CognaType

Privacy

Last updated 15 October 2026

Who is responsible

CognaType is run by a small team. Right now that team is one person, Jody, and it grows with the help of the people using it. For anything on this page, including a request to see or delete your data, write to support at cognatype dot com.

What is collected

When you sign in

When you choose Google sign-in, CognaType asks Google for two things only: your email address and your basic profile, which is your name and your Google account identifier. That is the whole request. CognaType has no access to your Gmail, Drive, contacts, calendar, photos or anything else in your Google account, and it cannot gain that access without asking you again on a new consent screen.

Email-code sign-in sends a short-lived, single-use code to the address you enter. Supabase verifies the code and manages your account and signed-in session. Resend delivers that email and receives your address and the code. Your mailbox provider also handles the email. A code is needed when you sign in again, not on every visit while your session remains active.

New authenticator setup is currently unavailable. When enabled in a future release, optional authenticator two-factor authentication stores the enrollment secret and factor details in Supabase Auth. CognaType displays the setup key and QR code during enrollment; it does not send them to an outside QR service or save them in browser storage. A verified authenticator applies to your account whether you sign in with Google or email. An unfinished setup does not turn it on.

What you tell it about yourself

CognaType exists to hold a picture of how your mind works and show it back to you, so most of what is stored is what you deliberately entered.

What	Stored because
Your chosen name, full name, pronouns, and the initials or emoji you pick as an avatar	So the site can address you the way you asked to be addressed
Your energy windows, reading-comfort choices, life context, what works for you, and your goals	These are the durable settings and self-authored parts of your profile
Your dated state check-ins, including capacity, a preset you chose, optional context and Mental, Physical, or Emotional detail, and the timezone used for that day's 4:00 AM boundary	So the Dashboard can remember what you reported today and, later, help you notice recurring patterns over time
Surveys you have taken, when you took them, and the scores and ranking each one produced. Your individual answers are kept only with research consent; see Survey answers and research below	So results can be produced and so you can see change over time
Which patterns you have claimed as yours	So the site knows which parts of the atlas you recognise in yourself
Feedback you send as a tester: your note, which part of the page it is about, a picture of that part of the page unless you remove it, and your screen settings at that moment (light or dark mode, text size, density, your tier, window size, the site version and your local time)	So a report can be traced back to exactly what you were looking at. Only CognaType's administrators can see feedback pictures; testers cannot, not even their own.
Notices in your account's notification bell: what each one says, when it arrived, and whether you have read or dismissed it	So CognaType can tell you when your feedback has been dealt with, send you messages from CognaType, and so you can tell what you have already seen. Every notice, including one you dismiss, is kept for 12 months after it arrives and then deleted. Notices are part of having an account and need no separate consent. They are emailed to you only if you turn on email copies in your account.
If you turn on email copies of your notices: when you agreed, the words you agreed to, and when you turned it off	So we only email you if you asked, and so there is a record of what you agreed to. Each email we send is kept for 30 days, then deleted.
An email address you type in to have results sent to you	So the results email can be sent. This is kept separately from your account
If you choose to hear about new surveys: that email address, the words you agreed to, when you agreed, and when it was added to CognaType's Substack list	So your address can be added to the New surveys list, and so there is a record of what you agreed to. See Survey announcements below
Your account tier, and whether you have allowed your data to be used for improving the model	Your tier is managed by CognaType and is not browser-editable. The model-improvement choice defaults off and remains a separate consent setting; it is not the planned Research mode.

What is never collected

Some things are off the table permanently, not merely absent for now. CognaType carries no advertising, no tracking pixels, no session recording, and no third party marketing cookies. There is no Meta pixel and no ad network of any kind. Nothing you do here is used to target you, on this site or anywhere else.

The commitment is specific and worth saying in plain words: the goal is never to market things at you. It is to understand the community and improve the site around what that community actually needs.

Understanding how CognaType is used

CognaType is a research project as well as a website, so it does look at how the atlas is being used, in aggregate. That work is the point of the thing, and pretending otherwise would be dishonest.

