DRAFT · Not in force
Stat Sheet Privacy Policy
Effective date: {{EFFECTIVE_DATE}}
Stat Sheet is operated by {{ENTITY_NAME}}, {{ENTITY_ADDRESS}}. Privacy and rights requests: {{PRIVACY_EMAIL}}. Safety reports and moderation appeals: {{SAFETY_EMAIL}}.
Privacy summary
- Stat Sheet is for US residents aged 18 or older. Age and residence are self-declared; we do not verify residence or request a birth date. Signup availability depends on the operator's invitation/open-signup configuration.
- Guest Mini-IPIP answers stay in this browser until an authenticated member explicitly saves them to an account.
- Account answers, scores and writing support private results. Social discovery, matching, community contributions and health-related channel eligibility have distinct choices described below.
- No ads are shown at launch. We do not sell personal information or consumer health data, or share member data for cross-context behavioral advertising.
- The FAQ is static and identical for everyone. No member data is sent to AI models today. Research copying is inactive.
- Settings provides export, product-consent withdrawal and account deletion. Withdrawal stops use without deleting existing records. Deletion has the limited exceptions below.
Guest quest and browser storage
Mini-IPIP can be completed logged out. Browser localStorage holds a random quest ID, questionnaire version, answers, current question and completion status. If a save choice is made during signup, it also holds that choice and its email address. The guest answers do not reach the server until signup or sign-in and the explicit “Save to my Sheet” action. Ordinary page requests still reach the host and Cloudflare; creating an account sends account information separately.
A signup save choice applies only to the same normalized email address; it does not authorize saving into a different account. The save screen requires product consent, and the server rejects an import without an explicit affirmative save flag. “Discard saved quest” removes the local quest. Successful saving clears that browser copy; a failed save keeps it for retry. Clearing this site's browser storage also removes it. A local copy has no automatic expiry and is not protected from other people using the same browser profile.
Information and purposes
| Information | Use and visibility |
|---|---|
| Email, password hash where used, sign-in credentials, age/Terms and versioned consent records | Account access, security and recording choices. Passwords use salted scrypt hashes; account-link tokens and session credentials are hashed. |
| Partial answers, completed answers and retakes, scores, questionnaire/scoring versions, answer times, response latency and quality flags | Private results. Quality flags describe answer patterns, not diagnosis or dishonesty. Guest imports do not contain per-answer response latency. |
| Optional private name and sheet writing, including class, backstory, quest, quirks, skills and items | Private account features. The private name is included in export and is not shown to other members. Contact discovery is inactive. |
| Outside-test names, scales, entered results, reported dates/formats, corrections, large-change confirmations, link actions and timing | Private self-reported history. Stat Sheet does not administer or verify outside tests. Earlier corrections remain in history until result/account deletion. |
| Chosen social name, bio, interests, coarse location, discovery range, connections, posts, messages, votes, reports and blocks | Optional social features and safety. Other members see content through the audiences and features used. |
| Feedback text, type, page path, app surface/version, coarse viewport, contact permission and team review records | Product feedback. The account email is looked up for contact only when contact is allowed. |
| Sign-in/action counters and operational records | Security, misuse prevention and operation. Counters may use an account ID, a code derived from email, or a network address. |
| Extras | Server-checked Sudoku attempts and patterns checks are account-linked and exported. Browser-local practice/music/puzzle progress and older Extras storage are separate and are not in account export. |
Optional About-you demographics, transcript extraction and research occupation/education coding are not active. They cannot begin under this notice alone. Any future collection needs a defined purpose, limited categories, retention, licensing checks and new choices; sensitive fields require their own unchecked opt-ins and cannot be used in ads, matching or public profiles.
Sensitive information and choices
We treat Mini-IPIP Neuroticism, IPIP-NEO-120 Neuroticism and its Worry, Anger, Low mood, Self-Consciousness, Immoderation and Vulnerability facets, and CAT-Q total, compensation, masking and assimilation as health-adjacent. Associated answers, timing, quality flags, outside health/neurodivergence results and health-revealing text or inferences can also be consumer health data. The Consumer Health Data Privacy Policy explains sources, recipients and rights.
