隱私權政策

MOSAIC-48 is built so that there is no personal data to protect in the first place. There are no accounts, no sign-in, and no fields asking for your name or email address. The one exception: if you purchase the paid profile, you enter your email address on the checkout run by Polar, the merchant of record (see section 8).

This policy explains which personal data we do not collect, the small amount of aggregate information our analytics receives, and how to stop even that.

1. Personal data we collect: none

• No accounts, no registration, no sign-in.
• No name, email address, phone number, date of birth, or any other identifying information.
• Payments are handled by Polar Software Inc. as the merchant of record, on Polar’s own checkout. Nothing you enter there — email or payment details — reaches our servers (see section 8).

The assessment writes your item responses, response times, Composite Cognitive Index, eight domain scores, and thinking type to your browser’s local storage so it can display your result again. Scoring happens entirely inside your browser.

Clearing your browser storage or switching browsers removes the result saved in that browser permanently. The service cannot restore it for you.

2. Analytics

To understand which pages are actually read, we use Umami, a privacy-focused analytics tool operated by Umami Software, Inc. and processed in an EU region.

We do not use cookies or any persistent identifiers for analytics. No visitor ID is generated or stored, so return visits are not linked to earlier ones and you are not tracked across other websites.

What is sent when you open a page:

• The URL of the page being viewed
• The referring URL that brought you here
• Browser and operating system type
• Screen size
• Approximate country

What analytics never receives:

• Your answers to any item
• Your response times
• Your Composite Cognitive Index, domain scores, or thinking type

About IP addresses. Any internet request necessarily reaches the analytics server with an IP address attached. It is not stored. It is used only to derive an approximate country and is then discarded, never retained in a form that identifies you.

Purpose. We use these aggregate counts for one thing: deciding which pages to improve, rewrite, or remove, and checking that layouts hold up at the screen sizes people actually use. They are not used for advertising, profiling, or resale.

3. Other services involved in delivering this site

The personal-data relationships with these providers are limited to what the table describes.

4. Your rights — and the honest limits of them

Depending on where you live, you may have rights to access, correct, delete, restrict, or port your personal data, and to lodge a complaint with a supervisory authority.

We want to be straightforward about how those rights apply here. We hold no identifier that could link any record to you. Analytics data arrives without a visitor ID and is stored only in aggregate form, so we cannot locate "your" data, produce a copy of it, correct it, or delete it selectively — not as a matter of policy, but because the information required to do so does not exist and we deliberately never created it. Under the GDPR this is the situation described in Article 11: where a controller cannot identify a data subject, the access, rectification, erasure, and portability rights do not apply. You may of course still demonstrate additional information that makes identification possible, but nothing in our system is designed to enable that.

The data you can control completely is the assessment data on your own device. Clearing this site’s data in your browser settings erases it immediately and irreversibly, with no request to us required.

For anything else, contact us at 開發者電子郵件.

5. How to opt out of analytics

Because we set no cookies, blocking cookies alone will not stop analytics. These will:

1. Install a content or tracker blocker such as uBlock Origin. The analytics script is blocked and nothing is sent.
2. Turn on your browser’s built-in tracking protection (Safari Intelligent Tracking Prevention, Brave Shields, Firefox Enhanced Tracking Protection) at a strict setting.
3. Disable JavaScript for this site. Note that the assessment itself will not run in this case.

Options 1 and 2 have no effect on taking the assessment, scoring, or viewing your results.

6. Children

This service is not directed at children. We collect no personal data, so no parental consent mechanism exists. Separately, the items and the reference distribution assume adult respondents: results from a child are not meaningfully interpretable and should not be treated as a measure of a child’s ability. If a child uses the assessment, we recommend a guardian’s supervision.

7. Security

Not creating personal identifiers is the strongest protection we can offer. In addition:

• All traffic is served over HTTPS.
• Scoring and result generation happen in your browser.
• Analytics is limited to tools that create no personal identifier.

8. Payments

Purchases of the paid profile are processed by Polar Software Inc. ("Polar") as the merchant of record. You transact directly with Polar on its checkout; our servers never receive or store your payment details.

• Whatever you enter on Polar’s checkout (email address, payment method, billing details) is processed by Polar under its own privacy policy: polar.sh/legal/privacy-policy
• Card payments are processed through Polar’s payment processor, Stripe, Inc.
• To manage orders and refunds, the operator can view order records (order id, date, amount, buyer email address) in Polar’s dashboard, and uses them for no other purpose.
• Your unlocked status is stored only in your browser. We keep no account and no server-side purchase record, so clearing browser storage also clears the unlock.

