Privacy Policy

Last updated: October 2, 2026

Neuropsych ("we," "us," "our") operates the website neuropsych.io. This policy explains what data we collect, why, how we store it, and your rights.

1. What we collect

When you create an account, accept an updated version of this policy, or first accept the consent screen before a test, we store the consent version and acceptance time. If you are signed in, the record may be linked to your account. We do not send your browser's exact user-agent string as part of this consent record.

When you request a report, we store the age shown in the form so we can select the appropriate published comparison data. If your profile has a saved date of birth, we use it to prefill that age. The report flow does not change your saved date of birth.

The device and measurement context is a small technical snapshot that your browser declares: screen size, pixel density and refresh rate, touch or keyboard input, coarse memory and processor capacity, network quality category, battery level, and a yes-or-no flag for whether the page is running inside another app's built-in browser. Cognitive tests are timing-sensitive, so this context is stored alongside results to help interpret them correctly. To derive that last flag, the site may inspect the browser's user-agent string in memory and then discard it. The exact user-agent string and user-agent client hints are not stored in this context. The snapshot contains no identity, no location, and nothing else from your device.

When you buy a report, Link (a Stripe company, which sells it as the merchant of record) collects your name, email address, billing address and payment details, and a phone number if you choose to save your details with Link. We receive the payment's status and amount, your country and the email address on the payment. We never receive your card details.

When you reach the payment step, your answers, age, results and, if your profile has one, gender are saved on our servers so your report can be written even if you close the page. If you don't pay, they are deleted within 24 hours (14 days while a payment is being confirmed). Answers you are still filling in are kept only in your browser, for up to 30 days.

We do not collect: real names (unless you enter one), precise location, or anything on your device outside the tests themselves (no contacts, files, photos, or browsing history). We do not store IP addresses; the analytics and advertising providers in section 9 receive them.

2. How we use your data

• Assessment scoring: Your test responses are processed to generate cognitive domain scores and, if requested, a Cognitive Assessment Report.
• Normative comparisons: The age shown when you request a report selects the current age-appropriate published comparison data. Gender is not required or used for current report scoring.
• Measurement context: Device characteristics (for example, touch versus keyboard input, or the screen's refresh rate) are stored with your results so timing-sensitive scores can be interpreted correctly and technical problems can be diagnosed.
• Report feedback: If you choose to rate a generated report or add a comment, we use that feedback to improve the report experience. The rating and optional comment are stored with your account and that report, are not shown to other users, and can be submitted once per generated report. Authorized platform operators may review them to improve the experience. Please do not include names, diagnoses, or other personal or medical details in the comment.
• Research and normative data: We use test results and the measurement context stored with them to build normative benchmarks and improve our tests. We may also de-identify this data and use, publish or license it, including to research and commercial partners and for compensation. De-identified data carries no name, email address, account identifier or free-text answers and cannot reasonably be linked to you. We do not attempt to re-identify it and we require recipients to commit to the same in writing. This applies to data collected after you accept this version of the policy. Data collected before that, and data from users under 18, is not included.
• Communication: We use Resend to deliver transactional messages and, if you subscribe, periodic updates about new tests and validation studies. Resend receives the minimum email data needed to deliver and monitor those messages, as described below.

3. Anonymous users

You can take one test without creating an account. Anonymous test results are stored only in your browser's localStorage and are not sent to our servers; if you clear your browser data, these results are permanently lost. Like every visit, anonymous sessions generate basic usage events (pages viewed, tests started, device context) tied to a random session identifier. These contain no identity, and we have no way to connect them to you or contact you.

4. Where data is stored

• Authentication and user data: Supabase (hosted on AWS, US region). Encrypted at rest (AES-256) and in transit (TLS 1.2+).
• Website hosting: Cloudflare Pages (global CDN). Cloudflare delivers our static files and, through Cloudflare Web Analytics, counts visits in aggregate (see section 9).
• Email delivery: Resend processes the recipient address, sender, subject, and transactional or subscribed-update message content needed to deliver email. It also returns operational events such as sent, delivered, delayed, bounced, complained, suppressed, and opened.
• AI report generation: When you request a Cognitive Assessment Report, we send your test results, age and chosen questionnaire answers to the Anthropic API to prepare and review its explanations. We do not include your account email, display name or date of birth in these prompts. Anthropic is an external AI provider; this processing is not local to your device. Your questionnaire answers and generated report are stored in Supabase linked to your account. New reports containing questionnaire context use private PDF storage and require you to sign in to download them.

5. Data sharing

We do not sell or rent your personal data. We disclose it only to the service providers listed below, or when required by law. We share limited browsing data with analytics and advertising providers as described in section 9, and you can turn that off there. De-identified data, as described in section 2, is not personal data.

