Privacy Policy

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Yusuf Senel · Log-System Development Von-Hünefeld-Str. 8, 40764 Langenfeld, Germany Email: [email protected]

darkquiz is an entertainment personality test for self-reflection (Dark Triad). We process personal data only to the extent necessary to operate the website, run the test, provide optional sign-in, and — with your consent — for analytics.

• You can take the test without creating an account.
• Sign-in via Google is optional and used to save your results.
• Results are private by default; public sharing only happens if you explicitly enable it.
• Analytics cookies (Google Analytics via Cloudflare Zaraz) are only used with your consent.

We use the following infrastructure to provide the website:

• Hosting: The website is hosted by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. The server is located in Germany.
• CDN / reverse proxy: The website is delivered via Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare acts as a content delivery network (CDN), protects the site from attacks (e.g. DDoS), and provides the server-side tag manager Zaraz.
• When you visit the site, technically necessary connection data (in particular IP address, date/time, requested URL, user agent, referrer) is processed. Legal basis: our legitimate interest in secure and performant operation (Art. 6(1)(f) GDPR).

We process personal data in the following cases:

• Server and access logs: IP address (possibly truncated), date/time, page viewed, browser type, operating system, referrer URL — for operation, error analysis, and attack prevention.
• Session and authentication data: session cookies and OAuth tokens when signing in with Google — to provide your user account.
• Test answers and results: your answers and calculated scores (narcissism, Machiavellianism, psychopathy) — to display your result and, if signed in, store it in your account.
• Profile data on Google sign-in: name, email address, and profile picture from Google — to create and associate your account.
• Sharing settings: whether and under which link a result is publicly accessible — only if you explicitly enable sharing.
• Analytics data (consent only): truncated IP address, page views, time on site, referrer — for reach measurement and site improvement via Google Analytics (loaded through Cloudflare Zaraz).

• Art. 6(1)(b) GDPR — performance of a contract or pre-contractual steps (running the test, providing your account).
• Art. 6(1)(a) GDPR — consent (analytics cookies, public sharing of results).
• Art. 6(1)(f) GDPR — legitimate interests (operation, security, server logs, abuse prevention).

You may withdraw consent at any time with effect for the future (e.g. in the cookie banner, by disabling sharing, or by email).

For optional sign-in we use “Sign in with Google” by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google LLC, USA as parent company). During sign-in you are redirected to Google. After successful authentication, Google sends us the profile data listed above.

Google processes data in its own responsibility. See Google’s privacy policy: https://policies.google.com/privacy

The Dark Triad test is for entertainment and self-reflection only. It is not a psychological or medical diagnosis. Scoring is rule-based from your answers; there is no automated decision-making with legal or similarly significant effects (Art. 22 GDPR).

Without sign-in, test answers are processed only to show your result immediately and are not permanently linked to an account. With sign-in, we store results so you can access them later.

Your results are private by default. Only if you explicitly enable sharing will your result become publicly accessible via a non-guessable link. Legal basis: your explicit consent (Art. 6(1)(a) GDPR). You can withdraw sharing at any time by disabling it or deleting the result.

To provide our service we use carefully selected providers that process data on our behalf or as independent controllers:

• netcup GmbH (Germany) — hosting in Germany.
• Cloudflare, Inc. (USA) — CDN, attack protection, server-side tag manager Zaraz.
• Google Ireland Limited / Google LLC (Ireland/USA) — OAuth sign-in and, if consented, Google Analytics.
• Stripe Payments Europe, Ltd. (Ireland/USA) — payment processing for paid offers (see section 21).
• Anthropic PBC / xAI (USA) — generation of the paid AI report (see section 22).

We conclude data processing agreements under Art. 28 GDPR with processors where required.

Cloudflare and Google may transfer data to the USA. These providers rely on appropriate safeguards under Art. 44 ff. GDPR, in particular EU Standard Contractual Clauses and/or certification under the EU-US Data Privacy Framework.

If you do not want transfers to third countries, please use the site without sign-in and reject analytics cookies in the cookie banner.

• Server logs: deleted or anonymised after a short period unless security incidents require longer retention.
• Account data and stored test results: for as long as your account exists or until you request deletion.
• Publicly shared results: until you disable sharing or delete the result.
• Consent records (cookie banner): stored locally in your browser; we do not maintain permanent server-side consent profiles.

We use cookies and similar technologies:

• Strictly necessary cookies: for site operation, language selection, theme, sign-in (session), and an anonymous identifier that lets you manage (publish/hide) your own quiz result without signing in. This identifier is a random value with no personal reference and only ties your result to your browser. Legal basis: § 25(2) TDDDG, Art. 6(1)(f) GDPR. No consent required.
• Analytics cookies (consent only): Google Analytics for reach measurement, loaded via Cloudflare Zaraz. Legal basis: § 25(1) TDDDG, Art. 6(1)(a) GDPR. You grant consent in the cookie banner and may withdraw it at any time.
• Reach measurement (first-party access statistics): for all visits we count, anonymously and in aggregate, where visitors come from — coarse country (via Cloudflare), device type and the referring source (e.g. a search engine, social network or "direct"), plus any link tag we created (?ref=…). No IP address is stored and no cross-site profile is built (legitimate interest in privacy-friendly reach measurement, Art. 6(1)(f) GDPR). Only with your analytics consent do we additionally derive the internet provider/network for a ?ref visit (via a WHOIS lookup of your IP, which is not stored); without consent this enrichment does not happen.

