Privacy Policy

Effective Date: March 23, 2026

This Privacy Policy describes how PSYCHE PROJECT PBC ("Psyche," "we," "us," or "our") collects, uses, and protects your information when you use our psychological assessment platform at psyche.you (the "Platform").

By using the Platform, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Information You Provide

Account Information: Email address used for authentication and account recovery
Profile Information: Optional display name you may choose to set
Demographic Data: We collect demographic information to enable normative comparisons and improve assessment accuracy. All fields beyond age offer a "prefer not to say" option. Demographics are organized into the following categories:
- Core demographics: Age and biological sex (collected during account setup), gender identity
- Socioeconomic: Education level, country, postal/ZIP code, employment status, industry, job title, years of experience, team size, whether you manage people, income range, net worth
- Relationship & family: Relationship status, years with partner, number of children, lifetime partners, close friends count, living situation
- Identity & background: Sexual orientation, religious affiliation, ethnicity (NIH standard), race (NIH standard OMB categories)
Sexual orientation, religious affiliation, ethnicity, and race constitute special category data under GDPR Article 9 and are processed only with your explicit consent. All demographic fields beyond age and biological sex are entirely optional
Assessment Responses: Your answers to questionnaires and your performance data on cognitive tasks

1.2 Information Collected Automatically

When you use the Platform, we automatically collect:

Device Information: Browser type, operating system, screen resolution, and device identifiers
Usage Data: Pages visited, features used, session duration, and interaction patterns
Performance Metrics: Response times, accuracy scores, and task completion data
Behavioral Biometrics: During assessments, we collect mouse movement patterns (position, velocity), keystroke timing, touch events (position, pressure), scroll patterns, visibility/focus state, and per-trial response timing. This data is used to measure response quality, detect inattentive responding, and improve assessment accuracy. Behavioral biometrics are deleted if you opt out of research contribution or delete your account
Session Replay: We use product analytics tools to record page-level replays of your interactions with the platform, including navigation, clicks, scrolls, and form interactions. These replays are used for debugging and improving user experience. Assessment response values are excluded from session replays
Log Data: IP address, access times, and referring URLs

1.3 Information from Third Parties

We use third-party services that may collect information about you:

Supabase: Authentication and database services
Google Analytics: Website analytics and usage patterns
PostHog: Product analytics, feature usage tracking, and session replay that records DOM-level page interactions (assessment response content is excluded)
Vercel: Hosting and performance monitoring
Resend: Transactional email delivery

2. How We Use Your Information

2.1 To Provide Our Services

Generate your personalized psychological profiles and insights
Track your assessment progress over time
Display normative comparisons when you provide demographic information
Send transactional emails (welcome emails, account notifications)
Provide customer support

2.2 To Improve Our Platform

Analyze usage patterns to improve user experience
Use age and biological sex in aggregate to build and maintain population norms as part of core platform operation. No individual data is linked or exposed in this process
Develop and refine assessment accuracy
Fix bugs and technical issues
Conduct internal research and development

2.3 For Research (With Your Consent)

If you opt in to research contribution through your account settings, we link your demographic profile to your assessment data under a pseudonymous research identifier. Your data is pseudonymized (direct identifiers removed and replaced with the research identifier) and may be used to:

Build and improve normative datasets for psychological assessments
Enhance assessment validity and reliability
Contribute to aggregate research findings
Train machine learning models to improve assessment accuracy and generate insights

Pseudonymized data is used only for internal research purposes. Any data shared externally is fully anonymized — the research identifier is destroyed and the data cannot be linked back to any individual, even by us. For details on these two levels of protection, see our Research Data Policy.

Research participation is entirely voluntary. You can change your preference at any time in your profile settings, and your individual data will be excluded from future research activities.

3. Data Licensing and AI Use

3.1 Plain-Language Summary

We never sell data that identifies you — to anyone, for any reason. We may license fully anonymized, aggregate datasets — where no individual can be identified, even by us — to organizations advancing health, science, or human wellbeing. We never license data to advertisers or for behavioral targeting.

3.2 Details

If you consent to research contribution:

Internal Research & AI Model Training: Pseudonymized response patterns may be used internally to train and improve AI models for assessment accuracy and insight generation. Pseudonymized data is never shared outside of Psyche.
Aggregated Data Licensing: Fully anonymized, aggregated data — where the research identifier has been destroyed — may be licensed to third parties. This data cannot be traced back to any individual, even by us.

Permitted recipients and purposes (including but not limited to):
- Academic institutions and research organizations for scientific research
- Pharmaceutical and biotechnology companies for drug development and clinical research
- Healthcare organizations for public health and outcomes research
- Psychometric and assessment organizations for measurement science
Prohibited recipients and purposes:
- Advertisers, ad networks, or data brokers — for any purpose
- Insurance companies — for underwriting, pricing, or coverage decisions
- Any entity — for behavioral targeting, surveillance, or purposes designed to coerce, manipulate, or discriminate against individuals
AI-Powered Insights: We use AI to generate personalized narratives, recommendations, and insights based on your assessment results and anonymized patterns from our user base.

