About this site

Privacy Policy

How MyTestAtlas collects, uses, shares and protects information, including Google Sign-In data, which is never sold, shared or used for advertising.

Effective date: 22 September 2026. Last updated: 1 November 2026.

This Privacy Policy explains how MyTestAtlas (“MyTestAtlas”, “we”, “us”), the operator of the website and application at https://mytestatlas.com, collects, uses, shares and protects information. It applies to every page and every interface on that domain, including the MyTestAtlas application that uses Google Sign-In. It is the only privacy policy for this service.

MyTestAtlas is the data controller for the information described here. For results pupils send in a teacher’s class, the school or teacher who runs the class decides why they are collected, and we process them only on their behalf (section 2.9). For any privacy question or request, contact support@mytestatlas.com.

1. Summary

• Individual tests are scored in your browser.
• Team assessments and daily challenges send answers for grading (sections 4.7 and 4.8).
• You can save an individual-test result to your account when signed in and you press Save this result (section 4.5).
• On a class-linked reading speed test, pressing Send to my teacher sends your words per minute and score without your name (section 2.7).
• For a teacher-set class test, pressing Send to my teacher sends that test’s numeric result with your seat number and no name (section 2.9).
• If you keep the review deck, it stores the number right and total per section on your device; if you turn on sync, it also stores them in your account (section 2.15).
• We do not require an account. If you sign in with Google, we receive only your Google account identifier, email address, name and profile picture, and we use them only to operate your account. If you sign in with a link we email you instead, we receive only the address you type (section 4.10).
• We do not sell personal information and we do not share it for cross-context behavioural advertising.
• We do not use Google user data for advertising, profiling or any purpose other than providing the service.
• Audience measurement is cookieless and self-hosted.
• On eligible general pages and selected puzzle and skill tests, when session replay is on, Microsoft Clarity may record clicks, scrolling, page layout and public text, including visible questions, choices and results on selected tests. It may set its own cookies. In the European Economic Area, the United Kingdom and Switzerland it runs only if you allow it; anywhere you can turn it off (section 2.6). It does not run on personality or self-report questionnaires, health-related pages, children’s pages, class pages or your account.
• The children’s learning pages under /kids/ and the picture puzzles for children carry no advertising and no analytics, and what the learning pages remember stays on your device (section 12).
• Data we store is held in the European Union.

2. Information We Collect

2.1 Information you provide

Assessment answers and results. Individual tests are scored in your browser. When session replay is on, Microsoft Clarity may record visible questions, choices and results on selected puzzle and skill tests; typed text and account controls stay masked (section 2.6). Browser storage and sharing follow the choices described here: a result you ask to save before you have signed in waits in that tab’s sessionStorage during the sign-in (section 4.5), and a comparison link you create carries a result’s percentages after the # of its address (section 2.8). On the reasoning and knowledge tests (including the Norway-format practice and the English level test) and on questionnaires that are not about health, the page keeps an unfinished test in this browser’s localStorage, as mta.run. followed by the test’s name: the options you have chosen so far, the question order, the questions you skipped and your place, so that a reload, the Back button, closing the tab or coming back later does not lose it. When the result of a reasoning or knowledge test appears, the same entry is kept with the time it was scored, so that the result can be shown again on this device; a questionnaire’s entry is erased when its result appears. While a test is unfinished, its own page, the home page and the /iq/, /think/ and /work/ pages read this entry to offer to continue where you left off. It is never sent anywhere, and it is erased when you start over; after 48 hours it is no longer offered. Health-related pages, the untimed practice profile and tests opened from a class or coach link never keep a run. The aptitude trainer and its section drills and employer-format papers under /work/ keep an open sitting the same way, as mta.run.aptitude-trainer: the paper’s number and the questions it dealt, your answers so far, the time spent on each question, your place and the clock’s deadline, so that a reload or a later visit continues the same paper with the time away counted; after Finish the scored sitting stays kept, so that a reload shows its result again. It is never sent anywhere, and it is erased when you press Start over (Leave keeps it, so that you can continue); after 48 hours it is no longer offered; a sitting set by a teacher is never kept. A preview address that names one version of the trainer page (?apt= or ?aptnext=) is remembered in that tab as mta.apt.pin, holding only that letter. The explorer passport is one more, if you start it (section 2.5): it keeps the last headline scores of each ability test on this device, never sent. The practice plan is one more, if you keep a plan (section 2.14): its section to work on next is kept in this browser’s local storage, and a practice opened from the plan carries that section after the # of its address, which is never sent. The review deck is another, if you keep one (section 2.15): this browser’s local storage keeps how many questions you got right and were given per section and which questions you missed, and your account keeps the same once you turn sync on. No answer and no result label enters an analytics event; the one result-derived value our own analytics may receive is the coarse ability band described in section 2.3, and only from an ability test. On selected puzzle and skill tests, session replay can include the visible question, choice and result (section 2.6). Team assessments and daily challenges send answers for grading; daily-challenge choices are carried in the submission URL. Sections 4.7 and 4.8 describe the resulting records. A result from an individual test — the headline, the label, the summary and each dimension’s position and reading, never the answers — can be saved to your account when you are signed in and press Save this result; section 4.5 describes it. A result also leaves your browser when you press Send to my teacher: on the reading speed test opened from a teacher’s quick class link it sends two numbers and nothing else (section 2.7), and on a test in a teacher’s class it sends that test’s numeric result with your seat number (section 2.9).

Correspondence. If you email support, we receive your email address and whatever you write.

2.2 Information from Google, if you sign in

Your Google account identifier (stored as a one-way hash), your verified email address, your name and your profile picture (received, not stored). Described in full in section 4.

2.3 Information collected automatically

Audience measurement. We self-host an analytics counter at analytics.pagefabrica.com and configure it to honour Do Not Track. Umami's current tracker documentation says it uses no cookies, no cross-site tracking, and no personal-data collection. Because it is self-hosted, no analytics company receives anything about your visit. Page measurement can include the page address, page title, referrer, browser language and screen size. It also records how long pages take to load and respond (such as LCP, INP and CLS) with the page address and device type, to help us find slow pages; these timings contain no answer, result or anything you type. A shared-result page at /shared/ is counted as one page view of the address /shared/ alone: the link’s code and everything else after the ? are removed before the view is sent, and that page sends no event.

Events. Two events describe a test run, work_started and work_completed; others record the steps between them (a section completed, the review reached, a tab hidden before completion as work_abandoned (you may return and finish), or refused as work_refused because it was finished too fast to have been read) and which part of the site was used, such as a navigation tab, a category card, a result-page link or how far a guide was read, and, if you keep a passport, on how many different days it has recorded something (section 2.5), and when the practice plan is opened from a result, made, used or deleted (section 2.14), and when the review deck is kept, reviewed or deleted and sync is turned on (section 2.15). The full list is account_created, achievement_earned, api_cta_clicked, apt_done_a, apt_done_b, apt_first_a, apt_first_b, apt_next_click_a, apt_next_click_b, apt_next_view_a, apt_next_view_b, apt_start_a, apt_start_b, apt_view_a, apt_view_b, cabinet_assignment_added, cabinet_cards_printed, cabinet_class_created, cabinet_csv_exported, cabinet_growth_opened, cabinet_joining_opened, cabinet_report_downloaded, cabinet_review_assigned, cabinet_roster_exported, calculation_failed, category_card_clicked, category_tab_clicked, challenge_started, challenge_submitted, check_completed, class_pro_beta_joined, class_pro_offer_clicked, class_pro_offer_viewed, class_pro_quote_clicked, coach_beta_joined, coach_group_opened, coach_link_created, coach_offer_clicked, coach_offer_viewed, coach_report_downloaded, coach_share_sent, compare_link_created, compare_viewed, contact_link_clicked, converter_used, crumb_clicked, email_link_sent, examples_opened, feedback_helpful, feedback_unhelpful, first_response, focus_mode_on, footer_link_clicked, game_finished, guide_card_clicked, guide_cta_clicked, guide_read_end, guide_read_half, hero_cta_clicked, hint_opened, history_opened, intro_started, key_created, key_revoked, manifest_failed, menu_opened, nav_link_clicked, next_test_clicked, page_share_clicked, paid_landing, passport_started, plan_activated_click, plan_created, plan_cue_set, plan_deleted, plan_ics_downloaded, plan_offer_opened, plan_optin, plan_outcome_given, plan_practice_day, plan_return_day, plan_week_repaired, practitioner_beta_joined, practitioner_export_saved, practitioner_link_created, practitioner_offer_clicked, practitioner_offer_viewed, practitioner_return_imported, pricing_viewed, pro_activated, pro_failed, quota_requested, related_clicked, retest_compared, return_after_7d, return_day_2, return_days_3_6, return_days_7p, review_deleted, review_done, review_kept, review_opened, review_reached, save_clicked, save_confirmed, save_signin_clicked, search_used, section_completed, share_aborted, share_arrived, share_clicked, share_completed, share_link_created, share_viewed, sign_in_clicked, sign_in_completed, sign_in_failed, signed_out, sitemap_link_clicked, source_link_clicked, stamp_earned, sync_on, sync_prompt_pressed, task_aborted, team_invited, test_card_clicked, test_restarted, therapist_summary_made, trust_link_clicked, vision_check_finished, vision_check_started, work_abandoned, work_completed, work_half, work_q25, work_q50, work_q75, work_refused, work_resumed, work_started, work_step.

