Legal

Privacy

Last updated 2 November 2026. This page describes the data true16 actually keeps.

What you give us

• An email address and a password, if you create an account that way. We store the password as a salted hash, not as the password itself. We email that address to confirm it, to send a login link or a 6-digit code you asked for, and to reset a password. If you ask to log in and the address has no account, we email it once to say so and include a link to create one. We send marketing email only if you ticked the box asking for it, we record when you did, and you can withdraw that at any time from the link in any such email. Withdrawing it does not affect your account or your plan.
• If you sign in with Google or Apple, we receive the email address that provider shares and treat it as confirmed. We do not receive a password from them.
• Your responses, long enough to score the inquiry. An unfinished inquiry stays in this browser. We do not keep a copy of each individual response on the server. If you are signed in when you finish, your archive keeps the portrait: the inquiry, the archetype or score, and the date.
• Messages you send from the contact page.

What we store about the account

• Whether the account is on the free tier or an active membership.
• The portraits you complete while signed in, so you can open them again.
• A Stripe customer id and subscription id, once you pay.
• A session cookie so you stay logged in.

Payments

Stripe charges the card. We do not store the card number, expiry, or security code. Stripe tells us whether the payment succeeded and which customer it belonged to.

Cookies

Details are on the cookie page. In short: one login cookie, and the browser’s own storage for an unfinished inquiry. We do not run an advertising or analytics cookie.

How it is used

To score the inquiries, keep you signed in, deliver your dossiers, answer a message you sent, and deal with fraud or a legal request. We do not sell personal data, and we never use your responses to make a decision about credit, housing, or employment.

How long

The account lasts until you delete it, or until we close it under the terms. Contact messages are kept long enough to answer them and then removed. Delete the account from the account page, or ask from the contact page using the email on the account.

Where it sits

The account database is on the server that hosts this site. Stripe processes the payment in their own systems, which may be outside your country. Card data is handled under Stripe’s terms. Google and Apple handle their own sign-in on their sites, then send us the email address.

Your request

You can ask to see, correct, or delete the account data we hold. Email is the key we look up. If a privacy law where you live gives you other rights, say so in the message and we will follow the ones that apply.