The service providers with access to user data are:

• Supabase: Database and authentication provider. Subject to their privacy policy.
• Resend: Email delivery provider. Resend receives the email information described above and processes it under its privacy policy. We do not send Resend your test responses, cognitive scores, report content, date of birth, or clinical data.
• Anthropic: AI processing of the report inputs described above. See its data retention information. Anthropic does not use API data to train its models by default. Anthropic deletes API inputs and outputs within 30 days, except content flagged for Usage Policy enforcement, which it may keep longer; this is not zero data retention. Answer only what you are comfortable sharing; questionnaire answers can include sensitive information about health or learning history.
• Google: Analytics provider (Google Analytics). Subject to their privacy policy.
• Meta: Advertising provider (Meta Pixel). Subject to their privacy policy.
• Google OAuth: If you sign in with Google, Google provides us your email and profile picture. We do not receive your Google password or access any other Google data.
• Payments: Link, a Stripe company, sells the report as the merchant of record and processes the payment. It collects the payment details described above under its own and Stripe's privacy policies. We receive the payment's status and amount, your country and the email address on the payment, never your card details.

6. Data retention

• Account data is retained as long as your account exists.
• Test results are retained as long as your account exists.
• Your latest questionnaire is saved for review before a future request. Each report keeps the answers you submitted for that report; changing later answers does not rewrite an earlier report. Removing your profile removes its questionnaire and associated context-bearing report records.
• Answers, age, results and gender saved at the payment step are deleted within 24 hours if you don't pay, or within 14 days while a payment is being confirmed. Once paid, they become your report request.
• Optional report feedback is retained while the associated account and report request exist.
• Newsletter subscriptions are retained until you unsubscribe (email us at the address below).
• When you delete your account, all associated data (profile, test results, report requests, and report feedback) is permanently deleted within 30 days.
• De-identified data already included in a dataset cannot be withdrawn, because it is no longer linked to you.

7. Your rights

Regardless of where you live, you can:

• Access your data: View your profile and all test results at any time through the platform.
• Export your data: Request a full export of your data by emailing us.
• Delete your data: Delete your account from the Profile menu. This is immediate and irreversible.
• Correct your data: Update your profile information at any time.
• Withdraw consent: Stop using the platform at any time. Your existing data will be retained unless you delete your account.
• Opt out of data licensing: Email us and we will leave your results out of future datasets.
• Turn off analytics and advertising tags: Use Privacy choices in the footer.

If you are in the EU/EEA, you have additional rights under GDPR including the right to lodge a complaint with your local supervisory authority.

8. Children

Neuropsych is intended for people aged 13 and older. If you are under 18, use it with a parent or guardian's permission. We do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, please contact us and we will delete it.

9. Cookies and local storage

We use:

• Authentication cookies: Set by Supabase to maintain your login session. These are strictly necessary and cannot be disabled.
• localStorage: Used to store anonymous test results, UI preferences, session cache, and the report questions you are still answering (up to 30 days, removed once the report is requested).

We use Cloudflare Web Analytics, provided by our hosting company, to count page views, referring sites, countries and page load performance in aggregate. It sets no cookies, does not use local storage, does not fingerprint your device, and does not track you across websites. It never receives your test results, scores, or account details.

Analytics and advertising: We use Google Analytics, the Meta Pixel and the measurement tags of the ad platforms we advertise on (currently ChatGPT ads by OpenAI). They set cookies and receive the pages you visit, the ad that brought you here, your IP address, device and browser information, and a few events: account created, test started, test completed, checkout started, and purchase with its amount. They never receive your test results, scores, questionnaire answers, report content, email address or name, and they do not run inside the tests or on the report page. In the EU, EEA, UK and Switzerland they load only after you accept them in the cookie notice. Elsewhere they are on by default; you can turn them off with Privacy choices in the site footer, and we honor the Global Privacy Control signal from your browser.

10. Security

We implement industry-standard security measures including:

• TLS encryption for all data in transit
• AES-256 encryption at rest (Supabase/AWS)
• Row-level security policies restricting data access to the owning user
• No plaintext storage of passwords (handled by Supabase Auth with bcrypt)

Neuropsych is not HIPAA-compliant. It is a cognitive screening tool, not a covered healthcare entity. If you are a healthcare provider considering clinical use, please contact us to discuss requirements.

11. Changes to this policy

We may update this policy as our platform evolves. If we make material changes, we will ask you to accept the updated version the next time you sign in. The "Last updated" date at the top reflects the most recent revision.

12. Contact

For privacy inquiries, data export requests, or concerns:

Mailing address: 2801 Ocean Park Blvd #1207, Santa Monica, CA 90405, United States
Email: [email protected]
Phone: +1 (323) 285-1071
Website: neuropsych.io