Privacy

Private by design.

Plain-language summary. Your most sensitive data deserves a policy you can actually read.

What we collect: Your age range, the body option you chose, your relationship status, and your answers. No name, email, phone number, or payment details. We record that you confirmed you're 18+, not your birthday.
How it's protected: Answers and your profile are encrypted at rest with AES-256-GCM using a key held separately from the database. All traffic is encrypted in transit (HTTPS). Session cookies are HTTP-only and can't be read by scripts.
No trackers, no ads, no sale: Discovery Lab pages load no advertising, analytics, or third-party scripts. We never sell or rent sexual-health information, or any other data.
No AI reading your answers: Your results are generated by transparent, rule-based logic on our server. Your answers are not sent to any external AI system.
Sharing is opt-in and revocable: Nothing is shared unless you choose specific sections for a specific partner, or opt in to anonymous research. You can revoke or end a connection anytime and it takes effect immediately. Consent, safety, and sexual-health symptom answers can never be shared.
What the site owner can see: The owner sees anonymous totals only: how many people start and finish, broad demographics (country, age range, body, relationship status), and combined answer patterns. Any group smaller than 5 people is hidden. The owner never sees an individual's answers unless that person opts in to research.
Optional research opt-in: If you tick this, the site owner can download your completed answers with only your country, age range, body, and relationship status. Never your state, device key, or anything that identifies you. Free-text notes, questions about consent and personal safety, and anything about past trauma are always left out. You can turn this off anytime in My discoveries.
Contact messages: If you use the contact form, we store your first name, email, and message (encrypted) so we can reply. They are never linked to your quiz answers, and we delete them once they are no longer needed.
Your private key: Because there's no account, your results are tied to a private key stored in a cookie on your device. You can reveal it to open your results elsewhere. Anyone with the key can see your results, so keep it private.
Export and deletion: Download all your data as JSON from My discoveries, delete any single discovery, or erase everything permanently in one step. Deletion removes your answers, reports, and partner connections from our database.
Logs: Our application logs never contain your answers. Error logs record only the type of error.
Not medical advice: Discovery Lab is educational self-reflection, not a medical device or diagnostic tool, and it isn't a HIPAA-covered healthcare service. If something in your report concerns you, please talk to a licensed professional.