Your answers are yours alone.

If you choose Google sign-in, Google learns that you are signing in to 16Kinks. We receive your verified email and Google account identifier, and keep them until you delete your account. We do not request access to Gmail, store Google access tokens, or send your answers or results to Google through sign-in. A Google-verified Gmail or Workspace address can connect to your existing account with the same email. You can still sign in by email.

This policy explains how 16Kinks handles data on this website. Because answers can reveal intimate sexual preferences, we treat them as sensitive data. Collection is purpose-limited and structured: the service, questionnaire research, account, payment-history and security datasets are kept separate. Questions or rights requests can be sent to support@16kinks.com.

No consent form stands in front of the questions. While you answer, the working answer set is held in your browser's session storage and is not sent to us. Once every question is answered, a notice directly above the result action explains that tapping it sends your sexual-preference answers to our server to provide the report. Nothing is sent automatically when you give the last answer; only that deliberate tap, which is your explicit consent, sends them to our server to validate, score and assemble the report you requested. If you leave before tapping it, your answers are never sent. The preview endpoint itself does not insert those choices into the database. Session storage normally lasts for the browser-tab session and is also cleared by the retake control.

The 16-question quick test is scored entirely in your browser. Its answers are held only in that tab's session storage and are never sent to our server, so it shows no consent notice. If you choose to continue to the full test, those answers are carried into it on your device and become part of that full-test attempt: they are sent only through the notice and result action described above, and the research choice for that attempt covers them like any other answer.

After your result appears, the result page offers a separate research choice with its own “Share” button. It is optional, nothing is pre-selected, and it covers only the attempt you just finished. Until you choose, the interaction data listed here is kept only in the page's memory; if you decline, reload, or leave before finishing or choosing, it is discarded without being sent. If you choose to share, our first-party research stream stores a random attempt ID; test, item, telemetry and consent-notice versions; consent time; locale; normalized internal referral category/path; coarse device, viewport and pointer classes; start/completion times; page durations; each question's entries into and exits from the visible area and answer timing; exact selected options and their change sequence; page navigation; foreground/background events; and completion. This lets us study hesitation, confusing questions, answer distributions and revision patterns. The research tables have no user ID, email, result ID, payment identifier, raw IP address or full User-Agent, and answers are not sent to Google Analytics, Sentry or application logs. Raw attempt, answer and event rows are deleted after 12 months. The withdrawal control on the result page deletes attempt IDs remembered in the current browser session sooner.

• Magic-link sign-in: we use your email address and expiring authentication tokens to send and complete sign-in. We do not store a password.
• Result draft: if you ask to save a result while signed out, we temporarily store the normalized email, complete answers and result metadata for up to 30 minutes so the same result can be claimed after cross-device sign-in. A successful claim consumes the draft.
• Saved result: when you deliberately save, we store under your account the complete answer snapshot, the server-computed scores together with the question-set and scoring versions used, the result and consent-notice versions and the creation time. The report text is usually written from these each time you open it; some results saved before 5 October 2026 are still shown with the report text generated when they were saved. These remain until you delete that result or the account.
• Legacy purchase rows: payments are disabled and the current beta collects no new payment data. An account created under an earlier version may still contain amount, currency, status and provider reference identifiers for historical support and audit. We never stored full card numbers.

• Saved-result sharing: only your explicit share action creates a public URL; saving a result or receiving its confirmation email does not. The public URL contains a random token; the database stores only its SHA-256 hash. A link expires after the configured period (30 days by default). Replacing or revoking it deletes the active row, and scheduled cleanup removes expired rows.
• Share picture and invite link: the share picture is drawn in your browser and leaves your device only if you save or send it yourself. An invite link contains only your four-letter type code, with no answers or identifiers, and is marked noindex so search engines do not list it. When someone opens it, the inviter's type code is kept only in that tab's session storage, to compare the two types on the device.
• Match: before swiping, each participant must actively tick a separate explicit-consent box. A Match session stores both participants' yes/maybe/no choices, the consent-notice version, a random session code, and one-way hashes of participant tokens. Raw participant tokens stay in each browser's local storage; a participant's reusable copy of their own choices is limited to that tab's session storage. A session expires after 7 days and scheduled cleanup deletes it and all answers. The in-product delete control removes a participant's answers earlier.
• Transactional email: when you request a sign-in or result confirmation, Resend receives the destination address and message necessary to deliver it. A result confirmation links to your authenticated saved-result page, not a public share. The public beta does not offer arbitrary-address Match email delivery or maintain a lead or marketing database.

Cloudflare necessarily processes request information such as IP address, headers, URL, timing and security signals to deliver and protect the site. It also evaluates the Turnstile challenge used for magic-link requests and maintains short-lived native rate-limit counters keyed by an IP address or a keyed email hash. We do not send questionnaire answers to Turnstile or use them as rate-limit keys. Application logs record structured operational events and deliberately exclude raw answer choices, full email addresses, request bodies and secret tokens. Infrastructure providers may retain limited request metadata under their security and operational settings.

