Privacy Policy

1. Scope and operator information

This policy applies to the TurnMind website, its Mental Rotation Test, the local Session History feature, and the measurement services described here. “We,” “us,” and “our” refer to the operator of the deployed website. The production operator should publish its legal identity, business address when required, and a working privacy contact before making the site publicly available. This document does not cover websites reached through external links, which have their own policies.

You can use the core test without creating an account or submitting your name, email address, phone number, or payment information. We do not offer user profiles, cloud synchronization, public rankings, or a paid results report. Please do not send sensitive health, education, or employment information through any future contact channel.

2. Information stored on your device

After a session finishes or you end it early, the site stores a record in your browser’s local storage. A record includes a random session ID, completion time, selected difficulty, planned and completed rounds, correct-answer count, accuracy, median response time for correct answers, total session duration, and whether the session ended early. The site keeps up to 20 recent records under the local key mrt_session_history_v1.

This local history is read by the History dialog on the same browser and device. It is not synchronized to an account and the application does not upload the history collection to an application database. Anyone who can use your browser profile may be able to open it. Select Clear history in the dialog, clear this site’s browser data, or use a private browsing session if you do not want records to remain. Browser settings, storage limits, or privacy tools may prevent the feature from saving; the test will still work.

3. Google Analytics and Microsoft Clarity

The site supports Google Analytics 4 (“GA4”) and Microsoft Clarity. Their scripts are included only when the production operator supplies a valid service ID. When enabled, they may process information such as pages viewed, approximate location derived from network information, referring page, browser and device characteristics, operating system, language, screen size, IP-derived information, timestamps, cookie or similar identifiers, and interactions with the interface. Clarity may provide aggregated heatmaps and session-replay style information to help identify usability problems.

The application sends high-level custom events such as test_start, test_answer, test_complete, and history actions. A per-answer event includes the round number, whether the answer was correct, and a broad response-time range. Completion events use an accuracy range rather than the exact answer list. The custom analytics code does not send the selected option, exact response time, shape coordinates, or complete local history. Results and History dialogs are marked for masking in Clarity recordings. The analytics providers may still collect other interaction and technical data through their own scripts under their respective policies.

Google and Microsoft act under their own terms and privacy documentation and may process data on infrastructure in more than one country. Their retention, deletion, access controls, and use of identifiers depend on the production operator’s account configuration and the providers’ current services. Provider-level information is described in Google’s Privacy Policy and Microsoft’s Privacy Statement.

4. Cloudflare hosting and security data

The website is designed to run on Cloudflare Workers. Cloudflare may process request and security information needed to deliver the site, route traffic, prevent abuse, diagnose faults, and maintain its network. That information can include IP address, requested URL, date and time, user agent, protocol details, approximate location, network identifiers, caching information, and security events. These records are separate from the browser-only Session History feature.

We use this information for availability, fault diagnosis, security, and aggregate performance. Processing and retention also depend on the operator’s configuration and Cloudflare’s privacy terms.

6. Cookies, local storage, and consent

Local storage is used for Session History as described above. GA4 and Clarity may use cookies or similar browser technologies when their scripts are enabled. The current application release loads configured analytics scripts directly and does not display a cookie-consent banner. That implementation choice is not a statement that consent is unnecessary in every country.

Privacy and electronic-communications rules differ by location and can change. The production operator is responsible for identifying its visitors, legal bases, contractual settings, and any consent mechanism required in the markets it serves. In regions where prior consent is legally required for non-essential analytics or session replay, the operator must add an appropriate choice before enabling those services or disable them for those visitors. Continuing to use a site should not be treated as a substitute for a legally required affirmative choice.

8. Your choices and privacy rights

You can clear Session History from the site, remove site data in browser settings, block or delete cookies, use tracking-protection features, prevent JavaScript from loading, or use compatible content-blocking tools. Blocking scripts may reduce analytics collection and should not prevent the core test from functioning, although strict browser settings can disable local history. Browser-level “Do Not Track” signals are not interpreted consistently across providers, so we do not promise that every third-party script responds to them in the same way.

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, portability, or information about processing, and you may be able to complain to a data-protection authority. Some requests concern data controlled by Google, Microsoft, or Cloudflare and may need to be directed to the relevant provider. We may need enough information to verify and route a request without collecting more than is reasonably necessary.