CAT-Q requires separate unchecked collection/use and sharing choices. Other questionnaires currently use product consent; optional outside-result saving requests storage without an additional health collection/sharing screen. We do not represent those paths as having CAT-Q's separate consent controls. Separate consent to collect and separate consent to share are the policy standard for consumer health data; the broader controls still require implementation before relying on that standard across all health-adjacent collection.
TwIVI includes a religion item and IPIP-NEO-120 includes political-opinion items. These contribute to private scores and can affect eligible values/personality matching with the separate matching choice. There is no separate item-level product consent screen today. Sensitive religious/political trait gates are excluded from channels.
Social visibility and location
Both members must enable matching for score-based discovery. Eligible personality/values scores, interests and distance affect comparisons. Health-adjacent scales, CAT-Q, O*NET interests and experimental H-H do not affect matching. Eligible promoted non-health outside community results can contribute percentile positions only with community contribution, confirmed mapping and a per-result matching choice. Catalogue outside results are not matching inputs.
Discovery shows chosen profile details, a broad tier (very similar, similar or other), a confidence level (low, medium or high, from how many matching quests you have both completed) and coarse distance labels, not exact scores, answers, similarity percentages or dimension names. Nearby uses score-based ranking only when both members enable matching; otherwise distance within base ranges applies. A pseudonym or coarse tier does not guarantee anonymity.
Location is requested by a member action and rounded to 0.1 degree for storage. There is no background tracking; location/range changes have a 24-hour cooldown. We do not use geofencing to identify or target visits to health-care facilities.
Channel trait gates exclude flagged sensitive scales. Separate optional health-result channel-access choices can reveal eligibility when a member requests or joins a channel. Owners and moderators can infer that the conditions were met; numeric scores and answers are not displayed. Health-related community names, memberships or message content can themselves reveal sensitive information. The default-off community-contribution switch permits eligible outside results to contribute to names and percentile cohorts; confirming a label alone is not consent.
Nearby posts omit profile names but retain an internal author account. Direct/private chats have their participants; group/channel messages have their permitted audiences. Reports permit operator review of reported content, including up to 20 recent messages for a reported Nearby private chat. Recipients can copy content. Pausing discovery leaves existing conversations; Leave social removes social records. Product withdrawal blocks further product/social use without deleting previous content.
Hosting, email and recipients
Production runs on an operator-controlled US Windows machine with local PostgreSQL 17, fronted by Cloudflare DNS and a tunnel. Cloudflare processes web requests and associated connection details, paths and content to route traffic. Microsoft OneDrive holds an encrypted offsite database backup. The operator also keeps local and operator-PC backup copies. We do not claim that every provider processes data exclusively in the US.
Production deployment supports Postmark or SMTP2GO for account emails; application configuration also supports Resend. The selected provider receives the email address and account message/link, not questionnaire answers through this integration. Provider log and email retention periods are not established by the application. We do not describe every supported provider as receiving every message.
Service providers process information needed to operate these features. We do not provide health data to affiliates or third parties for their independent commercial use. Disclosures required by law are limited to the applicable requirement. The rights contact can provide recipient details. No absolute security or universal encryption-at-rest guarantee is made.
Advertising
No ads are shown at launch. When enabled, general pages such as the landing page, Sources and general channel directories may show non-personalized contextual placements labelled “Sponsored” from EthicalAds and Carbon Ads (BuySellAds), selected by page content and approximate region, never by who a member is. Ads will not appear on test-taking, results/sheet, outside results, health-adjacent pages, DMs, channel message views or Nearby.
Loading an ad can send the network an IP address, browser type, page address and referrer, subject to browser restrictions. EthicalAds' privacy policy describes content/geography targeting without behavioral targeting and deletion of IP-bearing logs within 10 days, with stated exceptions. Carbon Ads' privacy policy describes its own cookies, including carbonads.net and syndicateads.net, pages viewed and approximate location.
