Privacy policy

1. Data We Collect

We collect the following categories of information:

Demographics: Age, education level, and other optional demographic information you provide before taking a test.
Test responses: Your answers to individual test items, including response times and accuracy.
Scores and results: Computed cognitive scores, subscale breakdowns, and percentile rankings.
Account information: Username and account credentials for registered users.
Reference data: Any additional information you voluntarily provide for calibration or personalization purposes.
Visit record (with Analytics consent): The page you landed on, the campaign tags in its link, your device type, browser, and language, and the country taken from your connection. We never store your IP address.

2. How We Use Your Data

Scoring: To compute and deliver your cognitive assessment results.
Calibration and research: Aggregated and de-identified response data is used to improve our adaptive testing models, validate item difficulty parameters, and conduct internal research.
Service improvement: Usage patterns and feedback help us enhance features and user experience.
Account management: To manage your account, authenticate your identity, and provide customer support.

3. Data Storage

Your data is stored on secure servers. All data is encrypted in transit (TLS) and at rest. Our infrastructure is hosted in secure, SOC 2-compliant data centers. We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. Direct messages between members are stored on our servers and are not end to end encrypted. They are protected from other members by access controls, and may be accessed by authorized staff only where necessary for safety, moderation, or to comply with the law.

4. Data Retention

Assessment and Life Tools data is retained for as long as your account is active and as needed for calibration and research purposes. De-identified aggregate data may be retained indefinitely. You may request deletion of your data at any time (see Your Rights below).

5. Cookies, Local Storage and Tags

Our own code does not set cookies. We use your browser's local storage to keep you signed in, to remember your cookie choices, to keep your preferences if you allow it, and to hold Life Tools data on your device.

The Service also contains analytics and advertising tags. They ship switched off: nothing in these categories loads until you opt in through the cookie banner (except the cookieless visit count under Analytics), and none of it ever loads on test, scale, counselling, support, or crisis pages.

Analytics (opt in): PostHog (PostHog Cloud on EU servers, with on-screen text masked and session recording off). With your consent we also keep our own record of the visit: the page you landed on, campaign tags, device type, browser, language, and the country taken from your connection, never your IP address. Before you choose, and if you decline, PostHog still counts the visit without cookies, using a one way daily hash it cannot reverse, with no cookies, no storage, no profile and no country. On our production site, Cloudflare Web Analytics also counts visits and page load speed, without cookies.
Marketing (opt in, separate from Analytics): Conversion tags from Google Ads, Reddit, Meta, and TikTok. They learn only that someone who came from one of their ads signed up or finished a test, never your answers, scores, results, or user ID. Google Ads runs with ad personalization denied.

Saying yes to one category never turns on the other. You can withdraw at any time in your privacy settings, and we treat a Global Privacy Control signal as an opt out of Marketing. Our Cookie Policy lists every storage entry and every provider.

We do not sell, rent, or trade your personal data, and we do not share it for cross-context behavioral advertising. Data reaches others only in these cases:

Community sharing: Other community members can view your public profile information and posts. You control your privacy settings to determine what is visible.
Service providers: Companies that run the Service for us under data processing agreements: Supabase (database and sign-in), Cloudflare (hosting, content delivery, bot protection, and, with your Analytics consent, Web Analytics), and Sentry (error reports, with emails, names, answers, and messages removed before they leave your browser). PostHog receives usage data only if you opt in to Analytics; without it, only the cookieless visit count in section 5.
Advertising partners: Only with your Marketing consent, Google, Reddit, Meta, and TikTok receive the conversion signal described in section 5. If we show display ads, they are contextual: matched to the page, not to you. Your results, mood logs, and other personality-derived data are never used to target ads.
Affiliate partners: Some recommendations link to partners who pay us a commission (see our Affiliate Disclosure). When you follow one, the partner and its affiliate network learn that your visit came from us, so they can credit the referral. We send them no answers, scores, results, or account details, and what you do on their site falls under their own privacy policy. We keep our own record of the click; without Analytics consent that record carries no user or session ID.
No payment processor: The Personality Project is free for consumers. We do not take payments from you, so no payment processor receives your data.
Legal requirements: We may disclose data if required by law, regulation, legal process, or governmental request.

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar data protection laws, you have the following rights:

Access: Request a copy of the personal data we hold about you.
Rectification: Request correction of any inaccurate personal data.
Deletion: Request erasure of your personal data, subject to any legal retention obligations.
Portability: Request your data in a structured, commonly used, machine-readable format.
Restriction: Request that we restrict processing of your personal data under certain circumstances.
Objection: Object to processing of your personal data for certain purposes.

To exercise these rights, first log in and use the self-serve controls in Settings → Privacy, where you can export your data, correct your profile, and delete your account. For rights that cannot be self-served, contact us at privacy@thepersonalityproject.com. We will respond to your request within 30 days.

8. Children

The Personality Project is not intended for use by individuals under the age of 16. You must be at least 16 years old to use our platform. We do not knowingly collect personal data from children under the age of 16. If we become aware that we have inadvertently collected data from a child under 16, we will take steps to delete that information.

9. Data Deletion & Export

You have the right to request deletion or export of your personal data at any time.

Requesting data deletion

To delete your account, log in and go to Settings → Privacy, then select Delete my account. Deletion is scheduled 30 days ahead; until then your account works as normal and you can cancel the deletion on that same page. After 30 days your account and the personal data tied to it are permanently deleted from our active systems; forum posts and comments you wrote stay, with your name removed. We do not send emails about deletion, because accounts are created with a username only.

Requesting data export

To receive a copy of all personal data we hold about you in a machine-readable format (JSON), log in and go to Settings → Privacy, then select Download my data. The file downloads straight away.

10. Contact

If you have questions about these Terms of Service or our Privacy Policy, or if you wish to exercise your data protection rights, please contact us using the details below.

Email: privacy@thepersonalityproject.com