Privacy Policy

Plain-English version: the free quizzes work without an account and your answers never leave your browser. If you create an account and use the paid tracker or AI coach, those store the wellbeing data and chat history you enter — because that is what makes them work. We don’t sell your data, run ads, or send marketing. You can export or delete everything at any time. The detailed version is below.

Who we are

Neurodiverge App is operated by the provider identified in our Impressum. We are the controller of the personal data described here. Contact: hello@neurodiverge.app.

What we collect

• Account email — only when you create an account (Google sign-in or email + password) or email us. Held in our Neon Postgres database and used for sign-in and Pro-billing receipts. We do not run a marketing newsletter.
• Quiz responses — while you take a screen, your answers stay in your browser and are not sent to us. If you are signed in and choose to save a result, we store the outcome (score, band, and the dimension breakdown) against your account so it appears on /account and survives a device switch. Anonymous use saves nothing server-side.
• Daily tracker entries (Pro) — the mood, energy, sleep, focus, sensory-load, masking and social sliders, trigger labels, and any journal note you enter. This is self-reported information about your wellbeing that you choose to record. Stored against your account so the dashboard and trends work. See “Sensitive data” below.
• AI-coach conversations (Pro) — the messages you send and the coach’s replies, stored so your chat history persists between sessions. These may contain health-related information you choose to share, and are sent to an AI model provider to generate replies (see “Who processes your data”).
• Analytics — aggregate, anonymised usage via Plausible (cookieless) and, if you consent, Google Analytics 4. We do not record IP addresses in identifiable form or names.
• Email correspondence — kept until your inquiry is resolved, then retained like any business mailbox. We don’t aggregate, analyse, or share it.

Sensitive (health-related) data

The tracker and the AI coach can hold information about your mental health and wellbeing. Under the GDPR this counts as special-category data (Article 9). We only collect it when you actively choose to use these optional Pro features and enter it yourself. Turning on a feature and typing your own data is your explicit consent(Art. 9(2)(a)) to store it for that purpose. You can withdraw at any time by deleting the entries, the conversation, or your whole account — which erases the data. We are not a medical provider; what you enter is self-reported and for your own use, not a clinical or diagnostic record.

Legal basis for processing

• Account, sign-in, billing — performance of our contract with you (Art. 6(1)(b)); tax/accounting records where legally required (Art. 6(1)(c)).
• Saved quiz results, tracker entries, AI-coach conversations — your consent (Art. 6(1)(a)), and for the health-related parts your explicit consent (Art. 9(2)(a)), given when you opt into the feature.
• Cookieless analytics (Plausible) — our legitimate interest in aggregate usage (Art. 6(1)(f)). Google Analytics — your consent (Art. 6(1)(a)), which you can decline or withdraw below.

Who processes your data

• Neon — managed Postgres database storing account data (email, hashed password, Stripe customer ID), saved quiz results, tracker entries, and AI-coach conversations. Their privacy policy.
• Vercel AI Gateway & AI model provider — when you use the AI coach, your messages (and, if you enable it, a summary of recent tracker entries) are sent through Vercel’s AI Gateway to a large-language-model provider — currently Anthropic (Claude)— solely to generate your reply. They do not use it to train models or for advertising. Anthropic privacy · Vercel privacy.
• Stripe — processes Pro subscriptions. Receives your email, payment method, and billing address; sends receipts. Their privacy policy.
• Google — optional OAuth sign-in only; we receive your Google email + name, no other scopes. Their privacy policy.
• Vercel — hosts the site. Their privacy policy.
• Plausible and (with consent) Google Analytics — aggregate analytics.
• Ahrefs Web Analytics — cookieless, aggregate traffic analytics (no cookies, no cross-site tracking).
• tawk.to — the live-chat widget, a US provider. It loads only after you accept cookies (declined or undecided → it never loads and sets no cookie); once loaded it may set its own cookies, and if you use the chat it receives your messages and IP to run the conversation. Please don’t share health details in chat you wouldn’t want a support tool to hold. Their privacy policy.

We do not sell or rent your data, run advertising or retargeting, or share your tracker or coach data with anyone beyond the processors above.

Your rights (GDPR + CCPA)

You can request: a copy of your data (including your saved quiz results, tracker history, and AI-coach conversations), correction, deletion of everything we hold, restriction, portability, and withdrawal of consent at any time. Signed-in users can self-serve: export your data or delete your account from /account. Or email hello@neurodiverge.appand we’ll action it within 30 days. Deleting your account erases your tracker entries, coach conversations, and saved results.

Cookies & tracking

Plausible runs without setting any cookies and without tracking you across sites — considered exempt from consent under PECR / ePrivacy by both the UK ICO and the French CNIL. Google Analytics, if you accept it, sets the standard _ga cookie. No third-party advertising cookies are set. No retargeting pixels are loaded.

We also use strictly-necessary cookies for the account session (NextAuth) and for Stripe Checkout if you subscribe. These don’t require consent (essential-function exemption) and you can’t use a signed-in account or pay without them.

Data retention

• Account, saved quiz results, tracker entries, and AI-coach conversations: kept while your account is open; erased when you delete them or close your account (actioned within 30 days).
• Email correspondence: 24 months from your last reply.
• Analytics: aggregate only, retained 26 months (Plausible/GA defaults).
• Server logs: 30 days (Vercel default).

Children

Neurodiverge App is not intended for users under 16. If you are under 16, please do not create an account. If we discover we have data on a user under 16, we’ll delete it immediately.

Changes to this policy

If we change this policy materially, we’ll bump the “Last updated” date and post a banner on the site. Trivial wording corrections happen without notice.

Last updated: 11 July 2026.