The Census · Privacy
Privacy Policy
This is the operative Article 13 layer referenced in the Terms of the Count: the full account of what Cognisentum collects, why, and what you can do about it. Controller for all personal data described here: Cognisentum ([email protected]), Romania.
What we collect
An account holds: your email address (used to authenticate you), your language preference, your Handle and an internal account identifier, your method, device preference and optional short device description, tap responses, rating and session scores, commitment and witness records, and the record of which remote-viewing images or dowsing image pairs you have been assigned (so none repeats). Sessions sealed while an optional 1-10 self-rating was still part of the flow retain that number. If you arrived through a recruitment link, the link's short reference code is stored on your account at signup, so we can tell which outreach brings readers who stay. If you join the commission waitlist, we hold the email address and language you submitted.
What we never collect
Your voice is never stored. Quick-mode sessions are tap-only; there is no audio input to record in the first place, so no recording of you exists anywhere, at any stage. In the EU and similar jurisdictions, detected from your browser's timezone, audience analytics (Google Analytics 4) and the Reddit conversion pixel load only after you accept them in the cookie banner, and declining keeps your browser from making any request to Google or Reddit. Elsewhere they run by default, and the Cookies control in the footer turns them off at any time.
Cookies & tokens
A signed session cookie keeps you signed in. Two preference cookies (cog_theme, NEXT_LOCALE) remember your display theme and language. A browser-only local preference (cog_voice_muted) remembers whether voice guidance is muted; it is not sent to Cognisentum. One-time magic-link tokens authenticate sign-in emails and expire after use or after fifteen minutes. If you choose Google sign-in, short-lived anti-forgery cookies hold the OAuth state, nonce, and PKCE verifier during the redirect and are cleared on return. Google Analytics and Reddit's conversion pixel run only if you accept them in the cookie banner in the EU and similar jurisdictions; everywhere else they run by default. Where they run, Google Analytics sets its own measurement cookies (_ga and _ga_G-BYGDE1W53S) to recognise returning visits, and, if you arrived from a Reddit ad, Reddit's conversion pixel sets its own cookie (_rdt_uuid) to measure whether that ad click led to a signup. A first-party cookie (cog_consent) records your choice either way, and Cookies in the footer lets you change that choice, including turning it off, at any time. Google Analytics cookies are not used to track you across other sites; the Reddit pixel's only purpose here is that one ad-to-signup match.
Why we process it
Email exists to sign you in and, only when you've asked for it, to notify you, for example about commission-waitlist openings. For email-link sign-in and requested notices, Resend processes the address and message. If you choose Google sign-in, Google confirms your verified email address. If you accept analytics, Google also processes the usual audience measurement data (pages viewed, approximate location from a truncated IP address, device and browser) as our processor; it receives nothing about your targets, responses or scores. Neither provider receives information about your sessions.
What's shown publicly
While the public leaderboard is paused, no account identity is displayed on public pages. Your Handle labels your private target and reveal screens, and your email address appears only in your signed-in account controls and Settings. Neither is visible to other readers or Requesters.
Your rights
You can access, correct, or export your data, and you can request erasure, at any time, by writing to [email protected]. Erasure deletes your account and identifying information; the sealed record of your past sessions' scores stays in the aggregate audit trail, pseudonymized, never linked back to you once your account is gone.
Retention
Account data is kept for as long as your account is open. Session scores and their pseudonymized audit trail are kept indefinitely as the platform's record, in line with the Terms of the Count. Magic-link tokens are deleted or ignored once they expire.
No identity checks in the pilot
We do not run KYC or identity verification during the pilot. Age is a self-attestation, not a document check.
Contact
Questions, requests, or complaints about this policy: [email protected].