Legal

Privacy policy

What data Mind Atlas processes, for what purpose, on what legal basis, who is involved and how long we keep it. The short version: your answers never reach us.

Last updated: October 25, 2026

This is a translation for your convenience. Only the German version is legally binding.

Controller

Mind Atlas (mymindatlas.org) is a service by headon. The controller for data processing on this website is:

headon Owner: Onur Cirakoglu Am Vogelsberg 8 97922 Lauda-Königshofen Germany

Email: hallo@headon.pro Phone: +49 176 63040241

For any question about data protection and for exercising your rights, you can reach us using these contact details.

The essentials

Your answers and results are scored and stored only in your browser. We do not store them on our servers.
There are no accounts: no sign-up, no password, no newsletter.
We set no cookies for analytics or advertising.
If you share a result, it travels as a code inside the link you send, after the # sign. Browsers do not send this part to our server. The only exception is the public profile card: only if you explicitly create a public link does a reduced code with your archetype and rough levels reach us, and we do not store it.
We measure reach with Rybbit on our own server, without cookies and without recognising you across websites.
During the pilot phase, the Full Mind Report is free: no purchase takes place, and Paddle and Resend are not used for it.
If you buy the Full Mind Report, Paddle handles the payment as the seller (merchant of record). Paddle receives nothing about your result from us. We send you the link to your report by email via Resend.

Storage in your browser

Your answers are scored on your device. Before you save a result, you choose where it is kept: on this device (localStorage, remains until you delete it) or only for this session (sessionStorage, deleted when you close the tab). Answers to a test you have not finished yet stay in your browser as well, so that you can continue after reloading the page.

In addition, your browser stores a few settings in localStorage: light or dark mode, whether sound is switched on, whether you have already seen the introduction, and which dimensions you have charted so far.

None of this data is transmitted to us. You can delete it at any time in your browser settings (site data for mymindatlas.org).

After a purchase, your browser remembers the access key locally (localStorage, “ma.reportToken”) so that you can find your report again. It contains no answers or results; like the link in your email, it is only used to confirm the purchase when you open the report.

Purpose: Scoring the self-assessments, keeping your results and settings on your device
Legal basis: § 25 (2) no. 2 TDDDG (storage that is strictly necessary for the service you have requested); no further processing by us takes place
Recipients: None; the data does not leave your device
Retention: localStorage: until you delete it; sessionStorage: until you close the tab

When you share your atlas or compare it with a friend, your result is contained as a code in the link. The code holds your summarised result for each dimension, but no individual answers and no name. Anyone who has the link can see the result it contains, so please share it only with people you trust.

The code sits in the link after the # sign (URL fragment). Browsers do not send this part to our server when the link is opened; the page reads the code directly in the browser. The code therefore never reaches us, neither in a database nor in the server logs. The only exception is the public profile card (next section).

Purpose: Displaying shared results and comparisons in the browser of the person opening the link
Recipients: Only the people you give the link to; the code is not transmitted to us
Retention: Not stored by us

Public profile card

If you want to show your archetype, for example on social networks, you can create a public profile card. It is only created when you explicitly choose “Create public link”. The link (an address with /p/ in its path) contains a reduced code: your archetype, the language and a rough level (low, moderate, high) for each dimension. It contains no scores and no individual answers.

Unlike sharing via a # link, this code sits in the path of the address and therefore reaches our server. Our server uses it to generate the page and preview images for social networks and messengers. We do not store the code: it is not written to any database, and our server logs requests to the profile card and its images without IP address and without the requested address. The page is excluded from search engines (noindex).

The page and images are delivered with a long cache lifetime. Browsers, caches and platforms that fetch the link (for example to show a link preview) may therefore keep copies. Whoever shares the link knowingly passes these rough details on to third parties. Once a link has been shared, we cannot take it back.

You withdraw your consent by no longer sharing the link. As we store nothing, there is no data for us to delete; copies in third-party caches are beyond our control.

Purpose: Displaying your profile card and generating preview images for the link you share
Data: Archetype, language and rough level (low, moderate, high) for each dimension; no scores, no individual answers
Legal basis: Your explicit consent given through the action “Create public link” (Art. 6(1)(a) GDPR and, as a precaution, Art. 9(2)(a) GDPR)
Recipients: Anyone who has the link, and platforms that fetch it for a preview
Retention: Not stored by us; copies may exist in third-party browser and platform caches

Hosting

Mind Atlas runs on our own server hosted by Hetzner Online GmbH in the data centre in Nuremberg, Germany. Hetzner processes data on our behalf. The connection between your browser and the website is encrypted with TLS.