• An essential cookie remembers that the 18+ age gate was acknowledged.
• Google Analytics sets its own cookie holding a randomly generated client ID, used to count returning visits. Turning analytics off on this page disables the tag and this cookie.
• Page speed is measured separately by our own first-party measurement. It sends anonymous timing samples only (a public page category, the metric value, a coarse device class and country), never answers, results, identifiers or cookies. Samples are deleted after 32 days, and nothing is sent while Do Not Track, Global Privacy Control or the analytics switch on this page is on.
• Authentication cookies keep a signed-in session working and expire according to the session configuration.
• Session storage holds an in-progress test and fresh result on the device.
• Session storage also holds current consent receipts, random research attempt IDs needed for in-session deletion and, during Match, a reusable copy of that participant's own choices for this tab session.
• Local storage holds a raw Match participant token on that participant's device.
• Session storage also holds the answers of an in-progress or finished quick test; they are never sent to us.
• After you open an invitation, session storage keeps the inviter's four-letter type code for that tab.
• Local storage remembers if you turned the site's sounds off. The sounds are generated on your device and send nothing.
• Google Analytics is loaded to measure page views and product usage. It receives page paths with identifiers removed (a result page is reported as /results/[id], a share page as /share/[token]), event names such as test started or result saved, and aggregate context such as locale, answer count and a coarse duration bucket. It never receives your answers, your result, result IDs or share tokens. Like any Google Analytics install it does set its own cookie containing a randomly generated client ID (retained up to two years), and derives approximate location from IP plus browser and device class — this is how visits are counted, and it is not anonymous in the strict sense. We do not load advertising networks or social tracking pixels. We do not interrupt you with a consent dialog for this, because what it measures is usage rather than anything you told the test; you can switch analytics off at any time with the switch at the bottom of this page, which fully disables the tag. Quick-test events are labelled as the quick test and, like all events, carry no answers or result type; an invitation page is reported as /invite/[code].

We ask for explicit consent before processing sexual-preference answers for the test or Match. A separate explicit choice covers storing identity-separated answers and interaction events to evaluate and improve questionnaire quality; declining that research choice does not prevent the test from working. Account and email data support authentication and requested messages; limited technical data secures, debugs and operates the service. You may withdraw research sharing from the result page and erase research attempts remembered in that browser session, delete your Match participant row, delete saved results, or delete your account using the product controls. Withdrawal does not make earlier lawful processing unlawful.

• Cloudflare — DNS, CDN, Workers hosting, the D1 database that stores application records, native rate limiting, Turnstile, security and request logs.
• Neon — managed PostgreSQL database that stored application records until October 2026. A read-only copy is kept for about two weeks after the move as a fallback, then deleted.
• Resend — delivery of requested transactional emails.
• Google Analytics — aggregate usage measurement. Receives redacted page paths, event names and aggregate context, and sets its own cookie holding a random client ID. It never receives your answers or your result.

These providers act for us to supply their specific function and may process data in countries other than yours. We do not sell personal data, provide it to data brokers, or use it for targeted advertising.

• Unsaved preview answers: no database record; browser-session lifetime on the device.
• Quick-test answers: never sent; browser-session lifetime on the device.
• Result drafts: up to 30 minutes, or earlier same-email account deletion.
• Optional questionnaire-research attempts, exact options and structured interaction events: 12 months, or earlier in-session withdrawal.
• Match sessions and answers: 7 days.
• Page-speed samples: 32 days.
• Share tokens: configured expiry, 30 days by default, or earlier revocation/replacement.
• Verification tokens and login sessions: until their own expiry or earlier account deletion.
• Saved results and account profile: until individual-result or account deletion.
• Operational and security metadata: only as configured for diagnosis and abuse prevention.

After you share questionnaire research, the result page offers a control that withdraws it and deletes research attempts remembered in the current session; Match participants can delete their own stored answers with their secret browser token. Because questionnaire-research attempts are deliberately not linked to an account or email, they do not appear in an account export and may no longer be identifiable after the browser session ends. Account controls let you export your profile, saved results and legacy purchase records; delete individual results; revoke shares; and delete the account together with pending same-email drafts and unused sign-in tokens. Depending on where you live, you may also have rights to access, correct, erase, restrict or object to processing, receive a portable copy, and complain to a privacy regulator. Contact support@16kinks.com if the in-product controls do not cover your request.

We use encrypted transport, access controls, one-way token hashes, server-side validation, rate limits and finite retention. No internet service can guarantee absolute security. The site is for adults aged 18 or the higher age of majority where they live; we do not knowingly collect data from minors.

We may update this policy as the service changes. Materially broader data uses require an updated notice and, where required, a new consent before that use begins.

This policy is available in several languages for convenience. If the versions differ, the English version prevails.