of this: there is no self-serve opt-out button yet. One is being built into the app's Home tab in Slack, and this page will change the day it ships. Until then the email address is the mechanism, and it works — we set a flag on your account and the scheduler skips you from then on.

You may still receive recognition after that, because that's someone else's message to you rather than ours. Say so in the email and we'll stop that too.

Removing the app from the workspace stops everything for everyone, immediately. Erasing what's already stored is a separate step and currently a manual one — /security says exactly how that works, including the part we haven't automated yet.