The short version, which is the version worth reading. The full policy is being reviewed and is not published yet — this page describes what the software actually does today.
Your nationality group, how you came to be here, and your establishment date are sent to a server, used to work out your route, and then fall out of scope. There is no nationality column in our database, no migration-ground column, and no field a health condition could be recorded in. Only the derived result is stored.
The quiz, every result page, and the feedback form all work without one. A random identifier is kept in your browser so your result is still there if you come back, and so it can be attached to an account if you ever make one.
Behavioural analytics and error monitoring both wait for consent. Refusing is one click, the same as accepting, and nothing is pre-ticked. What we do count without asking is aggregate and unkeyed — how many people reached a result, not which people.
The application in Frankfurt, the database in central Europe, and every optional service on its EU region. The app refuses to start analytics or error monitoring against a non-EU host rather than warning about it.
Access, correction, erasure, portability, objection and withdrawal of consent. Once accounts exist, all of it will be self-service in settings — consent history included — rather than an email address you have to write to and wait.