Privacy Policy

What we store

We store account details, answers, results, and the choices needed to provide the service and keep your progress available.

Data categories and purposes

Account and security: your email address, language and regional preferences, account dates, policy acceptance records, single-use email-code records, and login-session records. These support registration, authentication, account security, and your service preferences.

Assessments and reports: your answers, progress, question-set version, assessment length, calculated scores, archetype, and saved reports. These support resuming an assessment, consistent scoring, and retrieving your results.

Orders and access: the selected plan, payment country, currency, amount, payment status, provider references, and access start, expiry or revocation records. We also keep payment-event references to prevent duplicate processing and reconcile refunds.

Support and technical records: messages you send us and records needed to investigate errors, misuse or payment issues. Hosting and security services may process your IP address, browser information, request time and requested URL to deliver and protect the service.

We use information to provide the service you request, maintain security, respond to requests and meet applicable obligations. Where consent is legally required for an optional use, we must obtain it separately; purchasing a report is not consent to unrelated marketing.

Payments and card details

When payments are enabled, card or wallet credentials are entered with the payment provider, not in TooReal assessment forms. We keep order and payment references, not full card numbers, card security codes or wallet passwords.

Cookies and browser storage

When account sign-in is enabled, the tr_session cookie contains a random login token and normally expires after 30 days. It is marked Secure and HttpOnly, so it is sent over HTTPS and cannot be read by page scripts. Signing out removes the session cookie.

Local storage remembers assessment answers and progress, question-set version, language, payment-country and plan choices, and assessment or report references. It can remain after you close the browser, without a fixed expiry. Session storage also holds temporary checkout information for the current browser session.

Clearing site data removes the browser copy and may erase unfinished progress. It does not delete records already saved to your account. Signing out alone does not clear all locally stored answers; clear site data when using a shared device.

The current site does not embed advertising or behavioural analytics trackers. Payment providers may use their own cookies or similar technologies on their checkout pages under their own policies.

Service providers and international processing

Core account, assessment, report and order data is stored on Alibaba Cloud infrastructure in mainland China. The international frontend uses Cloudflare for delivery and security; connection information may be processed through its global network. Using the service from another country can therefore involve transferring information to China and other places where these providers operate.

When payment is available, mainland China purchases use WeChat Pay and overseas purchases use Stripe. These providers process the information required to complete a transaction and may have independent legal obligations. Their privacy notices apply to their own processing.

We do not sell personal information. We disclose information to service providers as needed for their role, to comply with valid legal requirements, or to investigate fraud and protect rights. This page does not replace any separate notice or consent that applicable law requires for a particular transfer.

Retention, deletion and security

Account-linked answers and reports remain available for ongoing use unless you request deletion or another retention requirement applies. They are not automatically deleted when you close the page. We retain transaction, security and support records as needed for refunds, accounting, disputes and applicable legal obligations.

A deletion request may not remove records that we must lawfully retain. Restricted backup copies may persist until their normal rotation. We will explain any material retention exception when handling your request; we do not promise immediate deletion from every backup.

We use HTTPS, password hashing, access checks and restricted database access. No storage or transmission system is risk-free. A PDF exported from your report is generated in your browser; you control the downloaded copy and anyone you share it with.

Your rights

You can ask what data we hold, request correction or deletion, or contact us with a privacy question at hello@tooreal.me.

How to make a privacy request

Contact us from your account email where possible and describe whether you want access, a copy, correction, deletion, or withdrawal of consent. Depending on your location, you may also have rights to restrict or object to processing, data portability, or complain to a competent authority.

We may ask for information proportionate to verifying account ownership, but never your password or full card number. Requests require review; submitting one is not proof that deletion or export has finished. We will respond within the period required by applicable law and explain any limitation.

Withdrawing consent does not undo processing already lawfully performed. Removing data needed to supply a feature can make that feature unavailable. Deleting an account and requesting a refund are separate requests; tell us if you need both.

Young users and policy changes

If you are below the age at which you can consent to data processing or enter a service agreement in your location, involve your parent or guardian where required. A parent or guardian may contact us about information supplied by a child.

We update this page and its date when practices change. Material changes requiring notice or renewed consent will be handled as required by applicable law. For privacy questions, email hello@tooreal.me.