Privacy

PRIVACY POLICY.

Plain-language summary of the actual data flows in this build — not a substitute for legal counsel before commercial launch.

What we collect

Email address (for sign-in), identity-verification outcome (age eligibility and country, via a mock provider in this environment), payment records for your attempt, your assessment responses and timing data, and content you post (ideas, evidence, predictions).

What we don't do with your assessment

Your item-level responses are used only to compute your attempt’s composite score under the documented scoring algorithm. We do not sell assessment data, and we do not use it to make claims about you beyond the disclaimer shown on your result.

Retention

Session tokens are revocable on logout. Payment and identity-verification records are retained as required for fraud prevention and dispute handling. There is currently no self-service data export or deletion endpoint on the API — see Settings for how to request one manually.

Sharing credentials

A qualified credential can be shared publicly via its verification link (/verify/[credentialId]). Sharing is opt-in: creating a share is a separate action from qualifying, and shares can be revoked.

Security

Access tokens are held in memory only, never in browser storage. Refresh tokens are stored in an httpOnly cookie your browser’s JavaScript cannot read. See the README for the full session handling writeup.