Ad clicks. When you arrive from an ad, the click identifier the ad network added to the address (such as gclid or msclkid) is removed before the visit is counted, and we record one paid_landing event whose only fact, click_kind, names the network (google, microsoft, meta, reddit, tiktok, linkedin, x or other).

Event properties. Since 27 September 2026 an event may also carry a few short facts about the run, and only these:

• account — on a share press, whether you were signed in at the time (in or out); never who you are
• attempt — which start this is in the current page view (1, 2, 3…)
• band — on ability tests only, the share of items solved in fifths (0–19, 20–39, 40–59, 60–79 or 80–100 per cent), or, on a share from a result, its band in words (excellent, strong, good, solid, early, advanced, confident, developing or type); never on a health-related page
• channel — on a share press, which button was pressed (for example whatsapp, copy or story); on health-related pages this is page-link sharing only
• elapsed_s — whole seconds since Start
• form — which of a test’s equivalent forms, or which practice mode, was given
• how — on leaving a test before its end, which way out was taken: exit, back, hidden (the tab was put away), pagehide or stop (a lesson stopped)
• input — on test start, steps and finish, how the page was used so far: touch, mouse, mouse_still (clicks with no pointer movement, typical of software driving a browser), pen, keyboard, automation (the browser says it is automated) or none; never what was typed or chosen, and never on a health-related page
• item — how many items had a choice when the event fired, or how many trials a timed task had reached
• section — the number of the section just completed
• surface — where a share button was pressed: home, hub, test, result-footer or result (the share sheet on a result); never the answers
• test — which test page the event came from, by its address name (for example big-five-personality-test)
• vh — the browser window’s height in pixels
• vw — the browser window’s width in pixels

On health-related pages — every route under /adhd/, /mood/, /anxiety/, /autism/ and /calm/, the adult attention, happiness, sound-sensitivity, number-difficulty, distraction and procrastination self-checks, the colour vision check and its guide under /vision/, and the account and service pages — an event carries at most attempt, channel, elapsed_s, form, item, section, surface, test, vh, vw, and never the band. No event carries an answer, a score, a result label, an inferred trait or condition, a per-item response time, anything typed, or a personal field, and a value that looks like an email address, a token or a long number is dropped before anything is sent. Until 27 September 2026 events carried their name only. These properties go only to our own counter at analytics.pagefabrica.com; they are not shared with or sold to anyone, and carry no identifier that links one visit to another.

Shared session counters. The focus room at /room/ keeps exactly two numbers per half-hour period on a server: how many browser tabs opened the room, and how many sessions were marked finished that day. They are plain counters with no identifier attached — no account, no cookie, no address, no session token, nothing that could be traced to a visitor or joined with anything else.

Server logs. Our hosting provider records ordinary request information, including IP address, needed to deliver pages and to protect the service against abuse.

2.4 Completion counter

Separately from audience measurement, when you complete something on this site your browser sends one request to our server, at /api/count/complete, so that we can count completions. A completion is a test that shows its result, a finished Reason game or test round, a finished practice set, or a submitted daily-challenge entry. For most of them the request carries only a name: the test’s catalogue name, such as big-five, or the name of the game, practice set or challenge, such as rule-246, practice-logic or daily-challenge. On the ADHD, mood, autism, anxiety and calm self-checks, and on every other page that carries no advertising because of its health subject, it carries nothing at all and only adds to the total. On the ability tests and timed tasks that show a headline score, and never on a health-related or children’s page, it also carries the coarse band the score fell in: an IQ-style estimate rounded down to 5 points, a count of correct items as itself (in steps of 4 on the 80-word memory test), a percentage or a typing speed in steps of 5, a time in steps of 25 milliseconds. We use the counts per band only to state the average of results on this site. Apart from that band it never carries an answer, a score, a result, a time or anything that identifies you. The page sends it at most once per completed run (showing a result again does not send it again) and remembers that only in its own memory: nothing is written to your browser’s storage. The times tables and maths facts pages never send it. Children’s pages never send it.

On the server we keep counts only: a running total, a total per test, a total per test and score band, a total per day, and, so that one network address cannot inflate the figure, a tally per day under a keyed one-way hash of the requesting address (at most 10 completions an address a day are counted; for an IPv6 address, the tally covers its network prefix). That tally is deleted automatically after two days; the address itself is not stored. The public figure is these counts plus 13,713 completions our analytics recorded before the counter started.

2.5 Explorer passport

The explorer passport is off until you press Keep my results on this device on a result or Start my passport. From then on this browser keeps, in its local storage for this site, which categories you have explored, the name of each test you finished there and the date, your achievements and your daily-challenge streak. It also keeps, for each ability test and timed task you finish, your last 20 headline scores: the number the result shows, with the date, the number of questions it is out of, and on the two IQ-style tests the half-width of the printed range. The test’s page uses them to say when you last took it, and the result to compare your next sitting with them. It never holds an answer or a time per question, never a result’s wording except as the next sentence says for a health-related self-check, never a score from the health-related pages listed in section 2.3, and never a time in milliseconds or a typing speed, which only compare on the same device and keyboard. For a health-related self-check it keeps only the date and the wording of the result’s level line, never an answer, a count or a score, so that your next result of the same self-check can show what it said last time. Like the scores, this never leaves your device. On the ADHD, mood, autism, anxiety and calm self-checks, and on the other tests that carry no advertising because of their health subject, it records only that the category was visited, with no test name. Clear passport deletes it from the browser, as does clearing this site’s data.

If you are signed in, the passport is also kept with your account, at most 4 KB, so that it follows you to another device. Stamps from the ADHD, mood, autism, anxiety and calm categories are never sent to us: they stay on the device where you earned them. The kept scores are never sent to us: the copy kept with your account holds no score. Deleting your account deletes the copy we hold.

Counting return days. Our cookieless counter cannot tell a returning visitor from a new one, and we keep no identifier that would. If you have started a passport, the page reads the dates it already holds on your device — the day you first finished each test, the day of each achievement and the days of your current challenge streak — and counts there how many different days that is. The first time on a new day that the passport records something, the page sends our own counter (section 2.3) one event name for that number: return_day_2 for a second day, return_days_3_6 for the third to the sixth, return_days_7p for the seventh or later, and also return_after_7d when the latest earlier day was seven or more days before. The name is all that is sent: no identifier, no date, no exact count and no other property goes with it. Days are your device’s own calendar days, and nothing is sent on the first day or more than once a day. Without a passport nothing is counted this way, and nothing new is stored on your device to make the count. If you are signed in, the passport also holds the days from your other devices. Clear passport stops it, and Do Not Track stops it with the rest of our measurement.

Your switch. To object, tick Don’t count my return days on the passport page, and from that moment nothing is sent this way. Untick it and counting resumes on a later day, never the day you untick it. Your choice is one yes-or-no value inside the passport on this device, not a new storage key; it is never sent to us, and ticking or unticking it sends no event of any kind. It applies to the passport on this device, so on another device tick it there too. The switch is on the passport page.

2.6 Session replay with Microsoft Clarity

What it is. On some general pages and on the puzzle and skill tests listed below we use Microsoft Clarity, a service of Microsoft Corporation, to see how the pages are used: where people click or tap, how far they scroll, where they stop, and which link they follow. Clarity turns this into heatmaps and into replays of visits, following one visit across the pages it runs on, which we watch to find layouts that confuse people and controls that do not work. We have not connected it to Microsoft Advertising and we never give it an identifier of ours for you or your browser.

