Psyche Project PBC receives no federal funding for this work, holds no Federalwide Assurance, and conducts no FDA-regulated research, so 45 CFR 46 does not bind it as a matter of law. We are seeking an independent exemption determination anyway, and we do not yet hold one. When it is issued, the issuing board and protocol number will appear here. We would rather say that plainly than let a vaguer sentence imply a review that has not happened.

The determination sought is under 45 CFR 46.104(d)(4)(ii) — secondary research use of information recorded so that the identity of subjects cannot readily be ascertained, where the investigator does not contact subjects and will not re-identify them. It fits because the records were generated for a different purpose: a person opened an assessment to get their own result, and got it. Nobody is recruited, nobody is contacted, no one is paid, and nothing about the product is changed for a study.

Published analyses are restricted to respondents 18 and over, and the dataset itself carries no minor's records at all — enforced by the query that builds it, not by anyone remembering. Screener results are described as symptom patterns and never as diagnoses.

In September 2026 we spent an afternoon attacking our own research extract instead of documenting it, and wrote down everything that worked.

98% of attempts are unique on response timing alone. Concatenating one attempt's per-item millisecond latencies singles out 843 of 860 attempts. We did not fix it, deliberately: response latency is the measurement that several planned analyses read, and rounding it away would empty the file in order to protect it.

What follows from that is the rule everything else obeys. The dataset is pseudonymous, never anonymous. It cannot be published openly, every recipient is a data processor, and access is controlled. Two other findings were fixed the same day — person-level integers that singled out 13 people, and a comment describing a protection the code did not implement — and two attacks failed and are written down so nobody repeats them.

Attaching a name to any of it still requires having watched someone answer, which no public dataset offers. Singling out, yes. Re-identification, no route found. The full write-up goes to anyone who asks.

Four things together, which is the part no existing open dataset has: breadth across clinical screeners, Big Five, IPIP adaptations and original scales; every instrument keyed to the same person, so cross-instrument structure is directly estimable; parallel self and peer ratings on the same constructs; and repeat attempts over time.

It is small, and the honest number is the one that matters. As of 8 September 2026 the platform holds 2,222 completed attempts across 44 instruments — but the file a researcher would actually receive holds 191 completed attempts from 194 eligible people, because it carries only consenting adults. Peer ratings number 41, so the self–observer work is not yet powered and we will not report it until it is.

The sample is self-selected users of a consumer app, skewing young and toward people already interested in psychology. We treat that as a documented property of the resource rather than a limitation to bury: every descriptive figure is framed as what this cohort shows, never as a population rate.

Everyone's data supports internal validation and population norms, and only aggregate findings leave the company on that basis. Individual-level records leave only for people who separately opted in to Contribute to Science, which is off by default, reversible at any time, and recorded with an append-only audit trail and a hash of the document version in force when it was given.

Withdrawal is destructive rather than a flag: it erases the special-category demographic fields and deletes every attempt at the sensitivity-flagged instruments, including results the person can currently read. We tell users that before they choose.

The analysis machinery was frozen before the data: validity gates and exclusion criteria, the missingness model, one confirmatory self–observer hypothesis, the dataset descriptor, and the framing rules binding every descriptive claim. Each is timestamped into the Bitcoin blockchain, so the documents can be proven to predate the thresholds they fire on without anyone having to trust our commit dates.

They are available on request today and will carry public DOIs once registered.

Controlled access only. There is no open download and there will not be one — see the section above for why. What a request involves: named individuals at a named institution, a description of what you intend to do, your own ethics approval or determination for your use of the data, and a signed data-use agreement.

That agreement prohibits re-identification and redistribution, forbids publishing row-level data, rules out advertisers, data brokers and insurance underwriting outright, and requires destruction at the end of the term. It gives Psyche no right to review, edit or suppress your findings. A company that can veto a result has no business claiming one.