Aggregate means questions about many people at once, never about you:

• Which patterns do people recognise in themselves most often?
• Do people who express one trait strongly tend to express some other trait weakly?
• Which parts of the atlas do people reach for, and which never get read?

Answers to those questions make the underlying model more accurate and the site more useful. They are reported and used as counts and distributions. Nothing in that work identifies you, and no result is ever tied back to a named person.

As of the date at the top of this page, none of this is switched on yet. There is currently no analytics package of any kind installed, not even a privacy-preserving one. It is described here because it is designed in, it is coming, and you should know about it before you sign up rather than discover it in a changed policy later.

There is a separate and stricter line for using your specific responses to refine the model itself. That is governed by a setting on your profile, described below, and it is off unless you turn it on.

Survey answers and research

CognaType gets better for everyone the more people take part in research: your responses are only ever used in aggregate, to improve the results every member sees.

Research is separate from Use my data, and the two work together: your consented responses join everyone else's for site-wide, community-wide pattern discovery, never on their own. That work has not started yet; your consent is what makes it possible.

Every time you finish a survey while signed in, CognaType keeps the result: the score each pattern received and the order they came out in. That record belongs to your account, it is what My Map shows you, and it goes when you clear your survey results or delete your account.

Your individual answers are different. They are kept only if Include me in research is switched on in Account & privacy at the moment you finish the survey. If it is off, the answers are used to work out your result and then discarded; nothing about them is stored. If it is on, a research copy of the take is stored under a pseudonymous participant key and, while the setting is on, linked to your account so it can be de-linked later. The key is what lets answers from your different takes be studied together.

If you later switch Include me in research off, the research copy is not deleted. It is de-linked: the connection to your account is removed and your participant key is replaced, so nothing you contribute after opting back in can be joined to what came before. Clearing your survey results from Account & privacy de-links in the same way. Deleting your account de-links in the same way.

Two honest limits. De-linking is not perfect anonymity in a small community. On de-link, the time of the take is reduced to its calendar day, so it can no longer be matched back to your own survey results by exact time. A response with an unusual pattern of answers could still, in principle, be recognised while your own copy exists, and clearing your survey results removes that possibility too. And because nothing ties a de-linked record back to you, CognaType cannot later show you those answers or delete them on request; the moment you opt in is the moment that matters. The version of this page in force when you finish a survey is stored with the research copy.

Survey announcements

If you choose "new surveys", we add your email address to the New surveys section of CognaType's Substack newsletter. Substack then sends those emails under its own privacy policy, and every email has an unsubscribe link. Turning off "New survey announcements" in your account stops us adding you; it does not remove an address already on Substack, so use the unsubscribe link for that.

Where your data lives

Your account and everything attached to it are stored in a Supabase project hosted on Amazon Web Services in the United States, in the US West region in Oregon. If you are outside the United States, using CognaType means your data is stored there.

The pages themselves are served by Netlify.

Who else can see it

CognaType does not sell your data, does not rent it, and does not share it for advertising. It never will; if that ever changes it will not be by quietly editing this page.

A small number of services necessarily handle data in order for the site to work at all:

• Google handles signing in when you choose Google. Google knows you signed into CognaType, in the same way it knows about any site you use Google to sign into.
• Supabase hosts the database and the authentication service. This is where your rows actually sit.
• Netlify serves the pages. Like any web server, it sees the IP address a request came from.
• Resend delivers email sign-in codes, the results email if you asked for one by typing your address in, and copies of your notices if you turned that on in your account. It receives the recipient address and email content for those deliveries. Resend states that email and log data on our Free plan are retained for 30 days. This is separate from the short lifetime of a sign-in code.
• Cloudflare Turnstile loads when you open the sign-in page and checks email-code requests for automated abuse, including if you later choose Google instead. Its check processes network and browser signals. See Cloudflare’s Turnstile privacy notice.
• Substack sends new-survey announcements, and only to addresses whose owners chose "new surveys". CognaType adds those addresses to its Substack list by hand; see Survey announcements above.
• An AI assistant. To work on a fix, Jody may paste feedback notes into an AI assistant (currently Claude, made by Anthropic), with the tester's first name and links to the pictures that stop working after 24 hours. No email address is written into what is pasted, but a picture taken on one of the administrator's own pages, such as the member list, can show members' names and email addresses.
• Google Fonts serves the typefaces. This one is easy to leave out of a privacy policy and it should not be: because the fonts load from Google's servers, Google receives your IP address when a CognaType page loads, whether or not you have an account and whether or not you are signed in.

