What is stored
Valid records are stored under dru-questionnaire-v2 in this browser's localStorage. Each record contains a linkage code, a pre/post phase, a timestamp, and the six item responses. Nothing else is recorded: no IP-derived field, no device fingerprint, no session identifier, no free text.
Browser synchronization, extensions, shared-device access, backups, or exported files may expose them. If the browser profile is signed in and syncing site data, the records may travel to the other devices on that profile — that is the browser's behaviour, not this page's, and it is outside what this site can control.
Why nothing can be transmitted
The site is served with a Content-Security-Policy that sets connect-src 'none'. That directive governs fetch, XMLHttpRequest, WebSocket, EventSource and navigator.sendBeacon. With it set to 'none', the browser refuses those connections regardless of what the page's script asks for, so the guarantee does not depend on the script being well behaved.
The rest of the policy closes the usual side doors: default-src 'self' and script-src 'self' mean no third-party or inline script can run, img-src 'self' data: means no remote image can be used as a tracking pixel, form-action 'self' means no form can post off-site, and frame-ancestors 'none' means the page cannot be embedded and read by another site. There is no analytics tag, no font CDN, and no embedded widget.
Exports and imports stay inside the page: a download is produced from a Blob and a local object URL, and an import is read with FileReader from a file you pick yourself. Neither is a network request.
Pseudonymous, not anonymous
Codes make records pseudonymous, not anonymous. Anyone who knows a code — or who can open this browser, or who receives an export — can link the records under it. Under the EU General Data Protection Regulation, pseudonymised data is still personal data (Regulation (EU) 2016/679, Article 4(5)).
Do not use names, initials with a birthday, medical-record numbers, dates of birth, phone digits, or anything else that identifies a person as a code. Use the generator if you would rather not choose: it draws from crypto.getRandomValues over a 32-symbol alphabet, giving roughly 1.1 × 1012 possible codes.
Deleting and its limits
“Delete all local records” removes them from this device immediately, and deleting the site's data in browser settings does the same. Neither can reach a file you already exported, a copy that has been synced to another device on the same browser profile, or a printout. Those are yours to manage.
The corollary is that nothing here is backed up. Clearing site data, using a private window, or switching browsers loses the records permanently. If a record matters, export it.