Privacy Policy

What data do we collect from the self-check tools?

The questionnaire code does not intentionally submit answers or scores. Questionnaire answers and scores, including those for the PHQ-9, GAD-7, AUDIT, and AUDIT-C, are processed locally using client-side JavaScript and are not intentionally sent to MindCheck Tools. Ordinary page requests are separate and can create hosting records.

We have deliberately built our tools this way because mental health screening calls for strong privacy safeguards. The assessment application has no configured endpoint or application-database write for questionnaire responses and does not intentionally submit them to MindCheck Tools, analytics, or advertising systems. Browser extensions, device software, shared-browser access, and any copy you deliberately create operate outside that application boundary.

Do you use cookies?

We use browser localStorage for the light/dark theme preference and for tools that need to preserve a journal or plan between visits. Those tools are the safety plan, CBT thought record, worry-time scheduler, daily recovery check-in, and sobriety calculator. Their pages display a local-storage notice before the interactive tool.

Browser-local entries are not intentionally transmitted to MindCheck Tools application servers, but they remain available to this browser profile until you use the tool's reset/delete control, clear site data, or the browser removes them. Anyone with access to the same browser profile may be able to read them. Use a private window or clear the tool on a shared device. Browser extensions, device software, screenshots, downloads, and backups are outside our control.

The following controls and optional third-party services may use browser storage on this site:

• MindCheck Tools privacy choices, our first-party consent control. It stores only your analytics and advertising choices in this browser.
• Google Analytics (GA4), anonymized usage analytics. Measurement ID: G-XKHQN1NJ2Z.
• Google AdSense, planned advertising provider. AdSense is not currently enabled because the site has not been approved to show ads.

You can manage your choices at any time through the Privacy Choices link in the site footer or through your browser settings.

What data is collected through analytics and advertising?

Google Analytics (GA4), when you consent, may process the following categories of information through cookies and standard web protocols on routes that are not classified as sensitive. Google AdSense was disabled at the last review and is protected by separate publisher, certified-CMP, strict-CSP, consent, and route-safety gates.

• Device and browser information: browser type, operating system, screen resolution, device type
• Network information: IP address used to transmit the request and approximate geographic region derived by Google, not precise location
• Usage data: sanitized page URL and path, page title, session timing, and the referring site's origin
• Cookie identifiers: pseudonymous identifiers set by Google Analytics after analytics consent

The application is not configured to add screening answers, scores, or results to this data. It does not intentionally send screening data to analytics or advertising systems. A local print or download that you deliberately create is outside those systems and is controlled by your browser, device, printer, and any sync or backup service you use.

You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on (available at tools.google.com/dlpage/gaoptout) or by using a browser extension that blocks tracking scripts.

Current application status: Google Analytics (measurement ID: G-XKHQN1NJ2Z) is available only after consent and is disabled on sensitive routes. Google's European-regulations message was verified published on August 2, 2026, but the AdSense site review was still "Getting ready." AdSense stays fail-closed unless publisher enablement, certified-CMP readiness, and strict-CSP readiness are all explicitly confirmed.

Hosting and technical request logs

Vercel hosts MindCheck Tools and may process ordinary request information such as IP address, browser and user-agent details, requested URL, timestamps, and security events. A requested URL can reveal which tool or topic page was visited, but screening answers, scores, journal entries, and locally saved plans are not placed in URLs or intentionally sent with those requests.

Infrastructure-log retention depends on provider settings, security needs, backups, and legal obligations. We do not promise zero logging or immediate deletion from every system. Sensitive tool pages use a no-referrer policy so the page path is not sent when you follow an external link.

Do you collect personal information?

We do not require an account, registration, or email address to use our tools. If you voluntarily subscribe to resource emails, we collect your email address and send it to Loops, our email service provider. We do not send Loops the screening tool you used, your answers, score, diagnosis, crisis information, or the page where you subscribed.

Authorized MindCheck Tools administrators and Loops, acting as our service provider, can access subscriber records as needed to operate the mailing list. We use the address only for the emails you consented to receive. Every marketing email includes an unsubscribe link. We do not sell subscriber information or share it for advertising.

If you contact us voluntarily, we receive the information you choose to include in your message. Please do not send screening answers or other sensitive health information by email.