What it receives. On general pages Clarity can read the public headings, test catalogue, navigation, buttons and explanatory text so we can understand which page and control was used. Account controls and anything typed stay masked, and it never receives the value of any field. It receives pointer and touch positions, scrolling, clicks and which link was clicked, the page address, the site you arrived from (cut to the site’s name; never another page of ours), your browser, device type and screen size. Like any website you load, Microsoft’s servers see your IP address and derive an approximate location from it. On the selected puzzle and skill tests listed below, recordings include questions, options, figures, progress and visible results, including scores and which option you chose. Typed text and account controls remain masked.

Where it runs. It runs on the home page, the category pages outside the subjects below, the guides without a calculator, the list of all tests, and the about, method, sources, legal and support pages. It also runs on the puzzle and skill tests: the IQ and reasoning tests (free, full, Norway-format, abstract, logical, verbal, numerical, spatial, pattern, matrix, number sequence, spatial rotation, visual search and spot the fallacy), the aptitude trainer with its section drills and employer-format papers, the English, Spanish, grammar, spelling and vocabulary tests, the reading speed test, and the memory and attention tasks other than the short-term memory test. On selected puzzle and skill tests, questions, options, figures, progress and results are readable in recordings so we can see which question or control gets in the way. Clarity receives where and when you clicked or tapped, and so which option you chose and how long you took, together with labels of ours: the test, the step you reached, whether you finished or left, and how the page was used (touch, mouse, keyboard, or a browser driven by software). That is puzzle performance, never linked to your name or account. The text of anything you type is never recorded, and account controls stay masked. The optional prompt does not open over a test; Privacy choices in the footer opens it there.

Where it never runs. Clarity does not load on any personality, relationship, feelings, work-values or other self-report questionnaire, any self-check, game or practice page, or any test not listed above; on any page about ADHD, mood, autism, anxiety, calm or reasoning biases, or any other page that carries no advertising because of its subject; on any children’s page; on any class, teacher, coach or practitioner page, or a test opened from a class or comparison link; on your account, passport, plan, shared-result or invitation pages; on the developer, pricing, team, challenge, evaluation, focus room, practice or examples pages; or on the IQ percentile converter.

Consent and cookies.

On eligible general pages, the optional replay prompt offers Accept and Reject. Privacy choices in the footer reopens it; choose Reject to withdraw permission. The controls below offer the same choice.

If your browser’s time zone is in the European Economic Area, the United Kingdom or Switzerland, or cannot be read, Clarity does not load at all until you press Allow session replay in this browser, and so sets no cookie before that. Elsewhere it loads once the page has finished loading. It never loads when your browser sends Do Not Track or Global Privacy Control, or after you press Turn off session replay in this browser. When it runs, we tell Clarity that analytics storage is allowed and advertising storage is refused. It then sets its two first-party cookies on this site. Microsoft’s own servers at clarity.ms and bing.com may also set the third-party cookies in the table below in your browser; many browsers block those by default. Turning replay off erases the two first-party cookies from this site; the third-party ones belong to Microsoft’s domains and are cleared from your browser’s own settings. Microsoft's documentation lists the cookies Clarity sets and what each one is for.

How long Microsoft keeps it. Microsoft keeps recordings for 30 days; recordings we mark as favourites, and a random sample, are kept for up to 9 months. Microsoft processes Clarity data under the Microsoft Clarity terms of use and the Microsoft Privacy Statement.

Your choice in this browser.

2.7 Class sessions for the reading speed test

A teacher can start a class session at /learn/reading-speed-test/class/ and give pupils a link to the reading speed test that carries a six-character class code. This section is about that quick class session, which needs no sign-in; a teacher’s class with seats, run from a teacher’s account, is section 2.9.

What a pupil sends. On that link the test says which class it is for before it starts. After the result, and only if the pupil presses Send to my teacher, the browser sends two numbers to our server: the words per minute, or nothing in its place when the page did not count the speed, and how many of the six questions were answered correctly. No name, no account, no answers, nothing typed and no other result text is sent, and nothing is written to the browser storage. The class code is in the page address only while the page loads: before our audience measurement runs, the page moves it after the #, which that measurement does not record and browsers never send to a website.

What we store. For each class session: its code, a one-way hash of the teacher’s private key, when it started and when it closes, and how many results it holds, at most 200. For each result sent: the two numbers and the time it arrived. To limit abuse we also count, for two days, how many class sessions were started and how many results were sent across the site each day, and how many class sessions each network address started that day, under a keyed one-way hash of the address; the address itself is not stored. In a quick class session, nothing we store names a pupil or a teacher, or says which pupil sent which result.

Who sees it. Only someone who holds the teacher’s private address for the class, which ends in a key after the #. It shows the results in the order they arrived, the median and the middle half of the class’s speeds, and a CSV download, and nothing about who sent them. The key reaches our server only in a request header, to read or delete the class’s results, and only its hash is kept. That page carries no advertising and no session replay.

How long. A class session closes 7 days after it starts: from then on nothing in it can be read or added, and it is deleted from our database automatically within a few days. The teacher can delete it, with every result in it, at any time.

2.8 Comparison, challenge and share links

On the Big Five, attachment, communication style, conflict response and personality type profile tests, Compare with someone can make a link that carries your result’s percentages, one whole number per pattern, and which test it is, after the # of the link; a link sent back in reply also carries the numbers that came in the link it answers, so the first sender sees both without taking the test again; a link carries no answers, no labels and no name, and the page shows you its numbers before the link is made.

Browsers do not send the part after the # to any server, and when the link is opened our page removes it from the address before our analytics or any advertising script runs; anyone who sees the link can read the numbers, and it stays in browser history and in whatever app you send it through.

The person who opens it sees both results side by side on their own screen only, saving their result keeps only their own, and you see theirs only if they send a link back; comparison links are never offered on health-related or ability tests.

On ability tests and timed tasks, Challenge a friend makes a link that carries your headline score, the number of items it is out of or the half-width of an IQ-style range, and which test it is, after the # of the link, never your answers or your name; when it is opened our page removes it from the address before our analytics or any advertising script runs, and the person who opens it sees both scores side by side on their own screen only.

The Share button on a result opens a list of networks; each button opens that network’s own share page with the test’s address, tagged utm_source=share, utm_medium=share, a fixed campaign name (mindatlas-202611-share) and the button’s name as utm_content, and the text shown in the list, which can include your result’s headline but never your answers; nothing is sent to a network until you press its button, and we record which share button was pressed and, for page-link sharing, its location on the page. Sharing a result is never offered on health-related or children’s pages. Adult health pages offer page-link sharing only: it sends the test address and a general description of MyTestAtlas, without answers, scores or result labels.

On the main ability, English and personality tests, a link shared from a result points to a page of ours for that result’s band, such as /r/free-iq-test/strong/, so that the preview a network or messenger draws can show the band in words, for example “Strong result” with “top 16 % on the IQ-style scale”. The band is one of at most five broad groups for that test, never your exact score or your answers, and everyone in the same band shares the same page. It is only in the link when you press a share button, and never on health-related or children’s pages. When you share, we record which button you pressed, where, whether you were signed in (in or out, never who you are), the seconds since the result appeared and the band, and we record a visit that arrives through a shared link.

2.9 Teachers’ classes

A teacher who signs in with Google can create a class at /teachers/classes/, set tests from the list below, and give each pupil a join card with a class code, a seat number and a four-digit PIN. Pupils open the class at /join/, type the PIN on the test’s page, take the test in their own browser, and can then press Send to my teacher.

What a pupil sends. A pupil in a teacher’s class has no account and types no name: Send to my teacher sends the class, the seat number, the test and its numeric result, never the answers, and only when the pupil presses it, and nothing is written to the browser storage. The class code, the seat and the test travel after the # in the page address, so Back and a reload return the pupil to the same class and seat; a browser never sends the part after the # to a server, our audience counter is set to ignore it, and the pages send no referrer. The PIN is never in an address: it is typed on the page, checked by our server and never stored; it earns the page a token that can send results for that one test for at most three hours and can read nothing, and the token is kept only in the open page.