Important: Individual responses are never sold or disclosed in any way that could identify you personally. See our Research Data Policy for details.

4. Information Sharing

We do not sell your personal information. We may share information only in these circumstances:

4.1 Service Providers (Sub-Processors)

We share information with third-party service providers who perform services on our behalf. Current sub-processors:

| Sub-Processor | Purpose | Data Processed | Location | |---------------|---------|----------------|----------| | Supabase | Authentication & database | Account data, assessment results | United States | | Google Cloud Platform | Authentication infrastructure | Auth tokens, user identifiers | United States | | Vercel | Website hosting & delivery | IP address, browser information | United States (edge) | | Google Analytics | Usage analytics (when consented) | Anonymized usage data, IP address | United States | | PostHog | Product analytics (when consented) | Anonymized usage data, session replay of page interactions (clicks, scrolls, form field focus — not assessment response content) | United States | | Anthropic (Claude) | AI-generated insights | Assessment scores (no PII) | United States | | Resend | Transactional email | Email address, name | United States |

We may change service providers as needed to improve our platform. All providers are contractually obligated to protect your data and process it only according to our instructions.

4.2 Legal Requirements

We may disclose information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4.3 Business Transfers

If Psyche is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

5. Data Security

We implement appropriate technical and organizational measures to protect your information:

All data is encrypted in transit (TLS/HTTPS) and at rest
Authentication is handled through secure third-party providers (Supabase)
Access to personal data is limited to authorized personnel
We conduct regular security reviews of our systems

While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

6. Data Retention

Active Accounts: We retain your data while your account is active
Deleted Accounts: Upon account deletion, we delete your personal data within 30 days, except where retention is required by law or for legitimate business purposes (such as resolving disputes)
Anonymized Research Data: If you consented to research, your data is fully anonymized upon account deletion (research identifier destroyed, quasi-identifiers removed) and may be retained indefinitely as it cannot be linked back to you

7. Your Rights and Choices

You have the following rights regarding your data:

Access: Request a copy of your personal data
Correction: Request correction of inaccurate data
Deletion: Request deletion of your account and associated data
Withdraw Consent: Withdraw research participation consent at any time
Data Export: Export your assessment data in a portable format

To exercise these rights, contact us at support@psyche.you or use the relevant features in your account settings.

8. International Data Transfers

Psyche is operated from the United States. If you access the Platform from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland:

We rely on the European Commission's Standard Contractual Clauses (SCCs) as the legal mechanism for transferring personal data to the United States. Our service providers who process EU personal data have entered into appropriate data processing agreements incorporating these clauses.

You may request a copy of these safeguards by contacting us at support@psyche.you.

9. Children's Privacy

The Platform is intended for users who are 16 years of age or older. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected personal information from a user under 16, we will delete that information promptly.

10. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

Posting the updated policy on this page with a new effective date
Sending an email to the address associated with your account (for significant changes)

Your continued use of the Platform after changes become effective constitutes acceptance of the revised policy.

12. Legal Basis for Processing (EEA/UK Users)

Under GDPR, we process your personal data based on the following legal grounds:

| Processing Activity | Legal Basis (GDPR Art. 6) | |---------------------|---------------------------| | Account creation and authentication | Contract performance (Art. 6(1)(b)) | | Providing assessment results | Contract performance (Art. 6(1)(b)) | | Transactional emails | Contract performance (Art. 6(1)(b)) | | Platform security and fraud prevention | Legitimate interests (Art. 6(1)(f)) | | Analytics (with consent) | Consent (Art. 6(1)(a)) | | Research contribution (with consent) | Consent (Art. 6(1)(a)) | | AI model training (with consent) | Consent (Art. 6(1)(a)) |

Special Category Data: Psychological assessment results may constitute special category data under GDPR Article 9. We process this data based on your explicit consent (Art. 9(2)(a)), which you provide when agreeing to take assessments.

13. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Categories of Personal Information Collected

Identifiers: Email address, username, IP address
Internet activity: Browsing history, interactions with the Platform
Inferences: Psychological profiles and assessment results derived from your responses

Your California Rights

Right to Know: Request disclosure of personal information collected, used, and shared
Right to Delete: Request deletion of your personal information
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out of Sale/Sharing: We do not sell your personal information. Anonymized, aggregated research data that cannot identify you is not considered a "sale" under CCPA.
Right to Non-Discrimination: We will not discriminate against you for exercising these rights

How to Exercise Your Rights

Contact us at support@psyche.you or use the controls in your account settings. We will verify your identity before processing requests.

14. Data Protection Officer

For privacy-related inquiries, complaints, or to exercise your data protection rights, contact our Data Protection team:

Email: support@psyche.you

We will respond to all legitimate requests within 30 days (or as required by applicable law).

15. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

General Support: support@psyche.you

Privacy Inquiries: support@psyche.you

Entity: PSYCHE PROJECT PBC, a Delaware Public Benefit Corporation

Last Updated: March 23, 2026