Your data is yours. Full stop.
We understand the concern: your employer pays for Restemb — so can they see what you enter? The answer is no. Here is exactly how it works, with nothing hidden.
What your manager sees vs never sees
✓ What your manager sees
Anonymous team-level aggregates only
- ✓
Team average energy score (trend line)
Anonymized aggregate
- ✓
Team average stress level (week-over-week)
Anonymized aggregate
- ✓
Team average workload score
Anonymized aggregate
- ✓
Team participation rate (%)
How many people checked in
- ✓
Trend direction (improving / stable / declining)
Directional only
- ✓
Team-level alerts (e.g. "stress trending up this week")
Aggregate signal
✗ What your manager NEVER sees
Protected at the database level — no exceptions
- ✗
Your individual check-in answers
- ✗
Your personal burnout score
- ✗
Your free-text notes or reflections
- ✗
Who answered what, or who flagged a concern
- ✗
Your historical check-in responses
- ✗
Whether you completed or skipped a check-in
How privacy is enforced — not just promised
Most tools say "individual data is private." What they mean is: the UI does not show it to managers. But if someone with database access — a compromised admin account, a misconfigured API, or a future UI change — could query individual data, the privacy is only as strong as the weakest link.
Restemb is different. Individual check-in data is protected using Supabase Row-Level Security (RLS) — a database-level access control mechanism. This means:
- →The database itself refuses to return individual employee data to any manager query, regardless of how the query is constructed.
- →Even if someone bypassed the Restemb UI entirely and queried the database directly with a manager's credentials, they would receive no individual data.
- →This is not a setting that HR or your company admin can change. The RLS policies are set at the infrastructure level by Restemb.
Supabase RLS Policy (simplified)
-- Employees can only read
-- their own check-in data
CREATE POLICY employee_own_data
ON checkins
FOR SELECT
USING (
auth.uid() = employee_id
);
-- Managers receive aggregates
-- only when N >= 5
CREATE POLICY manager_aggregates
ON checkin_aggregates
FOR SELECT
USING (
team_id IN (
SELECT team_id
FROM team_managers
WHERE manager_id = auth.uid()
)
AND participant_count >= 5
);
-- No policy grants managers
-- access to individual rowsThe 5-person minimum
Even with aggregated data, a small team can expose individuals through arithmetic. If a 4-person team shows an average energy score of 4.2 and three people score 5/5, a manager could infer the fourth person scored 1.8.
Restemb prevents this with a hard minimum: aggregate data is only surfaced to managers when at least 5 team members have checked in during that period. On smaller teams or low-participation days, managers see only the participation rate — no score data at all.
Why 5?
Statistical research on re-identification risk suggests that groups of 5 or more with normally-distributed scores make individual inference statistically infeasible. It is the same threshold used by many healthcare data standards for "small-cell suppression." We chose 5 because it balances meaningful team signals with genuine individual protection.
Common questions from employees
Can HR see my individual check-ins?
No. HR users have the same view as managers: team-level aggregates only, subject to the 5-person minimum. Individual data is inaccessible to anyone at your company.
Can Restemb itself see my individual data?
Restemb engineers have database-level access for infrastructure purposes, but we operate under a strict data processing policy. Your individual data is never used for advertising, sold to third parties, or accessed without a specific support request from you.
What happens if I leave the company?
Your individual data is deleted within 30 days of your account being deactivated. You can also request immediate deletion at any time by contacting [email protected].
Can a manager tell if I skipped a check-in?
Managers see a participation rate (e.g., "7 of 10 team members checked in this week") but not who participated and who did not. Individual participation records are protected by the same RLS policies.
See it in action
Restemb is free for everyone. No credit card required. Experience the privacy model from both the employee and manager perspective.