What we store. For the teacher: their account (section 4) and, for each class, the code, the number of seats, when it was made, when it is open for joining and when it expires. For each test set: which test and how many sends a seat may make. For each seat that joined or had a wrong PIN typed for it: a PIN version (the PIN itself is worked out from it when needed and never stored), how many wrong PINs were typed for it under that PIN and how many of them on the day of the last one (30 lock the seat until the teacher gives it a new PIN), and the results it sent, each with the minute it arrived. In a teacher’s class, each result is filed under a seat number; we never receive a pupil’s name, because which pupil sits in which seat is kept only on the teacher’s own device. The label a teacher gives a class and the names they type beside the seats stay in the teacher’s browser and in any roster file they export; we never receive them. Results are worked out in each pupil’s browser, so a determined pupil could alter one; they are practice figures, not marks.

The aptitude trainer. For the aptitude trainer, the teacher chooses the sitting, whether everyone gets the same first paper, and a time multiplier of 1, 1.5 or 2 for everyone who sits that assignment; no pupil, condition or reason is stored with it, but each seat’s results show which assignment it sat, so extra time given through a separate assignment can be seen per seat; a pupil’s send carries, for each section, the number right, the number of questions and the number answered, the furthest question reached and the total time in seconds, never which answer was chosen, how long each section took or the paper number.

IQ practice with hints. For IQ practice with hints, the teacher chooses the set and whether hints are on (a timed set never has them), and a time multiplier only for the timed set; the assignment stores that choice and nothing about any pupil; a pupil’s send carries the same kinds of numbers as the aptitude trainer’s, for matrix puzzles, number series and letter series, and with hints on a question counts as right only when it was solved before the worked solution or the answer was shown; it never says which hints were opened, which answer was chosen or how long any question took.

Due dates. A teacher can give a task a due date and keep it open until the end of that day, so pupils can join it from home; after the due date a send is refused until the teacher sets a later day. For a task with a due date we store the day and the teacher’s time-zone offset, and for each task the seat numbers that have sent it.

Who sees it. Only the teacher who made the class, signed in to their account, sees results. The board shows each seat as “sent” or “not yet”, and a teacher’s own view adds the figures and the names from their device, in seat order and never ranked. Anyone with the class code can see the class’s tasks, their due dates and, for each seat number, whether that seat has sent each task, never what it scored; the teacher can turn the sent marks off.

Limits against abuse. On the pages pupils use in a teacher’s class, our servers see the network address only to deliver the page and to count failed joins against abuse limits, under a keyed one-way hash that expires after two hours. Our audience counter on those pages runs on a server we operate ourselves, not with an analytics company and not on Amazon Web Services, and we use it only for our own internal operations: it sets no cookie, works out a session hash from the network address and the browser’s user agent that changes every month, stores no persistent identifier, and is set to ignore the part of the page address after the #, so it never receives the class code, the seat, the test or the PIN. Those pages show no advertising and load no session replay, and nothing on them is used to contact a pupil, build a profile or show advertising. We also count joins, results and classes made across the whole site each day, with no identifier, and the classes each teacher makes each day.

How long. A teacher’s class and every result in it are deleted 120 days after the class was created (400 days for a class made on Class Pro), or at once when the teacher deletes the class, a seat’s results or their account: removed from live storage at once, and from our encrypted backups within 35 days.

Who decides. For results pupils send in a teacher’s class, the school or teacher who runs the class decides why they are collected, and we process them only on their behalf, under section 4c of our Terms. A pupil or parent who wants a result removed should ask the teacher, who can delete one seat’s results or the whole class at once; we cannot tell which seat is whose. As of 10 October 2026, a free teacher account can have 6 classes at a time, each with up to 60 seats and 40 tests, and each pupil can send each test up to 3 times.

2.10 The colour vision check

The colour vision check at /vision/color-blind-test/ shows dot plates and asks which digit, if any, you see. Your answers and the pattern it shows you stay in that page’s memory and are gone when you leave or reload it. No result from this check is saved: not in this browser’s storage, not on our servers and not in an account, and there is no Save button. It has no share card, no passport stamp, no completion count and no comparison with an earlier sitting, and it is not available in a teacher’s class. Our self-hosted counter records when a check starts and finishes. Sharing a page link records the button and its placement, never your answers or result. The start and finish events carry no properties. The page-link sharing event carries only channel and surface.

2.11 Coach shares

A signed-in coach on the coach beta can make a link at /coaches/cabinet/ for one client or for a group, for up to 15 one-to-one clients and 3 groups at a time, and sends it themselves. Before the first link they confirm the cabinet is never used to hire, promote or rank anyone.

What a client sends. A client in a coach’s engagement has no account; their result is sent to the coach only when they press Share, as one number from 0 to 100 per dimension, never their answers or their name, and they can take it back with the withdraw link. The engagement travels after the # in the page address, which a browser never sends; the pages send no referrer, load no account code, no advertising and no session replay, and our audience counter is set to ignore the part after the #. A share is not sent from a browser signed in to this site; that is a hurdle, not a guarantee, because nothing stops a coach adding answers from another browser.

What we store. For each engagement: the coach’s account, whether it is for one client or a group, the reflections chosen, when it was made and when it ends (180 days later), a share count and, for a group, the group’s spread. For each share: the reflection, its version and its numbers, a one-way hash of the withdraw token, and for one client the day it arrived and whether it was the first or the second time. No name, e-mail or free text: the label a coach gives a client stays in the coach’s browser. To limit abuse we count, per keyed one-way hash of the network address, shares to one group and reflection each day (at most 40) and failed requests each hour; those tallies expire within two days.

Who sees it. For one client, the coach sees that client’s numbers. For a group, the coach sees no row: only the middle of the group and its middle half on each dimension, rounded to 5, once five or more answers are in, moving only when five more arrive; and after a withdrawal empties it, only when five more than its last summary are in. The coach sees the group’s size as “fewer than 5”, “5–9” or “10+”. Your coach sees a group summary only once five or more answers are in. A coach could add answers of their own, so in a small group they might work out yours. Share only with a coach you trust.

How long. Until the client withdraws it, the coach deletes it or the engagement, or the coach deletes their account; everything in an engagement is deleted 180 days after it was made. For a client’s shared numbers the coach decides why they are collected, under section 4d of the Terms, and we process them on the coach’s behalf.

2.12 The practitioner tool

A tool to send standard questionnaires and add up their scores by their published keys; the clinical judgement is yours. A signed-in practitioner on the practitioner beta confirms a short professional statement and then makes questionnaire links at /practitioners/cabinet/ for clients, who answer at /practitioners/respond/ and send back a link.

What we process. The practitioner’s Google sign-in and session (section 4), that they joined the beta, and the date and version of the statement they confirmed. The pages are requested from our hosting provider, Amazon Web Services, which sees the page address without the part after the #, the network address and the browser’s request headers needed to deliver it; no access log of those requests is configured for this site.

What we do not process. Nothing a practitioner’s client answers reaches us: the questionnaire link and the answers travel after the # in the address, which browsers never send, and the records are kept only in the practitioner’s browser. We never receive a client’s answers, a request number, a label, a total or any count per client. The client’s page loads no audience counter, no account code and no advertising, makes no request after it has loaded, and writes nothing to the browser’s storage.

On the practitioner’s device. Clients’ labels, open links (with the key that checks a return), returns and totals are kept in the browser’s IndexedDB as mta-practice until the practitioner deletes them or the browser clears this site’s data, which Safari and every browser on iPhone and iPad do after 7 days without a visit unless the site is on the Home Screen. Exports are files the practitioner keeps, encrypted with their passphrase unless they choose otherwise.

Consumer health data. Under Washington’s My Health My Data Act and similar laws, a client’s answers to these questionnaires would be consumer health data. We do not collect, share or sell them: they never reach us. The practitioner who sends the questionnaire is responsible for how they keep and use the answers.

2.13 Beta products, Class Pro and test payments

Class Pro, the coach cabinet and the practitioner tool are free betas as of 10 October 2026. Joining a beta records that you joined, which product, its planned price and where you pressed the button; nothing is charged, and we will tell you in your cabinet at least 30 days before billing starts. You can leave a beta at any time; leaving deletes that record.

To learn which placements are seen, a signed-in person’s first view of a beta offer in a month is counted once per placement under a keyed one-way hash of their account that expires with the month, beside a plain monthly count per placement. Our own quality-assurance accounts are not counted.

Class Pro keeps a class made on it, and its results, for 400 days instead of the free 120 (section 2.9). If Class Pro ends, a class older than the free 120 days stays open to read, export and delete for 30 days from the next time you open your classes page, then is deleted; if you don't open your classes page, it is deleted at the latest 400 days after it was made.

