Your answers belong to you. The audit is browser-local by default and does not ask for an email address.
Answers and the current question are stored in localStorage in this browser. They are versioned so incompatible future instruments do not silently reinterpret old answers.
The application contains no account system, database write, email gate, or answer-submission endpoint. Reset removes the saved audit from this browser.
Analytics are disabled unless an operator explicitly configures an endpoint. The client can send only three event names: audit_start, audit_complete, and cta_click, plus the public instrument version.
The application payload does not include answers, scores, maturity bands, question position, names, email addresses, persistent identifiers, user-agent fields, or referrer fields. Requests omit credentials and use a no-referrer policy.
Hosting and analytics operators must still document any transport metadata their infrastructure receives or retains, including IP addresses, user-agent headers, access logs, and retention periods.
Copy summary writes a text result to your clipboard only after you select it. Print / Save PDF invokes your browser print dialog. Neither action uploads the result.
The commercial call to action opens an external site. That site has its own privacy practices; no answers or result values are added to the link.
This project is designed to be inspectable and self-hosted. Review your hosting platform, headers, logs, analytics endpoint, and any changes you make before representing a deployment as private.