Privacy Policy

HypeProof, Inhaber: Noah Fabian, Am Alten Sägwerk 3, 86899 Landsberg am Lech, Germany, is the controller responsible for the data processing described here. Contact: instituteofcognition@gmail.com. See also our imprint.

While you take the assessment, your answers and response timings are stored only in your own browser (in localStorage) so you can resume if you close the tab. When you finish, your individual answers are sent once to our server to calculate your result and are then discarded — we do not keep your raw answers in our database.

The computed result (your estimated IQ, percentile, domain scores, pace profile and similar derived figures) is stored in our database, linked to a randomly generated assessment id, so that a purchase can be verified and your report made available to you later — including via the same-device cookie and email restore-access described below. Free/unpaid results are only ever returned to your own browser in a limited "preview" form (completion time, average response time, strongest area) — the full figures are only ever sent to a browser after a verified purchase.

Legal basis: performance of the assessment/purchase you requested (Art. 6(1)(b) GDPR).

Before unlocking the paid report you may optionally provide an email address so the checkout receipt can reach you. Stripe may also separately capture the email you use at checkout. Either way, this email is stored against your paid result solely so you can later restore access to it (see below) — providing an email is never required to purchase or view your report. It does not sign you up for marketing communications; we do not currently send marketing email, and would never bundle a marketing opt-in into this flow without a separate, unticked checkbox.

Legal basis: your consent in providing it, and performance of the purchase contract (Art. 6(1)(a) and (b) GDPR).

Purchases of the Full Cognitive Report (€2.99, one-time) are processed by Stripe on a Stripe-hosted checkout page. We never see or store your card details. Stripe acts as an independent data controller for payment processing; see Stripe's privacy policy for how it handles your data. Stripe may process data outside the EU/EEA under appropriate safeguards such as Standard Contractual Clauses.

Legal basis: performance of the purchase contract (Art. 6(1)(b) GDPR).

After a verified payment (or a successful email restore, see below), we set one strictly-necessary, HttpOnly cookie (ioc_report_access) containing a randomly generated access token — never your Stripe session id, never your result data, and never a simple "paid" flag. Only a cryptographic hash of this token is stored in our database; the token itself exists solely in your browser's cookie. It lets you return to your unlocked report on this device without paying again, is not readable by page scripts, is not used for tracking or advertising, and is kept for up to 12 months or until it expires or you clear your browser storage. Because it is strictly necessary to provide the paid service you requested, it does not require separate cookie consent.

If you ask us to restore access to a previously purchased report (via /restore-access), we send a one-time link to the email address you enter — only if a paid report is actually associated with it; the confirmation message on screen is identical either way, so submitting the form never reveals whether an email has a purchase. That link expires after 45 minutes and can only be used once. Restore-access emails are sent via Resend, a transactional email provider; see Resend's privacy policy. These emails are strictly transactional (account/report recovery) — never marketing.

Legal basis: performance of the purchase contract / your explicit request (Art. 6(1)(b) GDPR).

This website is hosted on Vercel. Like any hosting provider, Vercel processes standard connection data (such as IP address and request metadata) to serve the site and keep it secure. The database described above (computed results, payment/entitlement state, restore tokens) runs on Neon Postgres, accessed only from our server — never from your browser directly, and never with credentials exposed client-side. Please refer to Vercel's and Neon's privacy policies for details of their own infrastructure-level processing.

We use Vercel Web Analytics to understand, in aggregate, how visitors move through the assessment funnel (for example, that someone started the assessment or reached the paywall). Our implementation only ever sends small, non-identifying event names and counters — never your name, email, session ID, individual answers, response times, or IQ score.

Legal basis: our legitimate interest in understanding and improving the product (Art. 6(1)(f) GDPR).

Separately from Vercel Web Analytics above, we run our own first-party analytics to see where in the 26-question assessment people tend to stop (for example, at which question, or which checkpoint) so we can improve it. This uses a random identifier generated in your own browser and stored in local storage (ioc_funnel_session_v1) to group your events together — it is not derived from and does not contain any personal information.

