The browser stores an AES-GCM encrypted draft locally. Its key remains in tab-scoped session storage, and no guest answer, private cue, or safety choice is sent to the server.
Private sessionNo account, no answer persistence on our servers
Question selection and scoring run in the browser using hash-pinned, versioned artifacts. Closing the browser session may destroy the key; unreadable ciphertext is removed on a later visit. You can print or download a local summary. Private sessions cannot use observers or longitudinal retests without an explicit upload after account creation.
If reviewed optional autism-related modules are enabled, their fixed answers and separate deterministic results follow the same local boundary. They add no voice, transcript, or server AI processing.
Saved accountVerified identity and encrypted server storage
Saved mode currently supports verified email access, cross-device pause/resume, an encrypted result, export, and deletion. Assessment content is stored as one application-encrypted document keyed to the Clerk user ID; Clerk retains the email address. Observer invitations, personalized baselines, and retests are not enabled in this lean release.
ObserversPlanned, not currently enabled
The planned observer design keeps access scoped and preserves a separate self-only result. No observer invitation or observer response is created by the current Clerk and D1 account flow.
Safety informationSeparated, minimized, never part of ordinary exports
Safety choices never become severity points. Guest safety state stays within the encrypted local draft. Saved safety records use the highest-sensitivity access class and are excluded from ordinary reports unless you explicitly request a high-sensitivity export.
Analytics and researchNo raw health content; research is opt-in
Minimal operational metrics may cover route templates, completion, performance, and accessibility preference use. They cannot include item answers, private examples, relationship details, event cues, actual-adversity detail, observer answers, or report contents. Optional research consent is unbundled, defaults off, and can be withdrawn prospectively.
Your controlsAccess, export, correction, revocation, and deletion
You can export saved data, change optional consent, revoke an unused observer invitation, remove an observer contribution, and delete an assessment or account subject to documented legal retention. Material access, export, deletion, and scoring-release actions are audit logged.