Stat Sheet will share no account, assessment, health, social or saved location data with advertisers or ad networks. The browser request information just described is separate from those member records. Any future first-party personalized advertising requires a separate explicit opt-in by pressing a button and typing “consent”. It is off unless turned on and will never use consumer health data. These plans do not activate ad serving or consent controls today.
FAQ, future AI and research
The FAQ does not use member data. No member data is sent to AI models today. A future AI assistant must be off by default, require its own opt-in, and exclude health-adjacent scores including Neuroticism and CAT-Q unless separately consented. A policy update and re-consent are required before any such AI processing starts.
Continuous research copying is not active. The general research switch cannot be enabled. Outside-result research choices record consent only and copy nothing. Future research is optional, off by default and separate from product use; activation needs updated disclosure, fresh consent, working withdrawal and privacy safeguards. See Research and retention. Account deletion creates no research copy. Older unlinked research records may remain; their anonymity is not verified and an account cannot reliably locate them.
Retention, export and deletion
Account data generally remains until edited or deleted. Settings offers JSON export and deletion, including for locked accounts. Export includes available answers, scores, consent and outside-result history, own social records, server Extras and feedback; it omits credentials, incoming reports, operator notes and some other-member identifiers. Some histories are capped and export flags truncation; the rights contact handles further access requests.
CAT-Q deletion withdraws its two choices and removes active CAT-Q answers/scores; consent withdrawal events remain with the account. Outside-result deletion removes the selected results and associated choices. Account deletion removes account-owned records and signs the member out, but feedback remains with its account link removed. Feedback text can still identify someone; no automatic feedback purge exists. Contact us for identifying-text deletion.
A locked/timed-out account can leave a code derived from its email and its restriction expiry to prevent evasion; permanent locks have no expiry. Non-account-keyed security counters are cleaned separately. Recipient copies, unlinked older research and browser-local data may remain. Browser storage can be cleared separately; uninstalling or clearing a browser does not delete the server account.
Nightly database dumps, operator-PC copies and encrypted OneDrive copies have configured 30-day retention. Offsite staging keeps three dumps by count, so failed jobs or other recovery/export copies can outlast that period. Account deletion does not automatically erase backups or provider records. We do not promise universal deletion within 30 days. Rights requests include processor deletion where required. Before a restored backup is used, the operator must reapply deletions and withdrawals; this is an operating duty, not an automated restore feature.
Rights, requests and appeals
Contact {{PRIVACY_EMAIL}} for confirmation of processing, access, a copy, correction, deletion, withdrawal, recipient details, or applicable limits on sensitive-data use and sale/sharing/targeted-advertising opt-outs. These choices do not cause a moderation penalty. Requests can be made without an account; an authorized agent can contact us with evidence of authority. Proportionate identity checks protect the requester and others.
We respond within 45 days, with at most one additional 45 days where allowed and with reasons and notice within the initial period; any shorter applicable deadline controls. A denial explains the reason and appeal route. Reply to the decision to appeal; we respond to appeals within 45 days and explain available regulator complaint routes. This is a manual contact process, not an in-app case tracker. We do not charge for ordinary rights requests.
Washington My Health My Data Act, Nevada SB 370 and Connecticut consumer health data protections are addressed through access/confirmation, a list of third parties and affiliates receiving health data with contact details where required, withdrawal of collection/sharing consent, and deletion including notification to processors and other required recipients. We offer these request routes to all launch members without limiting additional state rights. Complaints can go to the Washington Attorney General, Nevada Attorney General or Connecticut Attorney General.
Children and changes
The service is for US adults 18+. Under-18 correction locks product access and leaves export/deletion available. Reports of minor use go to the privacy contact for removal; there is no promise that older unlinked research can be located by account. No under-18 research collection is authorized.
Material changes will be described before activation. New sensitive uses, AI processing and research require the separate fresh choices described here. Filling operator details does not itself grant consent or activate a planned feature.