Test payments. Until billing starts, payment pages run in Stripe’s test mode for people we have listed as testers, and no real card is charged. When you open one, we store an order record (the product, its price, the currency, the time and your account) and Stripe receives what you type on Stripe’s own page under Stripe’s privacy policy; we never receive card details.

2.14 Practice plan

The practice plan is off until you press Keep my plan on this device. From then on this browser keeps, in its local storage for this site, a random plan number that names its calendar events, the kind of test, its date or that you have none yet, the days a week and minutes you chose, your practice time, the day the plan was made, the days you practised, the section to work on next (the weakest section of your last full mock, or the section you last drilled), which aptitude questions this device has been given, so that it is not given them again, and whether you have answered how the test went (never the answer). It also keeps the moment of the day you practise, if you pick one from a fixed list (such as after dinner, never your own words), and the day you last practised each section and the full mock. It is kept as mta.plan.v1. The plan never holds an answer, a score, a name or an email address; the one thing it keeps from a result is the name of the section to work on next. When you choose a practice moment on the plan page, the plan also keeps that moment, picked from a fixed list and never typed, and the last day you practised each section and the full mock.

Nothing you enter in the plan is sent to us unless you turn sync on. When you open the plan page from a result, make a plan, pick its practice moment for the first time, download its calendar file, practise, answer how your test went or delete the plan, the page sends our cookieless counter (section 2.3) an event name (two when you practise on a later day than the plan was made, and one more when that practice makes up a missed practice day of its week) with nothing attached: no date, no identifier and nothing you chose. Your answer to how the test went is not sent, only that you answered. A practice opened from the plan page has plan=1 in its address, which the counter records as it records every page address. Which section or kind of test it opens is kept after the # in the address, which is never sent. The calendar file is made in your browser and saved to your device; we only count that a file was made, never what is in it. The names are plan_offer_opened, plan_created, plan_ics_downloaded, plan_practice_day, plan_return_day, plan_outcome_given, plan_deleted, plan_cue_set, plan_week_repaired.

Delete my plan on the plan page removes it from this browser, and so does clearing this site’s data. The plan is separate from the explorer passport and is never used to count return days.

2.15 Review deck and sync

The review deck is off until you press Keep them for review under a result of the aptitude trainer, or the review button at the end of an IQ practice set, or turn sync on with an account that already keeps a deck. From then on this browser keeps, in its local storage for this site, a random name for this device, the day the deck was started, the last day it was used and on how many days, each question you missed, or in IQ practice needed help with (a wrong answer, a right second try, the second or third hint, or the answer shown), as a short reference that rebuilds it, with the day it was added, its review step, the day it is next due, how many times you reviewed it and how many times it changed, the references of the questions you have learned with how many times each changed, and, for up to four device names, how many questions you got right, how many you were given and the seconds you spent per section in timed sittings, with a running number. It is kept as mta.review.v1. The deck never holds an answer you gave, the option you chose, a name or an email address.

Nothing in the deck or the practice plan is sent to us until you press Sign in to sync, Sync my practice to my account or Use them here. While you are signed in, the account page, and the plan page when nothing is kept in this browser, read whether your account keeps a copy, and send nothing. After that press, while you are signed in, the trainer, the plan page and the account page send your practice plan and review deck to your account and read them back, so your other devices get them; your account also keeps when the plan was last edited on a syncing device, up to ten deleted plans' random numbers so no device puts them back, and when the copy was last saved or deleted, and this browser keeps when you turned sync on, when it last synced and the same edit time and deleted plan numbers. This browser’s note is kept as mta.sync.v1. If you press Not now on the invitation to sync, this browser keeps the day you pressed it, so you are not asked again for 30 days. It is kept as mta.sync.quiet. Your account keeps one copy of the plan and the deck, the fields listed here and in section 2.14, until you delete it.

When you keep a deck, finish a review, delete the deck, press one of the three sync buttons or a device first completes a sync, the page sends our cookieless counter (section 2.3) an event name with nothing attached: no date, no identifier, no question and nothing you chose. The names are review_kept, review_done, review_deleted, sync_prompt_pressed, sync_on.

Delete it from my account on the account page removes them from your account, so does deleting your account, and every device then stops syncing and keeps its own copy. Delete my review deck on the trainer removes the deck from this browser and, when this browser syncs, the whole practice copy, plan and IQ practice progress included, from your account; clearing this site’s data removes it too.

2.16 Extra time & display settings and employer-pace sittings

Extra time & display settings last for the open page unless you press Keep these settings on this device. Then this browser keeps, in its local storage for this site, only the display and timing choices: breaks after every five questions, how the clock is shown and how much time is allowed, the pause button, wider spacing, the reading font, larger text, read-aloud and calm motion. It never keeps why you chose them, and the settings are never sent to us or synced to an account. They are kept as mta.comfort.v1. Forget these settings removes them, and so does clearing this site's data.

Read aloud uses only voices that run on your device, so the text of a question is not sent anywhere to be spoken. When a sitting starts, the trainer sends our cookieless counter the event focus_mode_on once for each of these settings that is on, and once for a five-question set opened from a link or started with these settings on, each time with one word naming it (quick, bursts, timer, large, spacing or read) and nothing else; a sitting set by a teacher sends none. A sitting at an employer test's pace, a five-question set and a sitting set by a teacher send the same run events as any trainer sitting, with the sitting's neutral name, such as mixed-50-15 or quick-verbal, as their form.

The ADHD-friendly practice page carries no ads and no session recording, stores nothing, and shows every visitor the same links; nothing on it, or in the settings it opens, records a health condition.

2.17 IQ practice sets with hints

The IQ practice sets run in your browser. Your answers and chosen options stay in the tab, apart from the masked clicks Microsoft Clarity records on the test pages listed in section 2.6.

Nothing about your practice is kept unless you press Keep my progress by rule on this device, except that once your review deck is on, the questions you needed help with go into it, as described under Review deck and sync. Then this browser keeps, in its local storage for this site, for each kind of rule you practised, how many questions you met, a running mark of how you did, whether each of the last three was on your own, and the day; the step you reached in each question type; the hint wording you prefer; how many timed sets you finished; and the first and last day you practised. It never keeps an answer, a chosen option, a record of any one question, a time or a name. It is kept as mta.iqtrain.v1. Forget my progress removes it, and so does clearing this site's data.

If this browser also syncs your practice with your account (Review deck and sync), that progress by rule goes to your account with the plan and the deck only after a press that says so: Keep my progress by rule on this device and in your account while sync is on, or one of the sync buttons, whose text lists it. It is the same fields listed above, per kind of rule, never an answer, a chosen option or anything about any one question, and this browser keeps a one-character note that you made that press. Another syncing device where you pressed Keep combines it with its own; one where you did not keeps none of it. Forget my progress on a browser that syncs removes it there and, at that browser's next sync, from your account; until then this browser keeps a one-character note that you pressed it. Another device where you pressed Keep holds the combined progress, this browser's included, and sends it back to your account when it syncs, until you press Forget there too. Turning sync off on a browser removes both notes. Delete it from my account on the account page, and Delete my review deck on a browser that syncs, remove it from your account with the plan and the deck. The two notes are kept as mta.iqtrain.sync and mta.iqtrain.forget.

Opening a hint sends our cookieless counter the event hint_opened with the hint's level, the question's number in the set and the seconds since it was shown, and whether it was opened from the hint suggested after a wrong try, never an answer; opening a hint in a worked example sends its level and the example's number. The practice sets also send the usual run events with the set's neutral name, such as trainer-5, as their form. Rating an answer sends feedback_helpful or feedback_unhelpful with the page, the set's neutral name and how the question was reached (on your own, after the first, second or third hint, on a second try, shown, or wrong), never the question's number or an answer.

3. How We Use Information

• To provide the service — delivering pages, running assessments in your browser, operating the focus room, class sessions and teachers’ classes, and operating your account if you create one.
• To maintain and improve the service — aggregate audience measurement showing which pages are used, and, on general pages and the puzzle and skill tests, session replay showing where a page gets in the way (section 2.6).
• To respond to you — answering support and privacy requests.
• To keep the service secure and to comply with legal obligations.

We do not use your information to make automated decisions with legal or similarly significant effects, and we do not build advertising profiles of you.

4. Google Sign-In and Google User Data

An account is optional. Browsing the catalogue and taking tests never requires one. Sign-in with Google, or with a link we email you (section 4.10), is available at /account/; this section is the policy that governs both.

