Privacy Policy

The short version

You can take every test on this site without giving us anything that identifies you. There is no sign-up, no email capture, no profile and no advertising network. Your answers are scored by JavaScript running on your own device, and by default the only thing transmitted is the final number.

Three things are recorded, and this page describes each one:

1. Every submission writes one row: which test, the score, the time.
2. Only if you tick the box before submitting, the list of statements you checked is sent and added into per-question counters. It is off unless you turn it on.
3. Page views are counted per day, per path, per referring site, with no cookie and no identifier.

What a submission contains

When you finish a test, your browser sends one request to /api/submit. The row it writes has exactly three columns:

• test — which questionnaire it was, as a short key such as classic.
• score — the final number, 0 to 100.
• timestamp — set by the database when the row is written, not sent by your browser. It is what the “last 24 hours” figure on the statistics page is counted from.

The request carries two more values that are checked and then thrown away rather than stored: a short-lived signed token the page fetched from /api/session when you started, and how long you spent on the questions. The token holds the test key, the time it was issued and a random number — no IP address, no identifier, nothing about you — and exists so a script cannot post thousands of results in a second. Its random number is remembered just long enough to stop the same token being replayed.

That row is what the statistics page, the median and the percentile line on your result are calculated from. It contains no name, no email, no account, no advertising identifier and no per-question answers. Nothing in the row distinguishes your submission from anyone else’s with the same score.

As with any web server, the request reaches us over the network and our web server keeps standard operational logs (IP address, user agent, requested path, response code) for a short period so the site can be kept online and abuse can be blocked. Those logs are not joined to the score rows and are not used to build any profile.

One more thing happens with your IP address, and it is worth naming: the submit endpoint counts recent requests per address in memory so a script cannot flood the statistics. The address itself is not held — it is turned into a keyed hash with a random key the server picks at startup and forgets on restart, and that hash is what the counter is filed under. Against it sits nothing but a list of submission times, kept up to twenty-four hours because the cap is both per minute and per day, then dropped. It is never written to disk and never stored alongside a score.

The optional answer sharing

Above the submit button there is a checkbox offering to share, anonymously, which statements you checked. It starts unticked. Leave it alone and your answers stay on your device exactly as described above.

Tick it and the request adds one more field: a list of question numbers, such as [3, 17, 42]. The server does not keep that list. It adds one to a counter for each question you checked, and one to the counter for how many people answered that test, and the list is gone. What remains is a table of totals per question — the numbers behind the percentages on the question breakdown page. No row anywhere links a set of answers to one person, so your combination of checks is not reconstructable, not by us and not by anyone reading the table.

Changing your mind: untick the box. The choice is remembered in your own browser under the key rptk.consent, so once you untick it, later submissions send nothing extra until you tick it again. Clearing site data resets it to off.

What cannot be undone: a count already added cannot be taken back out. Your checks were added to totals shared with everyone else who opted in, and there is no record of which additions were yours to subtract. We would rather say that plainly than promise a deletion we have no mechanism to perform. That is the trade for the counters holding nothing that could identify you — think before the tick, not after.

How page views are counted

Each page sends one small request to /api/ping, which increases a counter keyed by three things: the day, the path you are on, and the hostname of the site that linked you here — google.com or reddit.com, never the full address you came from. That is the whole record.

There is no cookie, no visitor id, no device fingerprint and no session in it, so two views by the same person on two pages are indistinguishable from two different people. It cannot follow anyone around the site, which is the point: it answers “how many people read this page yesterday” and nothing else.

Blocking it is fine. A content blocker, a privacy extension or disabling JavaScript stops the request; the tests, the scoring and every page still work exactly the same, and the view simply is not counted.

What stays in your browser

Three pieces of state live on your device:

• sessionStorage holds your in-progress answers while you are taking a test, so a refresh does not wipe eighty checkboxes. It disappears when you close the tab.
• localStorage holds your own result history — the list you see on the history page. It survives closing the browser and stays on that one device. It is not synced, and we cannot read it.
• rptk.consent in localStorage remembers whether you ticked the answer-sharing box, so you are not asked to decide again on every test. It holds that one choice and nothing else.

How to clear everything

The history page has a “Clear history” button that empties the saved list immediately. Closing the tab drops the in-progress answers on its own. To remove both at once, clear site data for this domain in your browser settings — in Chrome and Edge under Settings → Privacy → Third-party cookies → See all site data, in Firefox under Settings → Privacy → Cookies and Site Data → Manage Data, and in Safari under Settings → Privacy → Manage Website Data. Using a private window leaves nothing behind when you close it.

Clearing local data resets the answer-sharing choice to off, but it does not remove the anonymous score row already written to the statistics table, and it cannot subtract a shared answer from the per-question totals — nothing links either of them to you or to your browser.

Cookies and analytics

This site sets no cookies of its own. There is no consent banner because there is no cookie or tracker to consent to. At the time of this update the site runs no analytics product, no advertising script and no third-party script of any kind; the page-view counter described above is our own code writing to our own database, and it stores no identifier. sessionStorage and localStorage are used only for the three purposes described above.

If analytics are ever added, this section will name the product, say what it collects and carry a new update date before it goes live.

Children and the teen test

The classic hundred-question test contains explicit material and is for adults aged 18 and over. The teen version is written for ages 13 to 17 and is intentionally free of explicit questions, but it still asks about alcohol, dating and rule-breaking — it is best taken with a parent or guardian aware of it.

The site is not directed at children under 13 and we do not knowingly collect anything from them. Because no submission carries an identifier, we have no way to detect a child’s submission after the fact and no record to delete. A parent with a concern can write to [email protected].

GDPR, CCPA and why requests are impossible

Laws such as the GDPR and the CCPA grant rights over personal data — access, deletion, correction, portability, opting out of sale. Those rights attach to data that can be linked to a person. The score rows here cannot be: they are a test key, an integer and a time, with nothing to search by.

The plain consequence is that we cannot fulfil an access or erasure request for a score, because we cannot find yours among identical anonymous rows and could not confirm it was yours if we did. This is not a refusal — there is no personal data record to act on. We do not sell or share data, because there is none to sell. Data held on your own device is under your control, and the clearing instructions above are the erasure mechanism for it.

The same reasoning covers the other two records, and it cuts both ways. The per-question counters and the page-view counts are aggregates: they are sums, not rows about people, which is why they fall outside those rights — and also why a request to remove your contribution from them is one nobody could carry out, ours or anyone else’s. The control you have over the per-question counters is the one that exists before the fact: the box, which is off unless you tick it.

Hosting and third parties

The site runs on a virtual private server we rent and administer ourselves, with the database on the same infrastructure. Score rows are not passed to any third party, and no data processor receives them for analytics, advertising or enrichment. Our hosting provider necessarily handles network traffic to reach the server, as any host does.

Outbound links to other sites are governed by those sites’ own policies, not this one.

Changes to this policy

Changes are published on this page with a new date at the top. Substantive changes — adding analytics, adding accounts, collecting anything new — will be described in specific terms here rather than behind a general phrase about improving the service.

Contact

Privacy questions go to [email protected]. The contact page lists what to include so the answer is useful first time.