Legal

Privacy

Last updated 6 October 2026. This page describes the data this site actually keeps.

What you give us

• An email address and a password, if you create an account that way. We store the password as a salted hash, not as the password itself. We email that address to confirm it, to send a login link or a 6-digit code you asked for, and to reset a password. If you ask to log in and the address has no account, we email it once to say so and include a link to create one. We do not send a newsletter.
• If you sign in with Google, Apple, or Facebook, we receive the email address that provider shares and treat it as confirmed. We do not receive a password from them.
• Your answers, long enough to score the test. An unfinished test stays in this browser. We do not keep a copy of each answer on the server. If you are logged in when you finish, the account keeps the result: the test, the habit or score, and the date.
• Messages you send from the contact page.

What we store about the account

• Whether the plan is Free or Kept.
• The tests you finish while logged in, so you can open them again.
• A Stripe customer id and subscription id, once you pay.
• A session cookie so you stay logged in.

Payments

Stripe charges the card. We do not store the card number, expiry, or security code. Stripe tells us whether the payment succeeded and which customer it belonged to.

Cookies

Details are on the cookie page. In short: one login cookie, and the browser’s own storage for an unfinished test. We do not run an advertising or analytics cookie.

How it is used

To run the tests, keep you logged in, deliver Kept, answer a message you sent, and deal with fraud or a legal request. We do not sell personal data, and we do not use answers to make a decision about credit, housing, or a job.

How long

The account lasts until you ask us to delete it, or until we close it under the terms. Contact messages are kept long enough to answer them and then removed. Ask for deletion from the contact page using the email on the account.

Where it sits

The account database is on the server that hosts this site. Stripe processes the payment in their own systems, which may be outside your country. Card data is handled under Stripe’s terms. Google, Apple, and Facebook handle their own sign-in on their sites, then send us the email address.

Your request

You can ask to see, correct, or delete the account data we hold. Email is the key we look up. If a privacy law where you live gives you other rights, say so in the message and we will follow the ones that apply.