Because this ties an event timeline to a persistent per-browser identifier — more like the TikTok Pixel below than Vercel's aggregate counters — we treat it the same way we treat the Pixel rather than assuming it is exempt: it only activates once you Accept the cookie banner, using the same choice described in the next section, and stops immediately if you Reject or later change your mind via "Cookie settings" in the footer.

What it can record: an event name (e.g. that a question or checkpoint was viewed or answered, that checkout started), a question or checkpoint number, how long a step took, a coarse device category (e.g. "mobile" or "desktop", never your exact screen size or other fingerprinting-capable detail), and the page path. It never records your name, email, IQ score, percentile, which answer you selected, whether an answer was correct, or any Stripe identifier. A successful purchase is recorded as having happened only after our server has independently verified the payment with Stripe — never from anything the browser alone claims.

Legal basis: your consent (Art. 6(1)(a) GDPR).

This website loads the TikTok advertising Pixel (Pixel ID DA4TMPRC77UBCVGKTMSG), operated by TikTok/ByteDance, so that ad performance for our TikTok campaigns can be measured. This is a marketing/advertising technology, separate from Vercel Web Analytics above — it is not anonymous (TikTok can associate pixel events with a browser/device and, if you arrived from a TikTok ad, with your TikTok account or advertising identifiers), and may involve data transfer to TikTok/ByteDance infrastructure outside the EU/EEA.

Your choice controls this. On your first visit, a banner asks you to Accept or Reject optional analytics/advertising technologies. Until you Accept, the pixel is held (ttq.holdConsent()) and transmits nothing. If you Accept, event transmission is enabled (grantConsent()); if you Reject, it stays blocked (revokeConsent()). You can change your choice at any time via "Cookie settings" in the footer. Your choice is recorded only in your own browser's local storage (ioc_consent_v1), not on our server.

The events the pixel can receive (once you've accepted) are limited to funnel milestones (for example, that an assessment was started or completed, that checkout began, or that a purchase was completed) together with the purchase amount and currency and a fixed, non-personal product identifier for completed purchases. We never send your email, name, IQ score, individual answers, session ID, or Stripe session/customer ID to TikTok.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 25 TTDSG). See TikTok's privacy policy for how TikTok itself processes pixel data.

This website uses Microsoft Clarity (project ID y6fhl1z9vc), a session-recording and heatmap tool operated by Microsoft, to see how visitors actually interact with our pages (for example, where they click or how far they scroll) so we can improve the site's usability. Clarity can record mouse movements, clicks, scrolling behaviour and page structure. We do not use Clarity for advertising, and we do not configure it to capture the content of the assessment itself.

Your choice controls this — the same banner described in the section above. Until you Accept, Clarity runs in no-consent mode: it does not set a cookie and does not persist a session across pages (clarity('consentv2', { analytics_Storage: 'denied' })). If you Accept, analytics storage is granted so Clarity can associate your page views into one session (clarity('consentv2', { analytics_Storage: 'granted' })); if you Reject, it stays denied. Clarity's ad-storage consent is always kept denied — we never grant it. You can change your choice at any time via "Cookie settings" in the footer. Your choice is recorded only in your own browser's local storage (ioc_consent_v1), not on our server.

Clarity is operated by Microsoft and may process data outside the EU/EEA under Microsoft's standard contractual safeguards. See Microsoft Clarity's FAQ and the Microsoft Privacy Statement for how Microsoft itself processes Clarity data.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 25 TTDSG).

We do not sell your personal data. Beyond the TikTok advertising pixel and Microsoft Clarity described above (both of which only activate with your consent), we do not run any other advertising trackers or third-party session-recording tools on this site.

Under the GDPR you have the right to access, rectify, or erase your personal data, to restrict or object to certain processing, and to data portability. To exercise any of these, contact us at instituteofcognition@gmail.com. You also have the right to lodge a complaint with a data protection supervisory authority — for example the Bavarian data protection authority (Bayerisches Landesamt für Datenschutzaufsicht), or the authority responsible for your own place of residence.