Privacy policy

Our privacy philosophy

Ramchirs is built on data minimization: we collect the least data that makes the product work, we tell you exactly what it is, and anonymous use is the default. This policy is written to be read, not to bury.

Anonymous screenings

When you take a screening without an account, your answers are scored entirely in your browser. They are stored only in your browser's local storage (to let you resume) and session storage (to show your results). They are never transmitted to our servers, never logged, never shared, and never used for advertising. If you download a PDF report anonymously, the report is generated from data sent in that single request and is not stored.

Accounts: what we store

If you create an account, we store:

• Account data: your email address, a salted scrypt hash of your password (we never store passwords in plain text), your display name (optional), your preferred language, and your email preferences.
• Consent records: the date and version of each consent you grant (terms, privacy, health-data processing, marketing).
• Assessment data — only what you explicitly save: anonymous screenings are never stored. When you sign in and explicitly choose to save a result, we store your responses, the derived scores, the instrument version, and the subject type. Saved results are stored under your account, encrypted in transit (TLS), accessible only to you and — for support requests you initiate — staff bound by confidentiality.
• Notes, reports, reminders: content you create in your dashboard, visible only to you.

We do not collect: government identifiers, precise geolocation, contacts, device fingerprints for tracking, or payment data (we take no payments).

Cookies and local storage

• Session cookie (ramchirs_session): httpOnly, SameSite=Lax, set only when you sign in. It contains a random token whose hash we store; it identifies your session, nothing else.
• Local storage: theme preference, language preference, advertising consent choice (if ads are enabled), and in-progress anonymous questionnaire answers (so you can resume).
• No advertising cookies are set and no ad network scripts load unless advertising is enabled for this deployment and you have granted consent. Advertising is never enabled on questionnaire, results, dashboard, account, PDF, crisis, or contact pages.

Analytics

We do not send assessment data, scores, answers, or page URLs containing personal data to any analytics service. If aggregate analytics are enabled, they are cookieless, IP-anonymized, and exclude all private pages.

Your rights

You can export all your data at any time (Dashboard → Profile → Export) and delete your account with one action (Dashboard → Profile → Delete). Deletion removes your account, sessions, consents, saved results, notes, reports, and reminders. Anonymous screenings were never stored, so there is nothing to delete there. Requests via the contact form are answered within 30 days at the latest.

Security

Passwords are hashed with scrypt (memory-hard, per-password salt). Session tokens are random 32-byte values stored only as SHA-256 hashes. All traffic is TLS-encrypted. Admin access to user data is role-restricted and audit-logged. We review security quarterly and publish material incidents.

Children

Ramchirs is not a service for children. Some instruments support parent/observer report about adolescents as designed by their publishers; this is educational screening, not clinical assessment of minors.

Changes

Material changes to this policy are announced on this page with an updated date and, for account holders, by email.