Data retention

We retain data for the minimum period necessary:

• Screening answers and scores: Not retained by MindCheck Tools. In-memory responses are removed when you close, refresh, or reset the page. A printout or downloaded reflection that you deliberately create is a separate local copy and remains until you or the relevant device/service deletes it.
• Browser-local journals and tool data: Retained in your browser until you delete/reset it, clear site data, or the browser removes it. MindCheck Tools cannot retrieve or delete data that remains only on your device.
• Privacy choices: Stored in this browser until you change them or clear site data. The choice itself is not sent to a consent-management provider.
• Google Analytics data: Retention follows the configured Google Analytics property setting and Google's service rules. The current account-side setting cannot be verified from public application code; you may request the current period at privacy@mindchecktools.com.
• Newsletter email address: Retained while you are subscribed or until it is no longer needed for the mailing list. You may unsubscribe from any email or request deletion at privacy@mindchecktools.com. Loops may retain limited suppression, security, backup, or legal records under its own obligations; we do not promise immediate deletion from every backup.
• Contact emails: Retained only as long as necessary to respond to your inquiry, then deleted.
• Dark mode preference: Stored in your browser's localStorage indefinitely until you clear browser data.
• Hosting and security logs: Retention follows Vercel settings and legitimate security, backup, and legal requirements; it may change and is not represented as zero retention.

Advertising

Google AdSense (publisher ID: ca-pub-7171402107622932) is configured as a possible advertising provider but was not active at the last review. Application code requires explicit publisher enablement, certified-CMP readiness, and strict-CSP readiness before the AdSense runtime can load.

The application is not configured to pass screening answers, scores, results, or browser-local tool entries to advertising systems. A copy you deliberately create is controlled by your browser, device, and any service you use with that copy. If advertising is enabled, MindCheck Tools requests non-personalized ads, requires an affirmative advertising choice, and excludes sensitive routes. Non-personalized ads can still use cookies or device identifiers for purposes such as frequency capping and aggregated reporting, which is why the advertising service remains consent-gated.

Ads are never placed adjacent to crisis resources (988 Suicide & Crisis Lifeline, Crisis Text Line, SAMHSA Helpline). We will never place ads in a way that exploits distress or interferes with access to help.

You can opt out of personalized advertising by visiting My Ad Center or the Digital Advertising Alliance opt-out portal.

Reflection summaries

Our screening tools offer a "Download Reflection Summary" feature that generates a summary of your results as an HTML file using client-side JavaScript. The application does not automatically upload the summary, answers, or score to a MindCheck Tools server or application database. Your browser creates the file locally, and your browser, device, downloads folder, and any sync or backup service you use may retain or process it.

A downloaded or printed summary can contain sensitive information. It may be accessible to other people using the device and may be processed by browser downloads, printers, cloud sync, backups, security software, or any app you choose to open it with. Tool-link sharing on MindCheck Tools is deliberately limited to the public tool name and canonical page URL; it does not include answers, scores, ratings, result labels, or summaries.

Third-party links

Our site may link to external resources such as crisis hotlines, professional organizations, and educational materials. These external sites have their own privacy policies. We are not responsible for their content or data practices, but we only link to resources we believe are reputable.

Some therapist links are affiliate links, which means we may earn a commission if you sign up. These links are configured not to send the referring page. We do not add your screening answers, score, diagnosis, crisis information, email address, or other identifiers to an affiliate link. The external provider may collect information after you choose to visit its site under its own privacy policy.

Children's privacy

MindCheck Tools is a general-audience educational site. Any youth-oriented tool identifies its intended age range and should be used with a parent, guardian, or qualified professional when appropriate. The application processes screening answers locally and does not automatically send them to a MindCheck Tools server or application database; a screenshot, printout, download, or other copy a user creates is controlled by that user's browser, device, and chosen services. Subscription forms are suppressed on sensitive interactive routes. Children under 13 should not submit an email address or contact message. If you are a parent or guardian and believe a child provided personal information, contact privacy@mindchecktools.com so we can investigate and address it.

Data security

Assessment code does not automatically send questionnaire responses to a MindCheck Tools server or save them in an application database, so MindCheck Tools does not maintain an application database of those answers. Browser-local tool entries and user-created screenshots, printouts, or downloads can remain on a browser, device, printer, sync service, or backup. The site is served over HTTPS and uses restrictive response headers, a content security policy, no-store controls on sensitive routes and API responses, and dependency review. No security measure can eliminate every risk, especially risks from a shared device, browser extension, downloaded file, or software outside our control.

Your rights

Depending on where you live, you have specific rights regarding your personal data:

GDPR (EEA/UK residents)

Under the General Data Protection Regulation, you have the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data. We rely on your affirmative choice in our first-party privacy control before enabling analytics or advertising storage.

GDPR Article 9, Special category data: Health data is classified as special category data under Article 9 of the GDPR. Screening results are processed in your browser, and the application does not automatically send them to a MindCheck Tools server or application database. A screenshot, printout, download, or other copy you create is controlled by your browser, device, and chosen services. Newsletter subscriptions are deliberately separated from tool names, answers, scores, diagnoses, and crisis information.

Washington My Health My Data Act (MHMDA)

Washington law can treat reasonably linkable information that identifies a person's interest in seeking health care as consumer health data. MindCheck Tools does not collect questionnaire answers, scores, journal entries, or locally saved plans, but a requested health-topic path can appear in ordinary hosting data and consented public-page analytics. Our dedicated Consumer Health Data Privacy Notice describes the categories, purposes, sources, service providers, and request process we apply to that limited data.

