Data practices
What we store, and what we refuse to.
No cookies, no identifiers, nothing written to your device at all. Everything below is the whole list, not a summary of a longer list.
01 What we store
From the forms
Interest-form fields: name, email, and the free text you type into them.
From tenants
Scalar scores plus bounded metadata — never prompts, never outputs, never your users' data.
Why: to onboard you and to send the digest you asked for. Where: one EU Postgres instance, encrypted at rest.
02 Retention
Deleted on request, and on a clock without one.
Interest records are deleted on request, or after 12 months of silence. Tenant data is exported and then deleted on request. The public record never contains your data.
03 Measurement
Two measurements, and neither can name you.
The counter is one endpoint on our own server: an event increments a single integer in a bucket for that day, so what is stored cannot describe a person even in principle. Page views go to a hosted product, PostHog, reached through a path on this origin — no other host receives a request from your browser, and no other host is permitted by the policy that governs what this page may load. Neither measurement sets a cookie or writes anything to your browser's storage.
What is counted
Named interactions, from a fixed list written out in the counter's source: whether the demo was broken, how far the methodology page was read, which call to action was clicked, which form was submitted. Then one page view per load — the page's address, the site that linked you, and your browser, operating system and screen size. PostHog is sent your IP address to place the view in a country, and is configured to discard it rather than keep it.
What is not counted
Returning visits, still. The analytics client keeps its identifier in memory alone, so it is gone when the page closes and the next visit arrives a stranger: our own dashboard cannot tell one reader from two. We would rather have the gap in our numbers than the identifier on your device.
Where: the counter's tallies in the same EU Postgres instance as everything else; page views in PostHog's EU region.
04 Erasure
Operator decision — not for publication as written This page owes readers a working contact route for access and erasure requests, and the deck points it at the /about email, which does not exist yet. Publish an address here, and have a lawyer read this page: it is a GDPR and PECR surface, and it is currently a draft.