Privacy Notice

Version 1.16 · Last updated 20 September 2026 · Covers: this website, including all seven tests · Every change to this page, with dates

What we collect

We do not collect personal information from you directly. Two things happen anyway and both are described below: the site counts page views, and a server has to receive your request in order to answer it. Specifically:

• No cookies today. This site sets none, and the analytics below does not set one either. The optional account will set exactly one, and only when you sign in — named and described below, published here before it exists rather than after.
• Analytics: one, and it counts pages rather than people. We use Cloudflare Web Analytics. It sets no cookie and uses no browser storage, it does not identify you by your IP address or your browser, and Cloudflare discards the IP address at the edge instead of storing it. It counts page views and where visitors arrived from. It cannot see your answers or your score, because those never leave your browser in the first place.
• One third-party file, and one only. The analytics script is loaded from Cloudflare, and the counts it makes are sent to Cloudflare. Everything else this site loads is served from this domain. No advertising today, no tracking pixels, no embedded widgets, no external fonts. Advertising is something this site may carry one day — what we have already ruled out about it.
• No accounts, no sign-in, no email capture — today. There is nothing here to sign up for yet. An optional account is being built, and everything it will and will not do is set out below. You will never need one to take a test or see a result.
• No cognitive data. All seven tests run entirely in your browser. The items you are shown, the answers you give and the result you get are never sent to us. Closing the tab destroys them. We could not show you your own past result if you asked, because we do not have it.

Planned — not active yet

Everything from here to the end of this section describes something that does not exist. None of it is running, none of it is collecting, and none of it applies to you today. It is published in advance on purpose — a notice written before the thing it describes is something you can hold us to.

We are going to add an optional account, so that people who want to keep their results can. Publishing this before building it is deliberate: a privacy notice written after the fact describes what you already did, and a privacy notice written first is something you can be held to.

The four things that will not change, whatever else does

1. You will never need an account to take a test or see a result. Not for any test, not for the Fingerprint, not later. A sign-in wall in front of a score is the thing this site exists not to be.
2. The tests will still store nothing. They will run in your browser exactly as they do now. There will be no background saving and no "we'll keep this for you".
3. Saving will happen only when you press save, after your result is already on the screen, and only if you are signed in. The default outcome of taking a test will still be that nothing is left anywhere.
4. So the sentence changes from "nothing is stored" to "nothing is stored unless you ask us to store it" — and each test page will still be able to say, truthfully, that the test stores nothing.

What we would hold, in full

The list is short because it is meant to be. If it grows, this notice changes first.

• Your email address — the only way to send you a sign-in link.
• A random account number, so everything else is keyed to that rather than to your email.
• The date you created it.
• The date you last signed in. This was missing from this list until 20 September 2026, and it should not have been: the eighteen-month rule further down cannot be kept without it. A promise to delete a dormant account needs something to measure dormancy against.
• The results you chose to save: which test, its version, your score, out of how many, and the date. Plus, if you pick them, one or more of a short fixed list of conditions — tired, rushed, interrupted, unwell, none of these. There is deliberately no free-text box. A box invites a name, a diagnosis or a circumstance, and the safest way to promise we will not hold those is to build somewhere they cannot be typed.

And what we would not hold, each of which is a decision rather than an omission: no answers to individual items — the saved result is the same number you saw, not a record of what you clicked; no IP address, no device type, no browser, no screen size; no analytics of any kind; no password; no name, age or location; and nothing inferred about you that you cannot see on the page.

The one cookie, described before it exists

It is called bsd_s and it holds one thing: a random session identifier. Not your email, not your account number, not a result. It is set only when you sign in and it is how the next page knows it is still you.

• HttpOnly — script on the page cannot read it, so a bug in our own code cannot leak it.
• Secure — it is never sent over an unencrypted connection.
• SameSite=Lax — it is not sent when another site links into this one, which is what stops it being used to act as you from somewhere else.
• Ninety days, renewed each time you use it. Signing out deletes it.

There is no second cookie and no tracking identifier. It does not follow you to other sites, because it is meaningless anywhere else.

