Legal

Privacy policy

What data Mind Atlas processes, for what purpose, on what legal basis, who is involved and how long we keep it. The short version: your answers never reach us.

Last updated: September 27, 2026

This is a translation for your convenience. Only the German version is legally binding.

Controller

Mind Atlas (mymindatlas.org) is a service by headon. The controller for data processing on this website is:

headon Owner: Onur Cirakoglu Am Vogelsberg 8 97922 Lauda-Königshofen Germany

Email: hallo@headon.pro Phone: +49 176 63040241

For any question about data protection and for exercising your rights, you can reach us using these contact details.

The essentials

Your answers and results are scored and stored only in your browser. We do not store them on our servers.
There are no accounts: no sign-up, no password, no newsletter.
We set no cookies for analytics or advertising.
If you share a result, it travels as a code inside the link you send, after the # sign. Browsers do not send this part to our server. The only exception is the public profile card: only if you explicitly create a public link does a reduced code with your archetype and rough levels reach us, and we do not store it.
We measure reach with Umami on our own server, without cookies and without recognising you across websites.
During the pilot phase, the Full Mind Report is free: no purchase takes place, and Paddle and Resend are not used for it.
If you buy the Full Mind Report, Paddle handles the payment as the seller (merchant of record). Paddle receives nothing about your result from us. We send you the link to your report by email via Resend.

Storage in your browser

Your answers are scored on your device. Before you save a result, you choose where it is kept: on this device (localStorage, remains until you delete it) or only for this session (sessionStorage, deleted when you close the tab). Answers to a test you have not finished yet stay in your browser as well, so that you can continue after reloading the page.

In addition, your browser stores a few settings in localStorage: light or dark mode, whether sound is switched on, whether you have already seen the introduction, and which dimensions you have charted so far.

None of this data is transmitted to us. You can delete it at any time in your browser settings (site data for mymindatlas.org).

After a purchase, your browser remembers the access key locally (localStorage, “ma.reportToken”) so that you can find your report again. It contains no answers or results; like the link in your email, it is only used to confirm the purchase when you open the report.

Purpose: Scoring the self-assessments, keeping your results and settings on your device
Legal basis: § 25 (2) no. 2 TDDDG (storage that is strictly necessary for the service you have requested); no further processing by us takes place
Recipients: None; the data does not leave your device
Retention: localStorage: until you delete it; sessionStorage: until you close the tab

When you share your atlas or compare it with a friend, your result is contained as a code in the link. The code holds your summarised result for each dimension, but no individual answers and no name. Anyone who has the link can see the result it contains, so please share it only with people you trust.

The code sits in the link after the # sign (URL fragment). Browsers do not send this part to our server when the link is opened; the page reads the code directly in the browser. The code therefore never reaches us, neither in a database nor in the server logs. The only exception is the public profile card (next section).

Purpose: Displaying shared results and comparisons in the browser of the person opening the link
Recipients: Only the people you give the link to; the code is not transmitted to us
Retention: Not stored by us

Public profile card

If you want to show your archetype, for example on social networks, you can create a public profile card. It is only created when you explicitly choose “Create public link”. The link (an address with /p/ in its path) contains a reduced code: your archetype, the language and a rough level (low, moderate, high) for each dimension. It contains no scores and no individual answers.

Unlike sharing via a # link, this code sits in the path of the address and therefore reaches our server. Our server uses it to generate the page and preview images for social networks and messengers. We do not store the code: it is not written to any database, and our server logs requests to the profile card and its images without IP address and without the requested address. The page is excluded from search engines (noindex).

The page and images are delivered with a long cache lifetime. Browsers, caches and platforms that fetch the link (for example to show a link preview) may therefore keep copies. Whoever shares the link knowingly passes these rough details on to third parties. Once a link has been shared, we cannot take it back.

You withdraw your consent by no longer sharing the link. As we store nothing, there is no data for us to delete; copies in third-party caches are beyond our control.

Purpose: Displaying your profile card and generating preview images for the link you share
Data: Archetype, language and rough level (low, moderate, high) for each dimension; no scores, no individual answers
Legal basis: Your explicit consent given through the action “Create public link” (Art. 6(1)(a) GDPR and, as a precaution, Art. 9(2)(a) GDPR)
Recipients: Anyone who has the link, and platforms that fetch it for a preview
Retention: Not stored by us; copies may exist in third-party browser and platform caches

Hosting

Mind Atlas runs on our own server hosted by Hetzner Online GmbH in the data centre in Nuremberg, Germany. Hetzner processes data on our behalf. The connection between your browser and the website is encrypted with TLS.

Purpose: Providing the website, operation and security
Data: All data that arises during use, in particular IP address, requested address, time, browser and device information
Legal basis: Art. 6 (1) (f) GDPR: legitimate interest in secure and reliable operation
Recipients: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as processor (Art. 28 GDPR)
Third countries: No transfer

Server logs

With every request, our server automatically records technical access data so that we can detect faults and attacks.

Data: IP address, date and time, requested address (without the part after the # sign), referrer URL, browser type and operating system; for requests to the public profile card and its images (addresses containing /p/) without IP address and without the requested address
Legal basis: Art. 6 (1) (f) GDPR: legitimate interest in security and operation
Retention: 7 days, then deleted automatically

Reach measurement with Umami

To understand which pages are used and where the website falls short, we use the open-source software Umami. We host it ourselves on our server in Germany; the data does not go to any other provider.