Maryland Online Data Privacy Act (MODPA)

MODPA took effect October 1, 2025 and applies when its statutory processing thresholds and other requirements are met. It gives covered Maryland residents rights to access, correct, delete, and obtain a portable copy of personal data, plus rights to opt out of sale, targeted advertising, and certain profiling. It also restricts the sale and unnecessary processing of sensitive data.

Your rights under MODPA:

• Right to access the personal data we hold about you
• Right to correct inaccurate personal data
• Right to delete your personal data
• Right to opt out of targeted advertising and profiling
• Right to portability of your data in a machine-readable format

We honor the Global Privacy Control (GPC) browser signal by automatically suppressing optional analytics and advertising services; you do not need to interact with the privacy-choice dialog for those services to remain off. Ordinary hosting and security processing still occurs to deliver and protect the site.

We do not sell sensitive personal data. We also do not use consumer health data for targeted advertising or profiling.

To exercise your MODPA rights, contact us at privacy@mindchecktools.com. We respond within 45 days.

To exercise any GDPR rights, contact us at privacy@mindchecktools.com. We will respond within 30 days. For California privacy rights, see the dedicated section below.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you specific rights regarding your personal information. This section describes those rights and how to exercise them when the law applies, and the privacy controls we make available more broadly.

Information We Collect

In the past 12 months we have collected the following categories of personal information:

• Identifiers: Email address if you voluntarily subscribe, plus IP address, browser type, and consented analytics cookie identifiers.
• Internet or network activity: Requested paths, timestamps, response status, sanitized consented analytics page data, and referring-site origin.

Sensitive Personal Information

As of January 1, 2026, California law defines an expanded category of sensitive personal information. MindCheck Tools does not intentionally collect screening answers, scores, or browser-local journal entries through its application servers. Sensitive information under CPRA includes precise geolocation data, racial or ethnic origin, religious beliefs, union membership, contents of private communications, genetic data, biometric data, health or medical information, or sexual orientation. Mental health screening responses entered into our tools are processed locally and are not intentionally sent to our servers or shared with any third party, including advertising systems. A local print or download that you deliberately create is controlled by your device and chosen services.

Data Minimization

We collect only the minimum personal information necessary to operate this service. We do not collect personal information beyond what is reasonably necessary and proportionate to the purposes disclosed in this policy.

How We Use Your Information

• To display non-personalized advertising through Google AdSense after approval and consent, if advertising is enabled in the future
• To analyze site traffic and improve user experience via analytics
• To maintain site security and prevent fraud
• To send occasional resource emails when a subscriber has expressly consented

We do not sell your personal information and do not use consumer health data for cross-context behavioral advertising.

Your Rights as a California Resident

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: You may request deletion of personal information we have collected, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out: You may opt out of the sale or sharing of your personal information. We do not sell personal information. You may also opt out via a Global Privacy Control (GPC) signal from your browser, which we honor automatically.
• Right to Limit Use of Sensitive Information: You may direct us to limit our use and disclosure of sensitive personal information to purposes necessary to provide the service.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.

Do Not Sell or Share My Personal Information

We do not sell personal information. To opt out of sharing for advertising purposes, you may use a Global Privacy Control (GPC)-enabled browser. Our first-party Privacy Choices control also provides separate analytics and advertising choices.

How to Submit a Request

To exercise your California privacy rights, contact us via the Contact page. We will respond within 45 days. We may need to verify your identity before processing your request.

Data Retention

Screening responses are not retained because processing is client-side only. Browser-local journal and planning data remains on the device until the visitor deletes it. Analytics and server-log retention follow the periods described above and our configured service settings. Newsletter addresses are retained while subscribed or until no longer needed, subject to the limited provider records described above.

Additional U.S. State Privacy Rights

U.S. state privacy laws have different coverage thresholds, exemptions, and request procedures. Where an applicable law gives you rights to access, correct, delete, or obtain a portable copy of personal data, or to opt out of sale, targeted advertising, or qualifying profiling, you may submit a request through the Contact pageor email privacy@mindchecktools.com. We will authenticate and respond within the period required by the applicable law.

Regardless of location, our Privacy Choices control can keep optional analytics and advertising off. We honor Global Privacy Control by disabling both optional services, do not sell personal information, and do not use consumer health data for targeted advertising.

Related policies

For more details, see our Consumer Health Data Privacy Notice (health-topic request and service data), Cookie Policy (browser storage and choices), and Terms of Use (use limitations and legal terms).

Changes to this policy

If we make material changes to this privacy policy, particularly if we begin collecting any data we do not currently collect, we will update the "Last updated" date at the top of this page. For significant changes, we will also add a notice on the homepage.

Contact

If you have questions about this privacy policy or how our tools work, you can reach us at:

Email: privacy@mindchecktools.com