Privacy
Last updated 10 August 2026
This describes exactly what this site collects, what it does with it, and what it refuses to do. It is written to be checked rather than believed — the scoring logic is published, the retention schedule below is the one the deletion job reads rather than a second copy of it, and the tracker prohibition is enforced by a test that fails the build.
Not yet reviewed by a lawyer
This policy has not been reviewed by counsel, and two questions about how this service is classified under US law are still open. We would rather publish an accurate description of what the software does today than a polished document that implies more certainty than we have. It will be revised, and the date above will change when it is.
You can take the test without telling us who you are
There is no signup, no account, and no email address required to take the questionnaire or to see your result. Your answers are stored against a random identifier held in a cookie in your browser. That identifier is not linked to your name, and it is not linked to an email address unless you later choose to link it.
We do not ask for your name at any point. We never ask for a date of birth, an address, or any government identifier.
What we store, and when
When you finish the questionnaire: your answers, the score computed from them, the version of every rule and every piece of wording in force at that moment, and the time. The versions are stored so that if you come back later, you see what you originally saw rather than a result silently recalculated under newer logic.
If you ask for the symptom-group comparison: your email address, and a record of the specific consent you gave, including which wording you agreed to. Consent to link your email with your result is recorded separately from consent to marketing email, because they are different decisions.
If you buy a report: the fact of the purchase, the amount, and your email address. Card details are handled entirely by Stripe and never reach this site.
What we deliberately do not store
We do not store your IP address or your browser's user-agent string alongside a consent record. Those are the two fields most services attach to consent by reflex, and both are identifiers we have no need for.
We do not build a profile of you across visits, and we do not enrich what you tell us with data bought from anyone else.
No advertising or analytics scripts run on the test
No Meta Pixel, no Google Analytics, no Google Tag Manager, no TikTok or Snap pixel, and no behavioural or session-recording script runs on the questionnaire, your result, or your report. This is the practice the US Federal Trade Commission has taken enforcement action over repeatedly, because those scripts send what you did to companies you have never heard of.
This is not a policy we ask you to take on trust. The rule is enforced by an automated check that fails the build if any file those pages depend on can reach an analytics module, and the same check verifies it is working by confirming the marketing pages do load one.
Ordinary web analytics run on the marketing pages only — the home page and pages like this one.
Who else sees any of it
Our database is hosted by Supabase. Payments are processed by Stripe, which receives your email address and your card details, and returns to us only a confirmation and an identifier. The site is hosted by Vercel. Email, once it is switched on, is sent by Resend.
Nobody else. We do not sell data, we do not share it with advertisers, and we do not license it to researchers.
Email is written so a preview reveals nothing
Any email we send about a purchase has a neutral subject line, a neutral sender name, and no score, result, or mention of what the questionnaire is about in the part a phone shows on a lock screen. It links to a page rather than attaching a file, so nothing about your health sits in your inbox indefinitely.
How long we keep things
The schedule below is what we hold ourselves to. Financial records are the one exception: where the law requires a transaction record to be kept, the record of the payment survives, but the questionnaire answers attached to it do not.
The schedule is applied by a job that runs automatically, not by anyone remembering. Being exact about the current state, because a retention promise nobody implements is not a promise: that job is written and scheduled, and it has not yet run against real data, because this site is not yet open to the public.
Deleting your data
You can ask us to delete everything we hold about you and we will do it within 30 days, and tell you when it is done. You do not need an account to ask.
Being straight about a limitation: encrypted backups are kept on a rolling 7-day cycle, so a deleted record can persist in a backup for up to 7 days after we delete it from the live database. It is not restored to the live system, and it ages out on that cycle. Saying "we deleted it" while a backup still holds it would not be true.
Cookies
Two, both strictly necessary and neither used for advertising. One holds the random identifier for the result you are currently looking at. The other is a sign-in cookie that lets the database check that the answers you are reading are your own. Neither can be read by page scripts.
Retention schedule
| Record | Kept for | Counted from |
|---|---|---|
| Anonymous session that never gave an email address | 30 days | the day you finished the questionnaire |
| Email given, nothing bought | 12 months | your last activity |
| Report purchased | 24 months, then answers deleted | the purchase |
| Refunded | Answers deleted at refund | the refund |
| Consent records | As long as the record they relate to, plus the statutory period | the record they relate to |
| Payment records | Kept as long as the law requires, without the answers attached | the transaction |
These durations are our starting position and are subject to review by counsel. If they change, this page changes with them.
Getting in touch
We have not yet published a contact address, because an address that bounces is worse than none. This page will not go live in front of real users without one — the build refuses. If you are reading this on a preview, that is why.