A mirror, not a surveillance camera.

What we know about you

Without registration we're practically blind — we see an anonymous token (UUID in your browser) and your test answers. That's it. Without the token, even we can't retrieve your result afterwards.

If you created an account, we also have your email (password only as a bcrypt hash) and optional profile data — age, country, annual mileage, vehicle type. You fill in only what you want.

We have:

• Anonymous result token
• Email (only if you have an account)
• Test answers
• Reaction times, optionally lap times
• Score, tier, calibration
• IP /24 for 90 days (anti-abuse)
• Unfinished anonymous test — 14 days, then gone

We don't have:

• First or last name
• Phone or address
• Date of birth (only cohort)
• Device fingerprint
• Geolocation
• Health data

Where it physically lives

Your data doesn't sit in a cloud that disappears when the CEO changes. It sits in one region — Frankfurt — and we know which one.

The only exception outside the EU is Resend (USA) — the service that delivers your result by email and the 14-day re-test reminder. The transfer is covered by standard contractual clauses (SCC 2021/914) and Resend is in the EU-U.S. Data Privacy Framework. The second exception is Anthropic (USA) — only when open-ended answer scoring is enabled, which it is not in Beta. No other transfer outside the EEA.

What we do with it

Four things, nothing else:

• We evaluate your test — we return your S-Score, P-Score, tier and calibration signal. This is why you came here.
• We send you the result by email — only if you enabled this in settings. The default is "no".
• We remind you of a re-test after 14 days — again opt-in. One button to turn it off forever.
• We add your tier to the population norm — helps calibrate tiers for others. Only the tier, calibration and age cohort — no answers, no IP. It cannot be linked to you.

No profiling for insurance companies. No selling to employers. No advertising retargeting. If someone in the future starts doing that, we will no longer be us.

Your right, our obligation

GDPR gives you seven specific rights. We process requests within 30 days, most within five working days. An email is enough — no forms, no notarisation.

Cookies — the boring version

No third parties. No Google Analytics, no Facebook pixel, no Hotjar. The cookies we have serve exclusively to make the application work — session, anonymous token, CSRF.

If we introduce privacy-friendly analytics in the future (for example Plausible or self-hosted Matomo), we'll add a cookie banner with opt-in. Until then, no banner-requiring cookies exist. Details in the Cookie Policy.

Who we are and how to reach us

The data controller under GDPR is DriverRank s.r.o., registered in Bratislava. Full identification details (company number, registration court) are in the full privacy policy.

Questions or requests go to privacy@mydriverrank.com. Security findings to security@mydriverrank.com — responsible disclosure welcome. We respond within 5 working days on average, within 30 days in the worst case.