Privacy
Privacy policy
This site collects as little as possible. It never asks for genetic or medical information, and an account is optional for everything on the site.
Updated
What we collect
- Reading the site: nothing. There are no analytics or advertising trackers. Our hosting provider, GitHub Pages, records standard server logs (IP address, browser type, pages requested) that we do not access or analyse.
- Creating an account: your email address, which is used to send you a one-time sign-in link. We do not store passwords.
- Your profile, if you fill it in: name, country, which of five roles describes you, the topics you are interested in, and whether you want the newsletter. All fields are optional.
We never ask for, and you should not enter, genetic results, diagnoses, symptoms, medications, family medical history or any other health information. The profile form has no free-text fields for this reason.
Why we collect it
- To sign you in and keep you signed in.
- To send the monthly newsletter, only if you ticked the box, and only on the topics you chose.
- To understand, in aggregate, which kinds of readers use the site so we can improve it.
We do not sell personal data, use it for advertising, or share it with anyone except the service providers below.
Who processes it
- Supabase stores account and profile data and sends sign-in emails. Data is encrypted at rest and each person can access only their own record.
- GitHub Pages serves the website.
- If a newsletter provider is used, it will be named here before the first issue is sent.
How long we keep it
Until you delete your account. Deleting your account removes your email, profile and preferences immediately and permanently. Backups held by our provider are overwritten within 30 days.
Your rights
From the account page you can see, change, download or delete everything we hold about you, at any time, without asking us. If you are in the European Union, the United Kingdom or California you also have the right to complain to your data-protection authority; we would rather you contacted us first.
Children
This site is written for adults. We do not knowingly create accounts for anyone under 16.
Security
Sign-in is passwordless, so there is no password to steal. Data is held in a single provider with per-user access rules, and no secret keys are present in the website's code. If we ever learn of a breach affecting your data we will tell you by email and notify the authorities the law requires.
Contact and changes
Questions and requests can be raised through the site's GitHub repository. This policy will be updated here, with the date above, whenever what we collect or who processes it changes.