Purpose: Providing the website, operation and security
Data: All data that arises during use, in particular IP address, requested address, time, browser and device information
Legal basis: Art. 6 (1) (f) GDPR: legitimate interest in secure and reliable operation
Recipients: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as processor (Art. 28 GDPR)
Third countries: No transfer

Server logs

Our web server keeps no access log for this domain. Only technical error logs of the server are kept, so that we can detect faults and attacks; an IP address may appear in them.

Data: Technical error messages of the server; they may contain an IP address, date and time and the requested address
Legal basis: Art. 6 (1) (f) GDPR: legitimate interest in security and operation
Retention: At most 7 days, then deleted automatically

Reach measurement with Rybbit

To understand which pages are used and where the website falls short, we use the statistics tool Rybbit. We run it ourselves at rybbit.headon.pro on our server in Germany; the data does not go to any other provider. We do not load the script that comes with Rybbit: our pages send the data themselves.

We set no cookies, store nothing in your browser and do not recognise you across websites. Statistics events never contain your answers, scores, results, your archetype or your profile codes. Codes in the address fragment (after “#”) are not transmitted; for public profile pages we only record that a profile page was opened, not which one. A visit is only counted after a movement (mouse, finger, scroll wheel or key) or once the page has been visible for three seconds, and never in automated browsers.

Data: Pages visited (without codes) with their title, origin (on the first view the page you came from, after that our previous page), device type, browser and operating system from the browser identifier, country and network operator (for example your internet provider) from the IP address, time of visit, interactions without your name or answers, such as starting, finishing or abandoning a dimension (with rough progress), the archetype reveal (not which one), sharing, comparing, opening the report preview and purchasing, the campaign tag when importing from aphantasie.org, which link to an external website was clicked (its address only, without parameters) and technical errors on the page (error type, shortened message, file and line – without address parameters and without anything you entered). The IP address itself is not stored; plus the page’s load times (Web Vitals).
Legal basis: Art. 6 (1) (f) GDPR: legitimate interest in measuring reach and improving our service
Recipients: None; Hetzner is involved technically (see above)
Retention: 12 months

Rybbit recognises a visit by a hash of IP address, browser identifier and a random value that changes daily; beyond that day it does not recognise you. The IP address itself is not stored; to fend off automated access the server keeps it in memory for up to 24 hours. Requests identified as automated are not counted and are logged separately for up to three months.

You can object to reach measurement at any time by enabling Global Privacy Control or Do Not Track in your browser or by sending us an email. If your browser sends one of these signals or localStorage contains the entry “umami.disabled”, our pages send nothing to Rybbit.

Until 23 October 2026 we also counted with Umami, likewise self-hosted; its raw data was deleted on 24 October 2026.

Fonts

We deliver all fonts from our own server. Visiting the website does not create a connection to Google Fonts or other font providers.

Pointers to our own sites (“Guest”)

In several places of the German version we show pointers to other sites of ours – for example after a test result, in the background text of the dimensions, on the atlas page, in the overview of the dimensions, in the comparison, at the end of the home page and at the end of a public profile card: today’s question and today’s edition of Die Nachtausgabe (dienachtausgabe.de), an example question from aphantasie.org, the next public holiday from Jahreszeile (jahreszeile.de) and the weather situation from Wetterzeile (wetterzeile.com). All are marked as a guest contribution (“Zu Gast · aus unserem Haus”, German for “Guest · from our own house”) and are not third-party advertising. They do not appear during a running test or in the other language versions.

Our server fetches the content of Die Nachtausgabe, Jahreszeile and Wetterzeile from the respective site. For this, your browser only contacts mymindatlas.org and no other domain. The request contains nothing from your atlas: no answers, no results, no profile code. The example question from aphantasie.org is part of the page and needs no request; on a public profile card we show only this one. What you select in one of these pointers stays in the memory of the open page; your answer is neither stored nor transmitted. The fonts and styles of the pointers are delivered by our own server.

