Privacy Policy

1. Scope

This policy explains the privacy practices of the HISTI website and check-in at www.histi.org. It distinguishes information kept in your browser from ordinary technical information processed when a website is delivered over the internet.

2. Check-in data stays on your device

HISTI processes the check-in in your browser. The current app may store these items in localStorage so you can resume or review the check-in:

• test version, language, and recipient group;
• selected levels, answer statuses, and current question card;
• accessibility/preferences used by the check-in; and
• completion status and whether debug-generated test answers are present.

This check-in state is not submitted to an HISTI application server. It stays in the browser profile/device where you use HISTI unless you choose to copy or share it yourself. Results are calculated locally from those answers.

3. No cookies

HISTI does not set or use cookies for the current website or check-in. HISTI does not use advertising cookies, analytics cookies, or tracking cookies.

HISTI does use localStorage for local check-in progress. localStorage is browser storage, but it is not a cookie. You can inspect or clear it using HISTI’s controls or your browser’s site-data tools.

The site-wide Settings panel stores reading level, contrast, text size, and performance mode in a separate browser-only record, histi.preferences.v1. These preferences contain no check-in answers and are not submitted to a server. “Reset settings” clears only that preference record; it does not clear check-in progress or results. Other open tabs on the same site can apply updated preferences through the browser’s local storage event.

A single-use navigation flag in this tab’s sessionStorage prevents returning home from replaying the introduction. It contains no answers or personal details and is cleared when home opens.

A numeric navigation position in this tab’s session storage and browser history helps distinguish Back from Forward for page animations. It does not store visited URLs, answers, or personal details, and does not add history entries.

4. Choices, not real private details

The current Full, 120, 60, and School check-ins do not have a free-text answer or recipient-name field. Choose levels or answer options only. Never enter real names, passwords, codes, IDs, or other sensitive details.

English, Simplified Chinese, and Spanish check-ins keep separate local progress for each test and recipient. Switching language does not copy, translate, overwrite, or delete your saved answers. Return to the same language, test, person, and browser to resume.

The language pop-up changes the page URL. It does not send answers to a translation service or store an additional language-preference record.

5. What ordinary website hosting can see

Loading any website requires ordinary network requests for files such as HTML, JavaScript, CSS, the logo, and the static question catalogue. HISTI is hosted on Vercel, so hosting infrastructure may process technical request information such as:

• IP address and approximate network information;
• browser/device and protocol information;
• requested URL/static file;
• request time, response status, and security/diagnostic information.

Those ordinary hosting requests are separate from the check-in state. HISTI does not place your answers, progress, or score into those requests.

Vercel’s own handling of infrastructure information is described in the Vercel Privacy Notice.

6. No analytics, ads, or third-party runtime trackers

The current check-in does not load an analytics SDK, advertising tracker, third-party font service, or third-party tracking script. Idiqlat, Tiro Gurmukhi, Instrument Sans, and the Chinese font subset are self-hosted and loaded as same-origin static assets.

The production browser policy sets connect-src 'none' and form-action 'none', blocking the normal page APIs used for fetch/XHR/WebSocket/EventSource/sendBeacon connections and form submissions.

7. Inspecting local data

The current check-ins do not include a JSON export or saved-result-history interface. You can inspect local records using your browser’s developer tools: Application → Local Storage. These tools may expose your answers to anyone using your unlocked browser.

Older HISTI versions may have left local records, including optional labels or result history. Current check-in resets do not remove unrelated or older-version records. Clear this site’s data in your browser to remove all local records for that site.

8. Deleting your local HISTI data

Use Reset inside a check-in to remove that test, language, and recipient’s progress and result from the current browser profile. Other check-ins and Settings are unchanged. As an alternative method, clear site data for www.histi.org using your browser settings.

Because HISTI does not receive the check-in state, HISTI cannot remotely retrieve or delete data that exists only in your browser.

9. Local retention

Local HISTI progress remains in the browser until you reset it, clear site data, or the browser/device removes it. Progress is not synced across devices, browsers, or website domains.

Local browser storage is not a secure vault. Anyone with access to your unlocked browser profile/device may be able to inspect it. On a shared device, reset your check-in when you finish. Clear the site’s data to remove all versions and languages.

10. Sharing a result

You do not have to show anyone your result. The current results page does not automatically share, upload, or publish it. If you choose to save a screenshot, copy information, or send it elsewhere, review what it reveals first.

Once you choose another app, service, or person as the destination, that destination’s privacy practices apply.

11. Age policy

HISTI Full, HISTI-120, and HISTI-60 are not intended for users under age 13. HISTI for Schools has separate optional Middle School (ages 10–13) and High School (ages 14–18) classroom reflections. HISTI does not ask for a date of birth, real names, school identifiers, or private facts, and does not create an age profile. You choose an edition, not an exact age. Each school edition and person has a separate local progress record; older school records are left untouched and are not reused for the revised questions. Other children’s versions are coming soon.

If you are aged 10–12, use only the Middle School edition in an appropriate educational setting; do not use the main check-ins. No currently available version is intended for children under 10. Participation must be optional. Teachers should not collect named responses or use individual scores as grades. On shared devices, reset the local school check-in when finished.

12. Your choices and rights inside HISTI

• keep real private information to yourself;
• refuse any question;
• leave sensitive questions unanswered or use the available response options;
• go back, stop, review, or reset;
• keep your result private or share it only when you choose.

13. Alternative methods

HISTI is designed so privacy controls do not depend on one single UI path:

• Inspect: use the privacy-proof panel or browser site-storage tools.
• Delete: HISTI Reset or browser “clear site data.”
• Review: use Review in the result screen or return to a question card.
• Do not provide text: choose levels only; there is no name or private-details field.
• Do not answer sensitive questions: leave individual questions unanswered or use the available response options.

14. Privacy and security verification

The check-in includes a privacy-proof panel that checks its visible CSP, same-origin runtime resources, HISTI local-storage keys, and whether any cookies are visible to the page. You can also inspect the public source in the HISTI repository.

No technical control can make a general-purpose browser or device perfectly secure. HISTI’s design reduces data transmission rather than promising absolute security.

15. Changes to this policy

This policy may change when HISTI’s features, hosting, privacy controls, or service providers change. The effective date at the top identifies the current version.

16. Contact

A dedicated HISTI contact email is being set up and will be published here once available.

Do not send check-in answers, passwords, codes, account details, or other sensitive information by email.