What we store, and what we refuse to

The controller of the personal data described here is [operator legal name — to be completed before launch] [registered address — to be completed before launch]. Contact for anything in this notice: hello@getmindscore.com. We have not appointed a data protection officer because the scale and nature of this processing do not require one.

• An anonymous session identifier. A random value in a cookie on your device, used to link you to your own results and any report you have unlocked. It is not derived from anything about you. Purpose: providing the service. Basis: performance of a contract (delivering the assessment you started) and, for the security of that link, our legitimate interest in running the service safely.
• Your responses and results. Your answers, your reaction times and the scores computed from them, linked to that anonymous session. Purpose: scoring, showing you your result and any report you buy. Basis: performance of a contract. In aggregate, anonymised form they also build the comparison groups described in our methodology; basis: our legitimate interest in reporting honest statistics, which does not override yours because nothing in an aggregate identifies you.
• A device category. Phone, tablet or desktop, plus a browser family such as “chrome”. This is what makes fair comparison groups possible. Basis: legitimate interest, as above.
• An age bracket, only if you chose one. A bracket, never a date of birth, and only where you actively selected it. Basis: consent, which you can withdraw by asking us to delete it.
• Purchase records. Amount, product, the payment provider’s identifiers, and the time you consented to immediate delivery. Purpose: honouring what you bought and meeting tax and accounting obligations. Basis: performance of a contract and legal obligation.
• An email address, only if you gave one. Supplied to our payment provider at checkout, or to us when you create an optional account, and used to send a receipt, sign you in and restore access to what you purchased. Basis: performance of a contract. We do not send marketing email.
• Product analytics events. Counts of actions such as “challenge started”, attached to the anonymous session, and kept in our own database. Purpose: understanding which parts of the product work. Basis: legitimate interest; nothing is shared with an advertising network and no profile of you is built.

Your scores are computed automatically from version-controlled rules. That computation has no legal or similarly significant effect on you: nothing about you is decided by it, and no one uses it to decide anything about you.

• No full IP addresses in our application database.
• No raw user-agent strings — only a coarse category and browser family.
• No name, no date of birth, no address, no phone number.
• No health information. The assessments are educational, not clinical, and we do not ask about or infer any condition.
• No card details. Card data goes directly to our payment provider and never touches our servers.
• No third-party advertising or tracking pixels. Analytics are first-party and stay in our own database.

We set one cookie, ms_sid. It holds a signed random session identifier, is HttpOnly, and exists so your results and unlocks stay attached to you without an account. It is strictly necessary for the service to work, so no consent banner is required for it. We set no advertising or cross-site tracking cookies. Your sound preference is kept in your browser’s local storage and never reaches us.

Result links and challenge links contain long random tokens. A challenge link reveals only a headline number and never your answers, your device or your age bracket. An assessment result link shows only the overall band to anyone who is not you.

Anyone holding one of these links can see what the link exposes, so treat them as unlisted rather than secret. Leaderboard participation is off unless you deliberately add a display name, and we ask you to use a nickname.

• Supabase, which hosts our database on our behalf, and our hosting provider [to be named before launch], which runs the application.
• Stripe, our payment provider, which processes payments and holds the card data we never see. Stripe is an independent controller of the data it collects on its own payment page.
• Our email delivery provider, for receipts and sign-in links, once one is configured.

These providers may store data in the United States or elsewhere outside your country. Where data leaves the European Economic Area or the United Kingdom, we rely on the provider’s standard contractual clauses, the UK addendum to them, or an adequacy decision covering the provider.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months and have no plans to.

A compatibility report involves two people, so it is worth being exact about what crosses between you. Each participant answers independently and neither participant is ever shown the other’s answers. What you both see is a score for each of the six areas and the joint report computed from them. Both of you are told this before you answer, not afterwards.

• The invitation link grants one thing: the right to answer. It never resolves to anybody’s result, so a forwarded link cannot be turned into a reader of a report.
• Each participant gets a separate private link to the report. Neither of you is ever shown the other’s, and a link opened on a device that did not answer shows nothing.
• Invitations expire after 30 days, and only one person can take the second seat.
• If either participant deletes their account, the joint report is deleted for both of you. It is a record about two people and cannot exist with one of them removed.

Accounts are optional. Every assessment, report and payment works without one. If you create one we store your email address and nothing else about you — there is no password, so there is no password to leak, and sign-in links are single-use, expire in twenty minutes and are stored only as a one-way digest.

Signing in attaches results you already produced on that device to the account. It is additive: nothing is moved, rewritten or deleted, so signing in can never cost you a result.

Wherever you live, you can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop processing it, and receive it in a portable form. If you are in the European Economic Area or the United Kingdom, these are your rights under the GDPR and the UK GDPR, together with the right to object to processing based on legitimate interest, the right to withdraw a consent you have given (the age bracket) without affecting what was done before, and the right to complain to your data protection authority: in the UK the Information Commissioner’s Office, and in the EU the authority of the country you live in.

If you are a California resident, the California Consumer Privacy Act gives you the right to know what personal information we collect and how we use it (this page), to access it, to correct it, to delete it, and not to be discriminated against for exercising those rights. The categories we collect are identifiers (a random session id and, if you give it, an email address), commercial information (purchases), internet activity on our own site (analytics events), and inferences drawn from your answers (your scores). Their sources are you, your device and our payment provider. We collect them for the purposes above and disclose them only to the processors named above. We do not sell or share them.

To exercise any of these rights, use your account page if you have an account, or email hello@getmindscore.com. We answer within one month, and never charge for it.

If you have an account, you can delete everything yourself from your account page. It is immediate, it does not require asking us, and it removes your assessment results, your daily games, your compatibility reports and your account. Payment records are kept because a business has to be able to account for money it received, with the email address, the account link and every link to a result stripped from them.

Without an account, email hello@getmindscore.com with your result link and we will delete the underlying record, or send you a copy of it. That link is how we identify the data as yours. We will confirm when it is done.

MindScore is not intended for anyone under 16 and we do not knowingly collect their data. If you believe a child has used MindScore, contact us and we will delete the record.

• Responses, results and reports: until you delete them, from your account page or by emailing us. We keep them because a report you paid for has to stay readable, and because comparison groups are built from valid results.
• Analytics events: deleted with your other data when you delete it; otherwise kept as counts attached to an anonymous session.
• Purchase records: for as long as tax and accounting law requires, which is typically six to seven years, with everything that links them to a result or an email address stripped out on deletion.
• Compatibility invitations expire 30 days after they are created. Sign-in links expire twenty minutes after they are requested and can be used once.

The date at the top is the date of the current version. If we change what we collect or why, we update this page before the change takes effect.