Other people cannot read your data

Every table holding personal data has row level security switched on and forced, and every policy is scoped to the signed-in account. In plain terms: the database will not return your rows to another user even if the website asks it to. This is not a promise about how carefully the site is written. It is a rule the database applies underneath the site, which is the only kind of promise worth making.

An anonymous request for any of these tables is refused outright.

What is kept in your browser

CognaType stores a small amount of data in your browser's local storage. None of it is advertising related.

• sb-afathcrpfvbbvfhshggd-auth-token keeps you signed in so you do not have to sign in again on every page.
• One small key caches your feedback role. The site checks your current session and any enabled second factor before showing signed-in controls or reading member data.
• ct-reading-preferences caches your saved text size, line length, contrast, font, and reduced-motion choices for the signed-in account, so pages can apply them before the database read finishes. The database remains the authoritative copy.

Clearing your browser data removes all of these and signs you out. It does not delete your account.

Using your data to improve CognaType

There is a single setting on your profile that records whether you are willing to have your specific responses used to refine the underlying model. It is off unless you turn it on. While it is off, your individual responses are used to show you your own results and for nothing else.

This is a narrower thing than the aggregate counts described above. Aggregate statistics ask how many people recognised a pattern; the training setting is about your particular answers contributing to the model directly. If you would rather only the first ever happen, leaving this setting off is exactly how you say so.

Getting your data, and deleting it

You can download a full copy of everything CognaType holds about your account from Account & privacy. That export includes your profile and preferences, surveys, responses, Pattern claims, submitted feedback (feedback pictures are not in the download; write to support and they will be sent to you), owned email requests, dated state history, and the survey-announcement choices you made while signed in, your choices about email copies of notices and the notice emails sent in the last 30 days, and your notices.

You can also permanently delete your account from Account & privacy. Deletion removes the account, its profile and preferences, map records, claims, feedback, dated state history, email-request rows owned by that account, and survey-announcement choices made while signed in, your choices about email copies of notices, and your notices. An address already added to Substack stays there until you use its unsubscribe link. Feedback pictures are removed by a daily clean-up within two days of the account being deleted. Words from your feedback that were already copied into a work item or a request to make one, or pasted into the AI assistant, are not removed by deleting the account. It is not a flag or a hidden state, and it cannot be undone.

Resetting today's Capacity Companion is not deletion. Reset ends the active Dashboard state while preserving the dated report for export and future personal Trends. Account deletion removes that history.

How long it is kept

Your data is kept for as long as you have an account, and is deleted when you ask. Four things have a fixed schedule. A picture attached to a tester's feedback note is deleted 90 days after that note is closed; the note itself stays with the account. Every notice in your notification bell, including one you dismiss, is deleted 12 months after it arrives. A copy of a notice that we emailed you is deleted from CognaType 30 days after it was sent; the email in your own mailbox is yours. Where CognaType's administrators sent a message, the record of that send keeps only how many people it reached and how many read it, and no longer names you after 12 months.

Children

CognaType is not intended for children under 16, and accounts should not be created for them. If you believe a child has created an account, write to support at cognatype dot com and it will be removed.

This is beta software

CognaType is early and changes often. What it stores will change as features arrive. When that happens, this page changes in the same breath, and the date at the top moves. If something changes materially in how your data is handled, you will be told rather than left to notice.

Questions

Write to support at cognatype dot com. A real person reads it.

Terms of service