How your result reaches your account without travelling through an email

Your result lives in the web address of the page you are looking at, not on our server. So if you press save and then open the sign-in link on your phone, the result is not there any more — a different device, a different page.

What we do instead: pressing save sends the result to a short-lived holding slot on our server, labelled with a random number and nothing else. The email contains only that random number. When you sign in, the held result is attached to your account and the slot is destroyed. If you never sign in, it is destroyed after fifteen minutes.

The reason this is built the awkward way round is the sentence above about Resend — it receives your email address and the contents of that one message, and it does not receive your results or your scores. A random number is not a score. Putting the result in the link would have been simpler and would have made that sentence false.

Limiting sign-in emails without learning who you are

An address that anyone can post to is an address anyone can use to send mail to strangers. We limit it in two ways, and neither one holds anything about you: a cap on how often a link can be requested for any single email address, and a cap on how many this site will send in an hour in total.

The obvious way to do this is to count requests per IP address, and we are not doing that, because this notice says we do not hold your IP address and we would rather keep the sentence than have the tidier counter.

No password, ever

Signing in would be a one-time link sent to your email. There would be no password field, and therefore no password for anyone to steal from us. The cost is that signing in needs access to your inbox and is slower than typing a password, and we would rather state that than pretend it is free.

What the account will never be used for

These are refused in advance, while refusing them costs us nothing:

• Streaks, badges, levels, or any count of consecutive anything.
• No "you haven't tested in a while" email. No re-engagement message of any kind.
• No results that expire, and no history that degrades unless you come back.
• No leaderboard, no comparison with friends, no social feed.
• No newsletter attached to your account.

We would send exactly two kinds of email and there is no third: the sign-in link you just asked for, and a confirmation that your deletion has happened.

Deleting it

One press, from your own account page, and it deletes. Not a flag, not a hidden thirty-day grace period. The confirmation email is sent after the records are gone. Deleting the account deletes the saved results — there would be no "keep my anonymised data" option, because we have no research programme that would use it, and offering one would be collecting for a purpose that does not exist.

If you do not sign in for 18 months, we would email you once, wait 30 days, and delete it. Holding somebody's cognitive scores indefinitely because they forgot about us is not something we want to do.

The honest problem with keeping a history

A list of your past results invites you to compare yourself over time, and we have never measured test–retest reliability for any of our instruments — which is stated on every result page today and does not stop being true when the numbers are in a column.

So the history would show your results, their dates, the conditions you named and which version of the test produced each one — and it would not draw a trend line, fit a slope, or tell you that a change was meaningful. A history that implied progress we cannot demonstrate would be the most damaging thing on this site, precisely because it would look like the most useful.

Two things that would change about this page

A cookie. This site currently sets none. A signed-in account needs one to know it is you between pages. It would do only that — it would not be read by anyone else, would not follow you elsewhere, and would not be used to watch what you do. The rule that there is no advertising or tracking on any test or result page does not change.

A second processor. Sending email needs an email provider. It is Resend, and it is named here before the first email has been sent — which is the promise this section has always made, kept early rather than at the last moment. It holds nothing today, because there is nothing yet to hold.

The only thing the test does send

At the bottom of the result there are two optional questions — whether the explanation made sense, and whether it told you anything about yourself. Each has a row of buttons. If you press one, your browser sends us two short words: which question it was, and which button you chose. Nothing else goes with them.

Each answer is added to a running tally. It is not stored against you, your result, your session or your device, and it is not stored as an entry at all — we hold at most seven numbers per test, one for each button that can be pressed on it, and pressing a button makes one of them larger by one. The tally now records which test the answer came from, because the same question means something different after a result with a band and after one without, and pooling the two would hide that rather than measure it. A number does not exist until somebody has pressed that button. Nothing about who pressed it is recorded — not your result, not an identifier, not a time. Two of those numbers are older than that rule, each holding a single increment, left by the version of these questions that ran before the test was recorded alongside the answer. We cannot tell whether those two increments came from a visitor or from our own testing, and that is exactly why they are still here: two others were deleted on 7 September 2026 because we could show they were ours, and these two we cannot, so they stay. Deleting a number that might be somebody's answer, in order to tidy up, would be the wrong way round. Your two answers are not linked to each other, so even we cannot tell which pairs of buttons the same person pressed. There is nothing in that tally that could be traced back to a person, including by us.

