Privacy Policy

MindHits is operated by [OPERATOR — registered legal name], [ADDRESS — registered address], [REGISTRATION — company / VAT number] (“we”, “us”). For the limited processing described below we are the data controller within the meaning of the EU General Data Protection Regulation (GDPR) and the UK GDPR.

Questions about this policy, and all requests about your data, go to [PRIVACY EMAIL — data requests].

The rest of this document explains that claim precisely, including every place where data does leave your device, because a privacy policy that only lists the good parts is not worth reading.

Every assessment on this site is scored by code running in your browser. Your answers, your scores and up to five previous attempts per test are written to your browser's localStorage under the key assessments.v1. That storage belongs to your browser on your device. It is not transmitted to us, it is not synchronised between your devices, and it is not readable by any other website.

You can erase it at any time: use the “Start over” and clear controls on the site, or clear site data for this domain in your browser settings. Using a private window means it is discarded when you close the window. If your browser blocks site data, the site still works and simply forgets everything when the tab closes.

Because we never receive this data, we cannot retrieve it, restore it or delete it for you. A request to us for a copy of your answers will correctly return nothing.

Some instruments here — the GAD-7 anxiety screen, the WHO-5 Well-Being Index and the Perceived Stress Scale — ask about symptoms, mood and distress. Under GDPR Article 9 your answers to those are data concerning health, a special category which deserves more care than a personality questionnaire.

The design answer is the same as above: those answers are scored and stored only in your browser, and none of those tests offers a paid report, so they never travel to a payment provider. Where you deliberately create a share link (clause 5), you are choosing to put health data into a URL; we would advise against doing that with these three tests in particular.

Where you take such a test, we rely on your explicit consent under Article 9(2)(a), given by choosing to answer. You may withdraw it at any time by clearing your stored answers, which removes the data entirely.

A result can be turned into a link that carries your answers encoded in the address itself, after the ?a= part. This is what lets someone else open your exact result without us storing it anywhere. It has consequences you should know about before you use it:

• Anyone who has the link can reconstruct every answer you gave, not only the summary scores.
• The link is not secret and not expiring. Pasting it into a chat, an email or a ticket leaves a copy wherever that message lives.
• Web servers normally record the addresses they are asked for. A share link therefore appears in our hosting provider's request logs, and in the logs of any proxy between you and us.

The extended report is sold through Polar, which acts as merchant of record. That means the sale contract for payment purposes is with Polar, and Polar — not us — collects and holds what a payment requires: your email address, billing and tax location details, and the card or payment-method data handled by their own processors. We never see your card details.

To make the report work without a database, the checkout carries:

• the identifier of the test you took, and your encoded answer sheet, stored as metadata on the Polar order;
• nothing else — no name, no device identifier, no history of other tests you have taken on this site.

When you open your report, we ask Polar whether that checkout was paid, read the answer sheet back off the order, and re-score it to render the page. We do not keep a copy. Revoking or deleting the order at Polar therefore also removes our ability to re-open your report.

Our lawful basis for this processing is performance of a contract with you (Article 6(1)(b)). Polar is an independent controller for the payment data it collects; its own privacy policy governs that, and you should read it at polar.sh/legal/privacy. Where Polar or our hosting provider processes data outside the EEA, that transfer relies on the mechanisms set out in their respective agreements, including the European Commission's Standard Contractual Clauses.

We log that a sale happened — order identifier, which test, amount and currency. The answer sheet is deliberately excluded from that log.

Like any website, this one is served by a hosting provider that records technical details of each request: the IP address it came from, the address requested, the time, the referring page and the browser's user-agent string. We use these only to keep the site available and to investigate faults and abuse. That is our legitimate interest under Article 6(1)(f).

Note the interaction with clause 5: if the address requested is a share link or a checkout link, the encoded answer sheet forms part of that address and is therefore part of the log entry.

We set no cookies. We run no advertising, no tracking pixels, no session recording and no A/B testing, and we do not build a profile of you or follow you to other sites.

We do count visits, using DataFast in its cookieless mode. It tells us how many people opened which page, which site sent them and roughly where in the world they are. It stores nothing on your device and reads nothing back from it, which is why this site has no consent banner: the ePrivacy rules that require one are about storing and accessing data on your equipment, and this does neither.

What the counter never sees is anything from inside a test. Your answers, your scores and your results are not sent to it, because they are not sent anywhere — they never leave your browser. Share links are the one exception you create yourself, and clause 5 covers those.

Typefaces are compiled into the site at build time and served from this domain, so no page here requests anything from Google Fonts. The third parties involved are therefore three: our hosting provider, which serves the pages; DataFast, which counts them; and Polar, which appears only if you choose to buy a report and which sets its own cookies on its own checkout domain.

• Your answers and results: in your browser, until you clear them. We hold no copy and therefore no retention period applies to us.
• Purchase records: kept by Polar for as long as its own policy and the applicable tax and accounting law require, which is typically several years.
• Server logs: kept for the short rolling period our hosting provider applies, and not consulted except to diagnose a fault or abuse.
• Visit counts: kept by DataFast as aggregate figures. Nothing in them points back to a person, so there is nothing in them to delete on request.

If you are in the EEA or the UK you have the right to request access to your personal data, its correction or erasure, restriction of or objection to processing, and portability; to withdraw consent at any time without affecting processing already carried out; and to lodge a complaint with a supervisory authority — in our case [SUPERVISORY AUTHORITY]. Comparable rights exist under other laws, including the right to know and to delete under California law.

Write to [PRIVACY EMAIL — data requests] and we will respond within one month. Two practical points: for anything stored in your browser the fastest route is to clear it yourself, which is immediate and complete; and for purchase data we will forward your request to Polar where it is Polar that holds the record.

We have never sold personal data and have no intention of doing so.

This site is not directed at children. The instruments here were validated on adults and the results are meaningless for younger respondents. Do not use the site if you are under 16, or under the age at which you can consent to online services where you live if that age is higher.

If this policy changes, the date at the top of the page changes with it. Where a change materially affects what happens to your data we will say so on the site rather than relying on you to re-read this page. The version in force is the one published here; see also the Terms of Service.