Umami sets no cookies, stores nothing in your browser and does not recognise you across websites. Statistics events never contain your answers, scores, results, your archetype or your profile codes. Codes in the address fragment (after “#”) are not transmitted; for public profile pages we only record that a profile page was opened, not which one. If your browser sends the Global Privacy Control or Do Not Track signal, we do not load the statistics script at all.

Data: Pages visited (without codes), referrer, browser, operating system, device type, screen size, language, approximate location (country), time of visit, anonymous interactions such as starting, finishing or abandoning a dimension (with rough progress), the archetype reveal (not which one), sharing, comparing, opening the report preview and purchasing, and the campaign tag when importing from aphantasie.org. The IP address is processed only briefly and not stored.
Legal basis: Art. 6 (1) (f) GDPR: legitimate interest in measuring reach and improving our service
Recipients: None; Hetzner is involved technically (see above)
Retention: 12 months

You can object to reach measurement at any time by enabling Global Privacy Control or Do Not Track in your browser or by sending us an email.

Fonts

We deliver all fonts from our own server. Visiting the website does not create a connection to Google Fonts or other font providers.

Buying the Full Mind Report (Paddle)

Applies once the paid report is introduced.

The Full Mind Report is sold by Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom, as merchant of record (reseller). Paddle is your contractual partner for the purchase and processes your payment and contact details as an independent controller, for example your email address, payment information, country and information for fraud prevention. Paddle's privacy policy applies to this.

Your browser loads the checkout from Paddle's servers only once you click “Buy”. We pass Paddle only the product, the report version and your language. Paddle does not receive your result code or any other information about your result from us.

After payment, Paddle notifies us of the completed purchase with the order number, your Paddle customer ID and the details above. Your email address is not part of this notification: to send you the report link, we retrieve it through Paddle's API and pass it directly to our email service Resend (see below). We do not store it. The report link contains an access key derived solely from the order number, with no connection to your result. When you open the report, we use the order number to check that the purchase is valid, querying Paddle if necessary.

If you have lost your link, you can enter your order number. We then look up the order at Paddle and send the link again to the email address stored there. To prevent abuse, we limit the number of these requests per IP address; for this we count them for at most 15 minutes, in the server's memory only.

Purpose: Processing the purchase, delivering and restoring the report link, checking access to the report
Data: Product, report version, language, order number, Paddle customer ID, email address (retrieved only for sending); for link requests and recovery, the IP address as a counter. No result code.
Legal basis: Art. 6 (1) (b) GDPR (performance of the purchase you requested); for limiting requests per IP address, Art. 6 (1) (f) GDPR (legitimate interest in preventing abuse)
Recipients: Paddle.com Market Limited as independent controller
Third countries: United Kingdom. The transfer is based on the European Commission's adequacy decision for the United Kingdom (Art. 45 GDPR).
Retention: No permanent storage on our side. In memory only and without email addresses: order numbers for up to 24 hours (to avoid duplicate sending), the result of the purchase check for up to 10 minutes, IP counters for up to 15 minutes. Paddle stores purchase data according to its privacy policy and statutory retention periods.

Sending the report link (Resend)

Applies once the paid report is introduced.

We send the email containing your report link through the email service Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). The recipient is the email address you entered in the Paddle checkout; we retrieve it from Paddle for sending. Resend processes the data on our behalf.

Purpose: Delivering the report link by email
Data: Email address, order number, report link (without result code), time of sending
Legal basis: Art. 6 (1) (b) GDPR
Recipients: Resend (Plus Five Five, Inc.) as processor (Art. 28 GDPR)
Third countries: USA. Resend is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR).
Retention: Resend keeps sending data for 30 days.

No health data on our servers

Mind Atlas is a self-assessment for personal insight, not a medical or psychological examination. Your answers are scored in your browser and remain there. We do not store your answers or results on our servers and do not ask for any health information.

Your result code sits in links only after the # sign, which browsers do not send to our server. It therefore never reaches us, whether a shared link is opened, the report is bought or the report is opened. When you buy the report, neither we nor Paddle receive any information about your result. The only exception is the public profile card you explicitly create: it contains only your archetype and rough levels, and we do not store it (see “Public profile card”).

Your rights

You have the right, vis-à-vis us, to:

access to the data stored about you (Art. 15 GDPR),
rectification of inaccurate data (Art. 16 GDPR),
erasure (Art. 17 GDPR),
restriction of processing (Art. 18 GDPR),
data portability (Art. 20 GDPR).

Right to object: Where processing is based on Art. 6 (1) (f) GDPR, you can object to it at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests.

Because your answers stay in your browser, we usually hold no data that we could assign to you. For purchase data, please also contact Paddle. An informal message to hallo@headon.pro is sufficient.

Complaint to a supervisory authority

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg Heilbronner Straße 35, 70191 Stuttgart, Germany Postal address: Postfach 10 29 32, 70025 Stuttgart Phone: +49 711 615541-0 · Email: poststelle@lfdi.bwl.de www.baden-wuerttemberg.datenschutz.de

Changes

We update this policy when our service or the services we use change. The version published here applies. Details about the provider can be found in the imprint.