With Rybbit we count anonymously and without cookies how often a pointer was seen and how often the link in it was tapped (section “Reach measurement with Rybbit”) – only which pointer and where, never your answer and nothing from your atlas. Only when you follow the link do you open the other site; the link carries no addition – nothing about you and nothing about the spot you came from. As with any link, your browser may tell the other site that you came from Mind Atlas. The other site’s privacy policy applies there.

Buying the Full Mind Report (Paddle)

Applies once the paid report is introduced.

The Full Mind Report is sold by Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom, as merchant of record (reseller). Paddle is your contractual partner for the purchase and processes your payment and contact details as an independent controller, for example your email address, payment information, country and information for fraud prevention. Paddle's privacy policy applies to this.

Your browser loads the checkout from Paddle's servers only once you click “Buy”. We pass Paddle only the product, the report version and your language. Paddle does not receive your result code or any other information about your result from us.

After payment, Paddle notifies us of the completed purchase with the order number, your Paddle customer ID and the details above. Your email address is not part of this notification: to send you the report link, we retrieve it through Paddle's API and pass it directly to our email service Resend (see below). We do not store it. The report link contains an access key derived solely from the order number, with no connection to your result. When you open the report, we use the order number to check that the purchase is valid, querying Paddle if necessary.

If you have lost your link, you can enter your order number. We then look up the order at Paddle and send the link again to the email address stored there. To prevent abuse, we limit the number of these requests per IP address; for this we count them for at most 15 minutes, in the server's memory only.

Purpose: Processing the purchase, delivering and restoring the report link, checking access to the report
Data: Product, report version, language, order number, Paddle customer ID, email address (retrieved only for sending); for link requests and recovery, the IP address as a counter. No result code.
Legal basis: Art. 6 (1) (b) GDPR (performance of the purchase you requested); for limiting requests per IP address, Art. 6 (1) (f) GDPR (legitimate interest in preventing abuse)
Recipients: Paddle.com Market Limited as independent controller
Third countries: United Kingdom. The transfer is based on the European Commission's adequacy decision for the United Kingdom (Art. 45 GDPR).
Retention: No permanent storage on our side. In memory only and without email addresses: order numbers for up to 24 hours (to avoid duplicate sending), the result of the purchase check for up to 10 minutes, IP counters for up to 15 minutes. Paddle stores purchase data according to its privacy policy and statutory retention periods.

Sending the report link (Resend)

Applies once the paid report is introduced.

We send the email containing your report link through the email service Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). The recipient is the email address you entered in the Paddle checkout; we retrieve it from Paddle for sending. Resend processes the data on our behalf.

Purpose: Delivering the report link by email
Data: Email address, order number, report link (without result code), time of sending
Legal basis: Art. 6 (1) (b) GDPR
Recipients: Resend (Plus Five Five, Inc.) as processor (Art. 28 GDPR)
Third countries: USA. Resend is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR).
Retention: Resend keeps sending data for 30 days.

No health data on our servers

Mind Atlas is a self-assessment for personal insight, not a medical or psychological examination. Your answers are scored in your browser and remain there. We do not store your answers or results on our servers and do not ask for any health information.

Your result code sits in links only after the # sign, which browsers do not send to our server. It therefore never reaches us, whether a shared link is opened, the report is bought or the report is opened. When you buy the report, neither we nor Paddle receive any information about your result. The only exception is the public profile card you explicitly create: it contains only your archetype and rough levels, and we do not store it (see “Public profile card”).

Your rights

You have the right, vis-à-vis us, to:

access to the data stored about you (Art. 15 GDPR),
rectification of inaccurate data (Art. 16 GDPR),
erasure (Art. 17 GDPR),
restriction of processing (Art. 18 GDPR),
data portability (Art. 20 GDPR).

Right to object: Where processing is based on Art. 6 (1) (f) GDPR, you can object to it at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests.

Because your answers stay in your browser, we usually hold no data that we could assign to you. For purchase data, please also contact Paddle. An informal message to hallo@headon.pro is sufficient.

Complaint to a supervisory authority

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg Heilbronner Straße 35, 70191 Stuttgart, Germany Postal address: Postfach 10 29 32, 70025 Stuttgart Phone: +49 711 615541-0 · Email: poststelle@lfdi.bwl.de www.baden-wuerttemberg.datenschutz.de

Changes

We update this policy when our service or the services we use change. The version published here applies. Details about the provider can be found in the imprint.