4.1 What Google sends us

If you choose to sign in with Google, we request only the openid, email and profile scopes, and receive only:

• Your Google account identifier (the sub claim), which we store only as a one-way hash, so that a copy of our records does not reveal which Google accounts have used the service;
• Your email address and whether Google has verified it, used to recognise you when you return and to contact you about the service;
• Your display name and profile picture (received, not stored): the name is used only to show you who is signed in.

We receive your name, email address and profile picture from Google, and keep your name, your email address and one-way hashes of your email address and of your Google account identifier; we do not keep the picture.

4.2 How we use Google user data

Only to operate your account: to sign you in, and to associate what you save with your account; and, only if you tick Email me when paid plans launch when you activate an API plan, to email you once when paid plans launch. Nothing else.

4.3 Limited use

MyTestAtlas’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We do not sell Google user data or transfer it to third parties, except as necessary to provide or improve the service, to comply with applicable law, or as part of a merger or acquisition with notice to you.
• We do not use it for advertising, ad targeting, ad measurement or profiling.
• We do not allow humans to read it, except where you explicitly ask us to — for support, or by ticking Email me when paid plans launch, which lets us read your address to write to you once — where it is necessary for security purposes such as investigating abuse, or where the law requires it.
• We request no scope that would let us read your Gmail, Drive, Calendar, Contacts or any other Google service, and we hold no token that would allow us to act at Google on your behalf.

4.4 Withdrawing access and deleting your account

Signing out ends the session at once, on this device and on our server; Sign out on every device, on the account page, ends every session of your account. Deleting your account removes the hashed identifier, the email address, the display name and everything saved under it, including your API plan activations, the launch-email opt-in and your explorer passport; you can do this from the account page, or by emailing support. From the account page it happens at once: every API key and share link stops working the same moment. By email it is completed within 30 days. Either way it is not recoverable afterwards. Anonymous aggregate counts — such as how many people chose Pro in a month — carry no identifier and are not affected.

You can revoke our access at any time from your Google account permissions page, which stops any further sign-in without affecting your use of the tests.

4.5 Saved results and share links

Saving is your choice, per result. On a result screen, a signed-in person can press Save this result. What is stored under the account is the scored result the page showed: the test’s name, the date, the headline, the label, the summary, and for each pattern its label, its position within the test’s own range and its reading. The saved result does not include your answers, item-level response times or anything you typed.

On ability tests and timed tasks, a saved result also keeps a number so that your next sitting can show the change since then: the count solved or recalled with the number of items it is out of, the speed, the time, the span or the share of correct responses, or on the two IQ-style tests the middle of the estimated range with the half-width of the range the page showed; on the reaction and interference tasks the saved label also says whether you used touch or a mouse or keyboard; this number is never part of a share link, and results from health-related, questionnaire and children’s pages never carry one.

Saving before you have signed in. If you press Sign in with Google to keep it under a result while signed out, or Sign in with Google to save it when your session has ended, the page keeps the result the page showed — the same fields listed above, never your answers — in that browser tab’s sessionStorage, under the name mta.pending.result, while Google signs you in. Nothing of it is sent anywhere before you are signed in. When Google returns you to the account page, the result is read once, erased from the tab and saved to your account. It is also erased if the sign-in fails or is abandoned, when you open any other page of this site in that tab, and after 30 minutes; closing the tab erases it too. Results from the health-related pages listed in section 2.3 are never held this way. For those, sign in first and save the next result.

Sharing is your choice, per link. From the account page you can create a link for a saved result and give it to anyone — a clinician, a friend. The link is a random 192-bit token; whoever opens it sees the saved result and the test’s caveats, never your name or email. It expires after 7, 30 or 90 days as you choose, you can revoke it at any time, and deleting the result or the account ends every link to it. A shared result is still not a diagnosis and not a basis for a decision about you.

Saved results are kept until you delete them or delete the account. They are never used for advertising, never read by a person except at your request or for security, and never joined with audience measurement.

Results saved from the children’s picture puzzles cannot be shared by a link, and links made before this change no longer open.

Showing the panel that says what an account keeps, or the line that says a signed-in retake shows the change since last time, writes nothing to this browser.

4.6 Model evaluation runs

An evaluation run at /evals/ is started with an API key. We store the model name and harness name you give, the answers submitted (a model’s, not yours), the grade, and which key started the run. The public board and run pages show the model name, the harness name and the grade; they never show who ran it. Runs are kept while the board exists; deleting your account removes the link between a run and your account, and you can ask for a run to be removed.

4.7 Daily challenges

Entering a challenge at /compete/ stores, for that challenge, a one-way hash of your account or key (so you can enter once), the time you started and submitted, and the name you chose for the board, if any. The board shows that name or anonymous, your score and your time; it never shows your email. Entries are removed 30 days after the challenge closes.

4.8 Team assessments

A team owner who invites people at /teams/ gives us each invited person’s email address. For each invitation we store that address, the invitation’s status, and once the person finishes, their score, their share correct in each skill family, their time and when they finished — never their answers, which leave the browser only to be graded. The team sees exactly that. The invited person sees it first and can withdraw it from their invitation page, which removes it from the team’s view. The team owner can delete an invitation, an assessment or the team; deleting the owner’s account deletes the team. Invitations expire a year after the assessment closes. The team owner is responsible for having a reason to invite each person; we use the addresses for nothing else.

4.9 API plans

API plans. When you activate an API plan we record, under your account, the plan, the price shown and its version, the page you came from, the time, and whether you ticked Email me when paid plans launch. We learn that a plan was activated, or more quota requested, from a short notification that carries the plan, the price version, the time and an opaque account reference, and never your email address or name.

4.10 Sign-in by emailed link

You can also sign in with a link we email you. When you ask for one we store, for 15 minutes, a one-way hash of a random single-use code, the email address you typed (so that the link can be sent and the account found) and a hash of a cookie that ties the link to the browser that asked; the link works once, in that browser. Your account is then keyed on a one-way hash of the address, and the address is kept in your account to recognise you when you return, as it is for Google sign-in. The email is plain text with the link and nothing else: no image, no tracking pixel, and opens and clicks are not tracked. To limit abuse we count requests for an hour or two days under keyed one-way hashes of the address and of the requesting network. Our answer is the same whether or not the address already has an account.

Deleting your account removes the hashed identity and the account with its address; an unused link expires after 15 minutes and is erased by the database within about two days. The email is carried by Amazon Simple Email Service (section 6). Sections 4.1 to 4.3 describe what Google sends and apply only to Google sign-in.

5. Legal Bases for Processing

For individuals in the European Economic Area and the United Kingdom, we rely on the following legal bases under the GDPR:

• Legitimate interests (Article 6(1)(f)) for cookieless audience measurement, the shared session counters, class sessions, the join limits of teachers’ classes, the completion counter and service security. These involve no identifier and are necessary to operate and improve the service.
• Performance of a contract (Article 6(1)(b)) for operating your account, which you create by signing in, including the API plan you activate and the passport you keep with it.
• Consent (Article 6(1)(a)) for the one launch email you ask for with the opt-in, withdrawable by email at any time.
• Consent (Article 6(1)(a)) for advertising storage, requested before anything requiring it is set and withdrawable as easily as it was given.
• Consent (Article 6(1)(a)) for Microsoft Clarity session replay, which does not run for visitors in the European Economic Area, the United Kingdom or Switzerland until they allow it, and stops when they turn it off.
• Legal obligation (Article 6(1)(c)) where we must retain or disclose information by law.

When you save a result from a health-related self-check, you are asked to confirm first; that confirmation is your explicit consent to us storing it (GDPR Art. 9(2)(a)), and deleting the result or your account withdraws it.

Results from health-related self-checks saved before we added this confirm step are not shown or shared until you confirm; any not confirmed by 10 November 2026 are deleted.

For results pupils send in a teacher’s class, the school or teacher who runs the class decides why they are collected and on which legal basis, and we process them only on their behalf (section 2.9 and section 4c of the Terms).

6. Information Sharing and Disclosure

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have never done so, and the service is not built to.

