Privacy

Marketing-site analytics events. When you visit the marketing site (this site, contrastscreen.com), PostHog records page views, clicks on “Take the test” buttons, FAQ expansions, and similar navigation signals. The events do not include your name, email, or any input you typed. The switch is under Your rights below: one click turns PostHog off, immediately, on both apps.

Session recordings. PostHog records how pages are used — scrolling, clicks, and the screens of the test — on both the site and the test app, so one recording follows a visit from the site into a test. Everything you type is masked before it leaves your browser, and the recordings are used to see where people get stuck, not to identify anyone.

Your test results. Every completed test is saved to your account: the test mode (full; results from the retired quick check keep their own label), the threshold and log-CS value at each spatial frequency with the number of trials behind it, the AULCSF summary, the calibration values (pixel pitch, viewing distance, and display gamma, plus how each was measured), and timestamps. Not stored: your individual per-trial answers, the stimulus images, or anything about your device beyond those calibration numbers. Results live in a private store on Vercel (Vercel Blob) under your account id; nothing in it records IP addresses or user agents. This browser keeps a backup while a result is waiting to save and a cache of reports you open. Deleting a result from My results removes it from your account history. Browser backups and cached copies can remain until you clear site data. Account results are otherwise kept until you delete them or the account. The account also keeps a count of tests taken, which is how the free first test works; deleting a result does not change it.

Test-app analytics events. On the test app at test.contrastscreen.com, PostHog receives events such as test started, calibration complete, staircase complete, and test complete, with the resulting numbers (threshold contrast, log-CS, area under the curve). Analytics is on by default; you can turn it off at any time with the switch on this page (the two apps share one setting), and if your browser has Do Not Track enabled, analytics stays off automatically. Your per-trial answers never leave your device either way, and analytics is not how a result reaches your account — that is the results sync described above.

Email addresses (only if you give us one). “Email my results” goes to your account’s own address. If you sign up for notes by email (on this site or on the results screen), we store that address to send you what you asked for. If you share a result or your history with a provider, their address is used for that one email and not kept. List addresses are kept in our storage and, when one is connected, in our email provider’s contact list; every list email carries a one-click unsubscribe link, and you can ask us to delete the address entirely. After you create an account we also send a few short notes over the first weeks — a reminder to take the free test, and why a retest every 2 weeks matters — each with a one-click unsubscribe that stops them for good; the switch is on your account page too. We do not subscribe you to anything else.

Account information. Taking the test needs an account. Clerk stores your email and password (Clerk handles password storage — we never see your password); we file your stored results under the account id Clerk gives us. If you buy unlimited, Stripe stores your payment information directly; we receive only an indicator that the payment succeeded.

Standard server logs. Our hosting provider (Vercel) records request URLs, IP addresses, and user agents in short-term access logs for security, debugging, and uptime. We do not use these logs to identify individual visitors or to build advertising profiles.

We do not use third-party advertising or cross-site tracking cookies. PostHog drops a single first-party cookie to give each visitor a stable, anonymous ID across page loads — this is what lets a “test started” event and a “test complete” event come from the same browser show up as a single funnel entry rather than two unrelated visits. The cookie is scoped to our own domain and shared between the marketing site and the test app (both live under contrastscreen.com), so both apps see the same anonymous visitor. It carries no personal information. If you use the footer control to turn analytics off (or back on), a second small first-party cookie, vcs_analytics_consent, records that choice on the same domain so this site and the test app both respect it; it holds only the word “no” or “yes”.

We also store small bits of state in your browser’s localStorage (which is local to your device — we never read it from a server). The kinds of things stored:

• Your analytics opt-out choice, if you've made one, so it sticks across visits (the same choice is kept in the vcs_analytics_consent cookie so this site and the test app agree).
• First-touch and last-touch UTM parameters (where you came from), so we can tell if a particular blog post or ad is helping people find us.
• A private backup of pending test results and a cache of reports you open — calibration values, thresholds, and result curves. Pending saves retry when you return or reconnect; My results is your account history.
• Your sign-in pass for the test app, so it knows which account to save results to.
• Whether you've dismissed the privacy assurance banner.
• If you choose to share a result, the share link metadata so you can find it again.

You can clear all of this by clearing your browser’s site data for our domains.

Delete a result. Every result has a Delete button in the test app’s results list. That removes it from your account and from that browser. Clearing your browser’s site data for our domains removes the local copies, the analytics cookie, and the rest of the values described above — but not the results saved to your account.

Delete your account. Email us from the address on the account. We will remove the account and every result stored against it within 30 days, except where retention is required for a Stripe-related financial record.

For EEA / UK visitors (GDPR-style rights). You have rights of access, rectification, erasure, restriction, portability, and objection regarding your personal data, where applicable. Our lawful basis for processing analytics is legitimate interest in understanding aggregate product usage (analytics runs by default, with an opt-out on both apps and automatic respect for Do Not Track); for account data, it is the contract you enter when you create an account. You can object to the analytics processing at any time by using the opt-out. Email the contact below to exercise any of these rights.

For California visitors (CCPA / CPRA-style rights). You have the right to know what personal information we collect, to request its deletion, and to opt out of any “sale” or “sharing.” We do not sell or share personal information for cross-context behavioral advertising. You can still ask us, in writing, to confirm and delete any data tied to your account.

Contrast Screen is a self-tracking and screening tool, not a medical device. It does not diagnose, treat, or cure any condition. Anything you do here is informational. Talk to a clinician about what your results might mean.

We are not a HIPAA-covered entity. Your test results are not a medical record; they are stored against your account, and you can delete any of them at any time. If you share a result or your history with a clinician — by email, a PDF, or a read-only link — that copy is governed by whatever privacy practices your clinician uses, not ours.

Questions about this policy, or a request to exercise the rights described above, can go to privacy@contrastscreen.com.