Skip to content

Privacy Policy

Last updated: 2 July 2026
Version: privacy-2026-07-02

Who We Are

truthaboutyou.io is operated as an independent website providing private self-check quizzes for personal reflection. Our website address ishttps://truthaboutyou.io.

What Data We Collect

Quiz Responses

When you complete a self-check quiz and submit your answers, we store your quiz responses in our database. These responses are linked to a randomly generated session identifier and, if you provide it, the email address used for result delivery.

Email Address and Marketing Consent

Before starting a quiz, we ask for your email address so we can associate your quiz session with result delivery, all-tests pass use, and support requests. These are transactional uses of email and are separate from marketing. If you choose to tick the optional marketing checkbox, we also store the consent timestamp, source, and consent version so we can send occasional tips, product updates, or new self-check updates. You can use the service without creating an account and without opting in to marketing.

To make repeat self-checks smoother, your browser may remember the email address you entered. Marketing consent is not implied from browser storage and remains optional. You can manage optional email preferences through the Email Preferences page or thePrivacy Dashboard.

Payment Information

If you choose to unlock a full result, payment is processed entirely byStripe (stripe.com). We do not receive, store, or have access to your credit card number or banking details. Stripe may collect information necessary to process your payment in accordance with their ownprivacy policy.

Technical Data

For rate-limiting and abuse prevention purposes, we process a one-way cryptographic hash of your IP address. This hash cannot be reversed to reveal your actual IP address. We do not store raw IP addresses and do not use IP address alone to unlock or display sensitive quiz results.

If optional website analytics is enabled and you accept analytics in your browser, we may send page and funnel events to Google Analytics or Google Tag Manager. These events help us understand whether visitors start quizzes, complete quizzes, view result previews, begin checkout, complete purchases, or open support. We do not send quiz answers, email addresses, result tokens, payment card details, or paid-access secrets to Google Analytics or Google Tag Manager.

What We Do NOT Collect

  • We do not require account creation or registration.
  • We do not collect your name or phone number.
  • We do not load Google Analytics or Google Tag Manager unless you accept optional analytics.
  • We do not use optional analytics to store quiz answers, emails, result links, or payment secrets.
  • We do not use advertising pixels or behavioural advertising cookies.
  • We do not sell your data or transfer it to third parties for their own marketing purposes.

How We Use Your Data

The data we collect is used exclusively for:

  • Generating your personalised self-check result based on your quiz answers.
  • Associating your quiz session with the email address you provide.
  • Delivering paid result links by email after payment.
  • Sending a secure one-time recovery link if you request paid result recovery.
  • Managing all-tests pass eligibility and one-time pass redemptions.
  • Sending optional tips, product updates, or new self-check updates only if you opted in.
  • Measuring optional website analytics only after browser analytics consent.
  • Processing payment through Stripe when you choose to unlock a full result.
  • Preventing abuse through rate limiting (using hashed IP addresses).

Data Storage and Security

Your quiz responses are stored in a secure database hosted bySupabase (supabase.com). Access to results is protected by a cryptographically generated secret that is unique to each quiz session. Only someone with the correct secret can view a result.

If you request result recovery, we generate a short-lived one-time access token and store only a cryptographic hash of that token. We may also store delivery metadata such as the email provider message ID or delivery error to help troubleshoot recovery emails.

We use industry-standard security measures including encrypted connections (HTTPS), cryptographic hashing, and timing-safe comparison functions to protect your data.

Data Retention

Paid quiz responses are retained in our database to allow you to access your result for the access period shown at purchase. Paid result access sessions are intended to remain available for up to 14 days after unlock. Expired result sessions, recovery tokens, privacy dashboard access links, and other temporary access records are automatically removed.

Unpaid, expired, or failed quiz sessions are automatically expired, anonymised, and then deleted according to our retention policy. Older analytics records are either anonymised by removing session identifiers or deleted when they are no longer needed for operational reporting.

If you open a paid result in your browser, access is kept using a secure HttpOnly browser cookie for up to 14 days so you can revisit it from the website. The paid-access token is not stored in localStorage.

You can use the Privacy Dashboard to request a secure email link, review stored data connected to your email, prepare a JSON export through a short-lived one-time download link, change marketing preference, and request deletion.

You can unsubscribe from optional marketing emails from the unsubscribe link in a marketing email, through Email Preferences, or through the Privacy Dashboard. Unsubscribing from marketing does not stop transactional emails needed for result delivery, recovery, privacy access, receipts, or support.

Your Rights (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR):

  • Right of access: You can request a copy of the data we hold about your quiz session.
  • Right to erasure: You can request that we delete your quiz responses and results.
  • Right to rectification: You can request correction of inaccurate data.
  • Right to data portability: You can request your data in a machine-readable format.
  • Right to object: You can object to the processing of your data.

If you provided an email address, we may use it to help locate your data. Otherwise, exercising these rights requires you to provide the unique result link or session identifier associated with your quiz submission.

To exercise any of these rights, please contact us at the email address provided below.

Legal Basis for Processing (GDPR)

We process data on the following legal bases:

  • Legitimate interest: Processing quiz responses to generate results (Article 6(1)(f)).
  • Consent: Sending optional tips or new self-check updates if you opted in (Article 6(1)(a)).
  • Consent: Loading Google Analytics or Google Tag Manager only after optional browser analytics consent (Article 6(1)(a)).
  • Contractual necessity: Processing payment data to deliver the service you purchased (Article 6(1)(b)).
  • Legitimate interest: Rate limiting and abuse prevention to maintain service integrity (Article 6(1)(f)).

Third-Party Services

We use the following third-party services:

Typography uses local system fonts, so no third-party font provider is contacted for normal page rendering.

Children's Privacy

Our service is not directed at individuals under the age of 16. We do not knowingly collect data from children. If you believe a child has used our service, please contact us and we will take appropriate action.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

Contact

For privacy-related enquiries or to exercise your data rights, please use Contact support about privacy.