We share information only with the following categories of recipient, and only as needed to run the service:

• A teacher who started a class session — a pupil who presses Send to my teacher shares that reading’s words per minute and score, with no name, with whoever holds that class’s private address (section 2.7);
• A teacher whose class you joined — the seat’s numeric results, by seat number (section 2.9);
• A coach whose link you used — only the numbers you chose to share (section 2.11);
• Stripe — only if you open a test payment page, which runs on Stripe’s own site (section 2.13);
• Hosting and infrastructure — Amazon Web Services, which stores and serves the data described above on our instructions;
• Google — only if you choose to sign in, and, once advertising is activated, for the advertising described in section 9;
• Email provider — for support correspondence and, if you opted in, the one launch email;
• Amazon Simple Email Service (part of Amazon Web Services) — carries the sign-in links you ask for (section 4.10), and our own notification that an API plan was activated or more quota requested. It carries the plan, the price version, the time and an opaque account reference, and no email address, name or other personal detail;
• Microsoft — Microsoft Clarity, on general pages and the puzzle and skill tests only, under the conditions in section 2.6;
• Anyone you give a share link to — a link you create for a saved result shows that result, without your name or email, to whoever opens it until it expires or you revoke it (section 4.5).

Our audience measurement involves no other party, because we host it ourselves; Microsoft Clarity (section 2.6) is the one measurement service run by another company. We may also disclose information where the law genuinely requires it, and we will say so publicly where we are permitted to.

7. International Data Transfers

The information we store — the session counters, and account records once accounts exist — is held in Amazon Web Services’ Frankfurt region (eu-central-1) in the European Union. Pages and static files are delivered through a content delivery network with servers worldwide, which means the network sees the address of the page you requested in order to deliver it.

If you sign in with Google, that exchange takes place with Google and is governed by Google's Privacy Policy; Google may process it outside the European Union under its own safeguards.

Microsoft may process Clarity data in the United States and elsewhere under its own safeguards, described in the Microsoft Privacy Statement.

8. Data Retention

9. Cookies, Similar Technologies and Advertising

Our own audience measurement sets no cookie, we write assessment answers to browser storage only to keep an unfinished test or aptitude sitting, and then a reasoning test’s or sitting’s result, on this device for up to 48 hours or until you start over (section 2.1), a result only while a sign-in you started from a result is under way (section 4.5) or, once you keep them, as the practice plan’s section to work on next and the review deck’s section totals (sections 2.14 and 2.15) and, in an explorer passport you start, your last scores of each ability test (section 2.5), and we create no site-owned cross-site identifier. The only measurement cookies on this site are Microsoft Clarity’s, _clck and _clsk, with Microsoft’s own on its domains, all set only where and when section 2.6 says, and never from a questionnaire, a health-related page, a children’s page or your account. The explorer passport, once you start it, is kept in this site’s local storage on your device (section 2.5): it is the feature you asked for, it holds no answer, of a result only the last scores and a health self-check’s date and wording described there, and it is never read by advertising. The one measurement that reads it is the count of return days in section 2.5, made on your device, which sends a single event name and no date. Ticking Don’t count my return days on the passport page stops it: that choice is one yes-or-no value inside the passport, never sent to us. See section 2.5, or go straight to the switch. The practice plan, once you keep it, is kept in this site’s local storage on your device as mta.plan.v1 (section 2.14): it is the feature you asked for, it holds no answer or score, from a result it keeps only the section to work on next, and nothing in it is sent to us unless you turn sync on (section 2.15). The review deck, once you keep it, is kept the same way as mta.review.v1, and a browser that syncs keeps mta.sync.v1 (section 2.15): both are features you asked for, and neither holds an answer you gave. The children’s learning pages under /kids/ keep a progress record in your browser’s local storage, described in section 12; it is not a cookie, contains no assessment answer or result, and is never sent to us. A teacher’s class labels and the names they type beside seats are kept in their browser’s local storage as mta.cabinet.v1, or, if they choose it on a shared computer, in that tab’s sessionStorage as mta.cabinet.session.v1; neither is ever sent to us (section 2.9). Extra time & display settings, once you press Keep these settings on this device, are kept the same way as mta.comfort.v1: display and timing choices only, never a reason, never sent to us or synced. IQ practice progress, once you press Keep my progress by rule on this device, is kept as mta.iqtrain.v1: counts and marks per kind of rule only, never an answer. A browser that syncs keeps mta.iqtrain.sync after a press that lets that progress go to your account, and mta.iqtrain.forget after Forget my progress until its next sync; turning sync off removes both (section 2.17). The pages pupils use in a teacher’s class write nothing to browser storage.

We plan to show ads on some pages. We do not currently show ads, so no advertising cookies or requests to Google are made. If that changes, we will ask for consent first.

Google's current publisher requirements require a Google-certified consent platform integrated with the IAB Transparency and Consent Framework when serving personalised AdSense ads in the EEA, United Kingdom, or Switzerland. Refusal must be as easy as acceptance, and the provider privacy control must let a visitor revisit the choice. MyTestAtlas does not send assessment answers, scores, result labels, or inferred traits to Google for advertising or targeting.

Health-adjacent routes carry no advertising. Every route under /vision/ carries none either, and loads no session replay. Every route under /adhd/ and the adult attention reflection under /focus/ stay advertising-free, hub page included. These pages use the same DNT-aware cookieless page measurement and the same event names as the rest of the catalogue, with only the run facts listed for them in section 2.3 and never the ability band; answers and result text never enter any event. Microsoft Clarity never loads on a questionnaire or a health-related test, and on the puzzle and skill tests it records the questions, options and your clicks and taps, never typed text (section 2.6). We do not infer a condition, a diagnosis or a health interest from which pages you read.

10. Data Security

The service is served only over HTTPS with HTTP Strict Transport Security. Account identifiers are stored as one-way hashes rather than in readable form. Sign-in cookies are Secure and host-scoped, and the session cookie is HttpOnly; its -hint companion holds no secret and the page can read it. A sign-in session lasts 30 days from sign-in and is not extended. When you sign out we keep a record that the session has ended, naming the session and when it would have expired and nothing else, and delete it automatically a day after that. The cookies page lists all four sign-in cookies. The component that answers public requests is technically prevented from reading any credential store, and access to stored data is restricted to what the service itself needs. No system is perfectly secure; if something goes wrong we will notify affected people and the relevant supervisory authority without undue delay.

11. Your Rights and Choices

Depending on where you live, you may ask what information is available, object to processing, request deletion or correction, withdraw advertising or session replay consent, request a copy of your data in a portable format, or complain to your local data-protection authority.

To exercise any right, email support@mytestatlas.com with the subject “Privacy request”. Please do not include assessment answers, results or health information in that email.

Residents of California and other US states with comparable laws have the rights to know, to delete, to correct, and to opt out of the sale or sharing of personal information — an opt-out we can honour trivially, because there is no sale or sharing to opt out of. We will not discriminate against you for exercising any right.

Session replay can be turned off in this browser at any time, in section 2.6 or on the cookies page; Do Not Track and Global Privacy Control turn it off without asking.

We respond within one month, and we will not ask you for more information than we need to find what you are asking about, which for most of this service is nothing at all.

12. Children’s Privacy

MyTestAtlas is written for adults. A few pages are written for a parent, carer or teacher to use with a child, or for a parent of a young child: the picture puzzles for ages 5 to 11 at /think/non-verbal-reasoning-for-kids/, and pages under /kids/ of these kinds:

• children’s learning pages for ages about 3 to 7 (which are currently the name tracing worksheets, R sound practice games and cards and S sound practice games and cards);
• printable cards for babies (printable high-contrast baby cards);
• checklists for parents (milestone checklists by age, from the CDC);
• the /kids/ page that lists them (kids page).

The English and study-skills tests under /learn/ are for adults and are not covered by this section, except for the reading speed test used in a class session and the tests a teacher sets in their class, both described at the end of this section. Microsoft Clarity (section 2.6) never loads on any of these pages. Children never need an account, and these pages never ask a child to sign in, type, speak into the device, take a photo or upload anything.

The children’s learning pages under /kids/. The learning pages (the name tracing worksheets, R sound practice games and cards and S sound practice games and cards) carry no advertising and no analytics. They load no analytics script, send no event names and set no cookies, and each one tells your browser, through its security policy, to refuse scripts, connections and frames from any other website, and not to use the camera, microphone or location. Worksheets are drawn in your browser. The voices you hear are pre-recorded sound files served from this site; nothing is spoken by an online service. Our hosting provider records ordinary request information for these pages as for every page (section 2.3). An address under one of these pages that does not exist shows the site’s shared “page not found” page, which also loads no analytics script, sends nothing and sets no cookie.