If your payment fails or your results do not appear after purchase, email 開發者電子郵件 and we will refund you in full after verification. Refunds are returned via Polar to your original payment method.

9. Changes to this policy

Material changes will be posted on this page with an effective date. Changes that reduce your protections will be announced at least 30 days in advance.

• Operator: MOSAIC-48
• Effective date: 2026-07-25
• Contact: 開發者電子郵件

10. If you are in the EEA, Switzerland, or the UK

The GDPR, the Swiss FADP, or the UK GDPR may apply to the limited processing described above. Legal basis: server logs and the aggregate analytics in section 2 rest on our legitimate interests (Art. 6(1)(f)) in serving the site and seeing which pages are read; the paid profile rests on performance of a contract (Art. 6(1)(b)). What tips the balancing test is that none of this carries an identifier, and none of it is used for advertising, profiling, or resale.

Retention and transfers. We hold no personal data ourselves, so nothing on our side has a retention period. The providers in section 3 keep what is listed against them — analytics counts while the site runs, server logs for a short operational window, order records for as long as tax law requires. Hosting, the merchant of record, and its payment processor are established in the United States; those transfers rely on each provider’s safeguards, whether EU–US Data Privacy Framework certification or the European Commission’s Standard Contractual Clauses (Art. 46(2)(c)).

You may object at any time to processing based on our legitimate interests, including the analytics in section 2 (Art. 21). You need no reason and you do not need us: section 5 lists three ways to stop analytics from your own browser, each effective immediately.

You may also lodge a complaint with a supervisory authority where you live, where you work, or where you think the problem arose. The European Data Protection Board publishes the list at edpb.europa.eu. You do not have to contact us first.

Automated decision-making. This is an assessment that builds a cognitive profile, so the question deserves a direct answer: scoring runs entirely in your browser, and the operator does not use anonymous response records to make decisions about a particular person. We make no automated decision about you and carry out no profiling within the meaning of Art. 22. There is no account for a result to attach to.

The controller is MOSAIC-48, reachable at 開發者電子郵件. No data protection officer is designated; none of the conditions in Art. 37(1) applies.

No representative in the Union has been designated. The operator treats the processing described here — no identifier, no special categories of data, and limited processing — as covered by the exemption in Art. 27(2)(a). If that stops being true, a representative will be designated and named here.

Google AdSense 廣告與同意管理

我們在一般內容頁面使用 Google AdSense（Google LLC）刊登廣告，並驗證網站擁有權與廣告資格。Google 及第三方廣告供應商可能會存取 Cookie，並處理網路信標、IP 位址、裝置或廣告識別碼等資訊，用於廣告刊登、頻率限制、個人化廣告（經同意）、成效衡量及防止詐欺或濫用。

Google 如何使用所傳輸的資訊，請參閱使用 Google 服務的網站或應用程式之資訊處理方式。第三方供應商也可能存取 Cookie，或使用網路信標及類似技術衡量廣告刊登。

測驗答案、每題作答時間、綜合認知指數、領域分數與思考類型不會傳送給 Google 或廣告供應商。

在 /test、/test/mosaic96、/result、/report 及其各語言版本中不會載入 AdSense 指令碼，也不會刊登廣告。

歐洲使用者的同意

在歐洲經濟區（EEA）、英國與瑞士，我們會顯示經 Google 認證的同意管理平台（CMP）。您可以同意、拒絕或管理選項。需要同意的廣告 Cookie、識別碼及個人化廣告，只會依您的選擇使用；之後可在 CMP 中變更。

廣告設定與退出

您可在廣告設定中管理 Google 個人化廣告，並透過 AboutAds退出參與的第三方供應商 Cookie。瀏覽器封鎖第三方 Cookie 後仍可能顯示非個人化廣告。

本政策其他位置所稱「我們不使用 Cookie 或廣告識別碼」，僅指無 Cookie 的 Umami 分析及我們自身的處理。Google AdSense 的處理以本節為準。

About the assessment itself

MOSAIC-48 is a non-clinical instrument intended for education and self-understanding. It is not a medical diagnosis. Scores are estimates computed against an internal reference distribution, not formally normed certified scores, and must not be used for medical or clinical diagnosis or for hiring and selection decisions. If you have concerns about your cognitive functioning, please consult a qualified professional.

Last reviewed: 2026-07