AI feedback
The AI Feedback page (/admin/ai-feedback, section Activity) lists what users reported about answers Pia
gave them. A thumbs-up is only counted. A thumbs-down opens a written complaint, and the user can attach the
answer they are complaining about. Reports live in their own table, apart from the audit log and from token
usage, and only admins holding the AI Feedback area can read them.
The rated answer is not shown in the list. Each report offers Show the answer the user reported, and the text is loaded only when you ask for it — it is the part most likely to be about someone who never used Pia.
Who is told
Section titled “Who is told”A report is always stored. Whether anyone is told as well depends on the licence, the configured address and an SMTP relay:
| Licence | Complaint | Marked as a privacy concern |
|---|---|---|
carries PiaCloud |
ki@pia-ai.de |
datenschutz@pia-ai.de |
| any other | Feedback:NotifyAddress |
Feedback:PrivacyNotifyAddress, else Feedback:NotifyAddress |
There is no fallback to a neo42 address on a self-hosted server: a report carries what a user wrote, and it stays with you. Both keys are set in the server’s environment (see the configuration reference); the console deliberately offers no field for them.
The mail carries the report’s id, time, model and comment, and a link back to this page — never the rated answer.
The user is told the truth. From server 1.4 the answer to a report says whether a mail went out. With no address, no SMTP relay or a failed send, Pia Desktop 1.4.x tells the user the report was stored with the operator and that nobody was notified. The same state is shown to you in three places while it lasts:
- a warning on this page, naming what is missing;
- a banner on every other admin page, for admins who hold the AI Feedback area;
- a warning in the server log at startup.
Privacy concerns
Section titled “Privacy concerns”In the report dialog the user can tick that the report concerns data protection. Such a report is mailed to the
privacy address whatever its rating, and its subject starts with [Datenschutz], so a mail rule can sort it.
In the list it carries a privacy marker, and the category filter shows Privacy concerns on their own.
Triage
Section titled “Triage”Each report is new, triaged or closed. Changing the status is recorded in the audit log as admin activity; the report itself is not.
Retention
Section titled “Retention”| What | How long |
|---|---|
| Comment, rated answer and the link to account, chat and message | 30 days after the report is closed, and never more than 90 days after it arrived — also when nobody has read it |
| What is left afterwards: rating, model, category, status, date, app version, language | 365 days after the report arrived |
When the text goes, the report itself is deleted and a trend record takes its place. That record has a new id and a date instead of a time, so it cannot be traced back to the account, not even through the audit log or the usage figures. Reopening a closed report stops its 30-day clock until it is closed again. Deleting an account deletes its reports outright, without a trend record.
Every report shows the day its text will be deleted. The three periods are configuration keys
(Feedback:ClosedContentRetentionDays, Feedback:ContentRetentionDays, Feedback:RetentionDays), and each value
above is also the maximum — see Retention.
Access
Section titled “Access”The page needs the AI Feedback area with View; changing a status needs Manage. The same reports are
available to scripts under /api/admin/ai-feedback (see the API reference), with
status, rating and privacyConcern filters.