The speech sound practice pages. These pages never record, listen to or send anything a child says. They do not use the microphone, and their security policy tells your browser not to allow it. A grown-up listens and taps a button after each try; the page counts the tries and keeps nothing else about them. The answer you give to the page’s question about your child is used only while the page is open and is never kept.

What the learning pages keep on your device. So that a child can carry on where they stopped, the learning pages keep a small progress record in this browser’s local storage, under the name mta.kids.v1. It holds the day it was created; the animal picture chosen for each child on this device (up to four) and the day it was added; the age band you picked (3 to 4 or 5 to 7); which stages and levels have been practised, the stage each child is on, and how many rounds needed help; on the speech sound practice pages, how many practice tries each child has made at each step, as a count only, never whether a try sounded right; the days of the current week on which each child practised, as up to seven dates without times, cleared when a new week starts; the day (never the time) each was last played; the stickers earned; your settings (sound, volume limit, reduced motion, left-hand mode, pattern mode, captions, break timer); and the day you dismissed the storage notice. It holds no name, age, birthday, photo, voice, recording, drawing, handwriting, anything typed or anything a child says. It never leaves your device: it is not sent to us or to anyone, and we cannot see it.

A child’s name. A name typed for a name-tracing sheet is used only inside the open page. It is not sent to us, not added to the page address and not kept, unless you tick “Remember this name on this device”. Then it is kept in this browser under mta.kids.local.v1, separately from the progress record, and no part of our code that could ever send data reads it. Names typed for a class set of sheets are never kept.

Keeping and deleting it. Open “Settings and progress” on any of these pages and choose “Clear this device” to delete everything they keep, or clear this site’s data in your browser settings. “Save a copy” downloads the progress record, without any name, as a file for you to keep; we never receive it. The copy does not include the days of the week practised. Some browsers delete a site’s stored data by themselves after a period without visits (Safari after seven days).

The printable baby cards. The page at /kids/high-contrast-baby-cards/ is for parents of babies. It draws the cards in your browser. It keeps nothing on your device, not even your choices, sets no cookies and sends nothing about you or your baby. Like the learning pages, it carries no advertising and no analytics and tells your browser, through its security policy, to refuse scripts, connections and frames from any other website. Our hosting provider records ordinary request information for this page as for every page (section 2.3).

The milestone checklists. The checklists under /kids/developmental-milestones-checklist/, including the corrected-age calculator, are for parents and carers. What you mark, any note you type and the dates you enter in the calculator stay in the open page. They are not sent to us or to anyone, not added to the page address, not saved in your browser’s storage and not linked to any account; closing or reloading the page clears them, and the page also clears answers that your browser would otherwise restore when you come back to it. The address of each age’s page shows which checklist was opened, as any page address does, and never contains an answer. The printed list is made by your browser’s own print function; there is no email or sharing step. These pages carry no advertising and no analytics, set no cookies and, like the learning pages, tell your browser through their security policy to refuse scripts, connections and frames from any other website. The checklist wording comes from the US Centers for Disease Control and Prevention (CDC), which does not endorse this site. Our hosting provider records ordinary request information for these pages as for every page (section 2.3).

The kids page. The page at /kids/ lists these activities. It carries no advertising and no analytics, runs no script of its own, keeps nothing on your device and sends nothing about you or your child. It uses the site’s ordinary security policy, not the stricter one of the learning pages. Our hosting provider records ordinary request information for it as for every page (section 2.3).

The picture puzzles. The page at /think/non-verbal-reasoning-for-kids/ carries no advertising and no analytics, and collects nothing that identifies the child. It loads no analytics script, sends no event names and sets no cookies, and, like the learning pages, tells your browser through its security policy to refuse scripts, connections and frames from any other website. The puzzles are built in your browser and the answers stay in the open tab: the page writes nothing to your device, never asks a child to sign in and has no Save control. Scores an adult saved from it to their own account before 24 September 2026 stay there, as described in section 4.5; they hold the score and level, never a name, and cannot be shared by a link. Our hosting provider records ordinary request information for this page as for every page (section 2.3).

Accounts are for adults. Apart from the results pupils send in a teacher’s class (below), we do not knowingly collect personal information from anyone under 16. The pages under /kids/ and the picture puzzles are built so that they send us nothing about a child. If you believe a child has created an account or sent us information, email support@mytestatlas.com and we will delete it.

Pupils in a class session. A teacher may use the reading speed test with a class through a class link (section 2.7), and pupils under 16 may use it that way. In a quick class session, pupils need no account and type no name, and nothing we store identifies a pupil. The test runs in the pupil’s browser, and the only thing that leaves it is what the pupil chooses to send with Send to my teacher: the words per minute and the number of questions answered correctly. On a class link the page shows no advertising and loads no session replay; the cookieless audience measurement records the visit as on every page, with no identifier and without the class code (section 2.3). The teacher decides whether the test suits the class, explains to the pupils what is sent, and is responsible for using it with them.

Pupils in a teacher’s class. A teacher may set the tests listed in section 2.9 for their class, and pupils of any age, including under 13, may take them that way. Pupils may be under 13; they join only through their teacher, need no account, and give us no name, email address or other typed detail beyond the class code, the seat number and the PIN on their card. On the pages pupils use in a teacher’s class, our servers see the network address only to deliver the page and to count failed joins against abuse limits, under a keyed one-way hash that expires after two hours. Our audience counter on those pages runs on a server we operate ourselves, not with an analytics company and not on Amazon Web Services, and we use it only for our own internal operations: it sets no cookie, works out a session hash from the network address and the browser’s user agent that changes every month, stores no persistent identifier, and is set to ignore the part of the page address after the #, so it never receives the class code, the seat, the test or the PIN. Those pages show no advertising and load no session replay, and nothing on them is used to contact a pupil, build a profile or show advertising. The pages pupils use carry no Save control and no link into the rest of the site, say on the join screen in plain words what the teacher will see, and write nothing to the browser’s storage. The teacher or school decides whether to use the class with their pupils, under their school’s rules and any consent their law requires, and we process the results only for them (section 2.9 and section 4c of the Terms).

The times tables and maths facts pages. A child may use /learn/times-tables-test/, /learn/multiplication-practice/ and /learn/math-facts-practice/. On the times tables and maths facts pages the questions are made and marked in the browser, and nothing is stored on the device. The cookieless counter records the page view and run events (started, finished, stopped) with the test, the form, the attempt number in this tab, the seconds since Start and the screen size; nothing else is sent, never an answer, a score or a fact, and the pages carry no advertising and no session replay. The counter is the one described in section 2.3 and is set to ignore the part of the address after the #. Used in a teacher’s class, they send what section 2.9 describes, and only when the pupil presses Send to my teacher.

13. Changes to This Privacy Policy

When this policy changes materially — a new kind of data, a new recipient, a new purpose — we update the effective date at the top and describe the change on this page rather than replacing it silently. Where a change requires your consent, we will ask before it takes effect.

Material changes

• On 1 November 2026 we began removing ad click identifiers from page addresses before a visit is counted, keeping only which ad network the visit came from (section 2.3), and began counting when a test run reaches a quarter, a half and three quarters of its questions. We also changed the tag on shared links: they now carry utm_source=share, utm_medium=share, a fixed campaign name (mindatlas-202611-share) and the channel you chose as utm_content, and no longer name the test in the tag; the tag never carries your answers, scores or results.
• On 30 October 2026 we added page-link sharing, including on adult health pages. The shared text contains no result or answers. We record the share button and its location on the page.
• On 1 November 2026 links shared from a result on the main ability, English and personality tests began to name the result’s band in words (for example “Strong result”), never the exact score or answers, so a preview can show it (section 2.8); share analytics now also record whether you were signed in, the seconds since the result appeared and the band.
• On 1 November 2026 an unfinished test began to be kept in this browser for up to 48 hours instead of in the tab until it closed, and the keep was extended to the Norway-format practice, the English level test and questionnaires that are not about health, so that you can continue where you left off (sections 2.1, 8 and 9 and the cookies page). Health-related tests are never kept.
• On 29 October 2026 we clarified browser-storage, team and challenge grading, session-replay and current advertising descriptions, and reorganized this change history. Collection settings and provider behavior did not change.

14. Contact Us

MyTestAtlas — support@mytestatlas.com. A person answers privacy requests. If you are in the EEA or the UK and are not satisfied with our response, you may lodge a complaint with your local supervisory authority.