We are asking because we are trying to find out whether explaining a result is worth doing. If you would rather not answer, don't — nothing about your result changes either way.

The one thing that is unavoidable

To send you a web page, a server has to receive a request from your device, and that request contains your IP address. Our host processes it for that purpose and for ordinary security and abuse prevention. This is true of every website you visit, and we would rather state it than claim we collect nothing at all.

We do not use those records to build a profile of you, we do not combine them with anything else, and we do not have any other source to combine them with.

How long any of that is kept, as precisely as we can put it. We keep none of it ourselves. The program that serves this site writes no log of its own — there is no line of code in it that records a request, and we do not export request logs anywhere. So there is no file we could search for your visit, and none we could be compelled to hand over.

Our host keeps some of it, and that is theirs rather than ours. Cloudflare processes requests at its edge for delivery and for security, and retains some of that for a limited period under its own published policy. We cannot delete what we never receive, and we would rather point you at their policy than paraphrase it and get it slightly wrong.

Who else is involved

Two processors. Cloudflare, which hosts and serves these pages, and Resend, which will send the two emails described above once the account exists. Nobody else. If that list ever changes, this notice changes with it — an added processor is a change to this notice, not a technical detail.

Resend has not processed anything, and will not until you ask it to. No account exists, no email address has ever been collected, and no email has been sent from this site. We are naming it now because this notice promised the provider would be named before the first email rather than after, and the domain it will send from was set up on 19 September 2026. When it does send, it receives your email address and the contents of that one message — the sign-in link you asked for, or the confirmation that your deletion is done. It does not receive your results or your scores.

Its sending is configured in the European Union (Ireland). And there is no tracking in the email: no open-tracking pixel, no click tracking, and no rewriting of links to route them through a counting service first. We did not turn those off as a favour — the same rule that keeps analytics off a result page keeps them out of an email about one.

Who operates BrainScoreDaily

BrainScoreDaily is operated as an unincorporated business in Canada. There is no separate incorporated company behind it, and we would rather say so than let a trading name imply one.

• Operator: BrainScoreDaily
• Country of establishment: Canada
• Privacy contact: BrainScoreDaily Privacy Team — privacy@brainscoredaily.com

That address reaches a person, and until 20 September 2026 it did not. The domain had no mail record at all, so every message ever sent to it was discarded without a bounce. We found it by checking whether our own contact address worked before publishing it here, and it is on the corrections page with the date. If you wrote to us before that date and heard nothing, that is why, and we are sorry — please write again.

Your rights

Data protection law gives you rights over personal data held about you, including the right to ask what is held, to have it corrected or erased, and to complain to a supervisory authority. We hold no records that identify you beyond the server logs described above.

To ask us anything about this notice, or to make a request, contact us at privacy@brainscoredaily.com.

If this site ever carries advertising

It does not today, and we are not going to pretend that is permanent. This is a business and advertising is one of the ways it might eventually pay for itself. Saying “no advertising, ever” and then quietly changing it is exactly the move this notice exists to make impossible, so here is what was decided in advance instead, while there was nothing to gain by deciding it.

• Never on a test, and never on your result. No advertisement, no ad-network script and no tracking pixel will appear inside a measurement or on the page that shows you your score. This one is not a preference we might revisit — it was written down before the site had any traffic to sell, precisely so it could not be traded away later.
• Only on the pages of text, if anywhere.
• Never priced on anything about you. We do not hold a profile, and we will not build one to sell space against.
• Your results are never the product. Not sold, not shared, not used to target anything.
• This notice changes before the first advertisement appears, not after — the same order we used for the analytics, the account and the email provider.

What we will never do

We do not sell cognitive data. Not in any form, to anyone. This is recorded here as a standing commitment, before there is any such data to sell, so that it constrains us later rather than being decided under commercial pressure.

Changes to this notice

When this notice changes, the new version appears here with a new version number and date, and the change is stated. We do not edit a published notice silently.