Privacy Policy.

• Assessment answers: sleep, movement, diet, stress, alcohol, nicotine, waistline and similar habits, plus your age and sex.
• Account data: email address, display name, authentication identifiers.
• Protocol data: habit completions, points, streaks, weekly goals and reminder preferences.
• Payment data: handled by our payment provider; we receive the transaction status, not your card details.
• Technical and advertising data: IP address, device and browser information, and events from the Meta Pixel where you have consented.

Your answers concern your lifestyle and may reveal information about your health. We process this special category data only on the basis of your explicit consent (Art. 9(2)(a) GDPR), given when you submit the assessment. You may withdraw that consent at any time by deleting your results or your account.

• To calculate and show your results — explicit consent.
• To provide accounts, the Protocol and paid reports — performance of a contract (Art. 6(1)(b)).
• To send reminder and recap emails you switched on — consent, withdrawable in settings.
• To secure the service, prevent abuse and improve the model in aggregate — legitimate interests (Art. 6(1)(f)).
• To measure and optimise advertising — consent given via the cookie banner.

We use strictly necessary cookies for sign-in and session handling. Advertising and measurement technologies — including the Meta Pixel operated by Meta Platforms Ireland Ltd. — are loaded only after you accept them in the cookie banner, and you can change that choice at any time. Where the Pixel transfers data to the United States, Meta relies on the EU–US Data Privacy Framework and standard contractual clauses.

Hosting and database infrastructure, our email delivery provider, our payment provider and Meta for advertising measurement. Each acts under a data processing agreement and only on our instructions.

Assessment results and Protocol history are kept while your account exists and are deleted within 30 days of account deletion. Invoicing records are kept for the statutory period of 10 years under Luxembourg law.

You have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting prior processing. Contact us at the address above. You may also lodge a complaint with the Luxembourg data protection authority (CNPD) or your local supervisory authority.

Data is encrypted in transit, access is restricted per user through row-level security, and payment card data never reaches our servers. No system is perfectly secure, so we ask you to use a strong, unique password.

See also our terms of service and refund policy.