Without your consent, no analytics cookies are set and no analytics data is collected for marketing or statistics.

Cloudflare provides several services that may be active when you visit our website:

• CDN & reverse proxy: speeds up delivery and filters malicious traffic. IP address, request headers, and access time may be processed.
• Cloudflare Zaraz: server-side tag manager that loads Google Analytics only after your consent. Zaraz may process connection data to deliver tags reliably.
• Security features: protection against automated attacks and abuse (e.g. rate limiting, bot management, where configured).

More information: https://www.cloudflare.com/privacypolicy/

Under the GDPR you have the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent (Art. 7(3) GDPR)

To exercise your rights, email [email protected]. We typically respond within one month.

You have the right to lodge a complaint with a supervisory authority. In particular: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany — https://www.ldi.nrw.de

We implement appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS/TLS), restricted server and database access, regular updates, and Cloudflare protection against attacks.

This service is intended for users aged 16 and over. In Germany, the minimum age for consenting to processing of personal data without parental consent is 16 (Art. 8(1) GDPR in conjunction with § 8(1) TTDSG).

Legally mandated technical age verification (e.g. ID checks) is not required for this website, as we do not provide youth-endangering content and no regulated age-verification regime under the JMStV or DSA applies. In the cookie banner and at sign-in we nevertheless ask you to state your age truthfully.

Users under 16 should only use the site with parental consent, especially when signing in or publicly sharing results.

In your account you can optionally connect your Discord account to darkquiz to automatically receive a role matching your latest test result in the darkquiz Discord server.

• When you connect, we receive your Discord user ID and Discord username via Discord's sign-in (OAuth2, "identify" and "guilds.join" scopes).
• With the "guilds.join" scope we add you — only with your consent at connect time — to the darkquiz Discord server, so a role can be assigned to you there in the first place.
• The access token issued by Discord during this process is used only for this single operation and is not stored permanently.
• Using our own bot account, we then assign the matching role in the darkquiz Discord server server-side (and remove it again if your result changes).
• Connecting is entirely optional and independent of the Google sign-in.

Legal basis: your explicit consent (Art. 6(1)(a) GDPR). You can withdraw the connection at any time under "Account" via "Disconnect" — this deletes your Discord ID, username, and removes the assigned role in the server.

darkquiz is currently ad-free — we do not show any advertising at the moment.

We are in the setup phase and plan to integrate Google AdSense (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in the future to finance the free service. Once advertising is activated, we will update this section and inform you about the data processed, the cookies used and the respective legal basis. We only set personalised advertising cookies where consent is required and you have given it via the cookie banner.

You can optionally link your darkquiz account with our sister site omequiz (omequiz.com), operated by the same provider, to show your Dark Triad type there. Linking is started explicitly from omequiz and confirmed on a consent screen on darkquiz.

• When you confirm the link, darkquiz issues omequiz a secure access token. Using it, omequiz can retrieve your latest Dark Triad archetype and overall score to display on your omequiz profile.
• Only this minimal, derived data is shared — never your individual answers. No email address is transmitted; the link is a token, so it also works if your accounts use different email addresses.
• You can revoke the link at any time — in your darkquiz account under 'Connected apps' or on omequiz. Revoking deletes the token and stops any further sharing immediately.

Legal basis: your explicit consent given on the linking screen (Art. 6(1)(a) GDPR).

For the paid AI report we process payments via the payment provider Stripe: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (parent company: Stripe, Inc., USA).

• When you buy, the data required for payment (e.g. name, email, billing address, VAT ID if applicable, payment-method and transaction data) is collected directly by Stripe and processed by Stripe. We ourselves do not receive full payment data (e.g. no card number).
• For proper invoicing and bookkeeping we store the billing data Stripe passes to us (name, address, VAT ID if applicable) together with amount, date and a payment/order reference.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with legal, in particular tax and commercial, retention obligations (Art. 6(1)(c) GDPR).

Retention: invoice-relevant records are kept for the statutory retention periods (usually up to ten years). More information: https://stripe.com/privacy

Optionally you can purchase a paid, individually created AI report. To create it, we work internally with AI models from Anthropic (Claude) and xAI (Grok). We only send the test and answer data needed for the report (questions, chosen answers, trait scores, archetype and — only for the detailed variant — your additional free-text answers). We do not send data that identifies you, such as your name, email address or payment data.

• Model providers: Anthropic PBC (USA) and xAI (USA). Processing is carried out on our behalf solely to create your report, not for the providers' own purposes.
• No real names, email addresses or payment data are sent to the AI providers — only the test and answer data needed for the report.
• No automated profiling with legal or similarly significant effect (Art. 22 GDPR) takes place; the report is for entertainment and self-reflection.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Transfer to the USA is based on appropriate safeguards under Art. 44 et seq. GDPR (in particular EU standard contractual clauses). The generated report is stored in your account; you can delete it at any time.

We update this privacy policy when our website, services, or legal requirements change. The current version is always available at /datenschutz.