Privacy & health data

We run one analytics product: Vercel Web Analytics, made by the company that hosts this site. It records which pages are read, from what kind of device, and your approximate location to city level, and it derives a visitor identifier from your request that is discarded after 24 hours. It sets no cookies and builds no cross-site profile.

We run nothing else. No Google Analytics, no advertising tag, no session recording, no data broker, no enrichment. We set no cookies when you arrive. We do not sell anything about you and we do not share anything for advertising.

No advertising or third-party tracking scripts load. No Google Analytics, no Google Tag Manager, no Meta pixel, no Microsoft Clarity, no session recording, no A/B testing tool, no advertising tag. Our fonts are served from our own domain rather than from Google.

One analytics script does load: Vercel Web Analytics. It is served from this site's own domain, not from a third-party host, so if you open your browser's network inspector on any page you should still see every request going to finddrugs-related hosts rather than to an outside tracker. We checked that rather than assuming it — the measured request list is in our published verification notes. Vercel deliberately does not use a fixed path for this script, so its filename will not look like a familiar tracker and may change between deploys.

No cookies are set. A first visit to this site returns no Set-Cookie header at all.

There are now two records of a page being read, they hold different things, and conflating them is how a page like this goes quietly wrong — so here is each one separately.

**Our own counter, in our own database.** Each request adds a row containing the route pattern — such as /review/[brand] — a timestamp, and a coarse classification of whether the request looked automated. Not the resolved URL. No IP address, no user-agent string, no referrer, no cookie, no session or visitor identifier, and no location. Nothing in our database connects two page views to the same person. That is unchanged.

**Vercel Web Analytics.** This is a separate record, held by Vercel, not by us. Per Vercel's published documentation — dated 26 June 2026, which we read rather than paraphrased — each page view stores: the resolved URL (so the specific review, not just the pattern); the dynamic path; the referring site you arrived from; a timestamp; your approximate location as country, region and city; your device type; your operating system and version; your browser and version; and the version of their script. We pass it a function that strips the query string from the URL before it is sent, so anything after a "?" never reaches them.

**The identifier, stated plainly.** Vercel identifies visitors by a hash it creates from the incoming request. It uses no third-party cookie to do so, and it discards the identifier after 24 hours. So within a 24-hour window, two page views from the same request source can be connected to each other. That is the most important sentence here.

**What we get, and what we cannot do.** We see aggregate counts in a dashboard: page views per URL, rough geography, device and browser breakdowns, referrers. We are not given the visitor hash, we cannot query it, and we cannot export a per-visitor record — so we still cannot single you out, and we still hold nothing in our own database that identifies you. What we can now do, which we could not before, is tell how many visits a particular review received. That is the reason this was added.

**What we cannot verify for you.** Everything in the two paragraphs above about Vercel's side is Vercel's own documented description of their product. We have read it and cited its date. We have not audited their servers and cannot, so we are not going to tell you we have.

One thing is stored in your browser, and only if you make a privacy choice: a key called fd.consent, 72 bytes, holding your choice and when you made it. It contains no identifier of any kind. You can clear it with your browser data, or change your choice from “Privacy choices” in the footer.

This site runs on Vercel. To deliver a page to you at all, Vercel receives your IP address — that is how any web request works, not a choice we made. Vercel also keeps operational logs of requests to the site.

We are honest about the limit here: we do not currently know how long those platform logs are kept or exactly what they contain. We do not have access to them as a dataset, we do not analyse them, and nothing from them enters our database. We are establishing the specifics with our provider and will state them here once we can state them accurately, rather than guessing now.

The feedback control on every page lets you send us a comment, a bug report, a question, or — from a review page — a correction. If you use it, we store: the type you chose, your message, your email only if you choose to give one, the page path you were on, and that page's title. A brand correction also stores the brand and, optionally, your name and role.

**Your submission is also emailed to us, and that email goes through a third party.** The provider is Resend (resend.com), and the notification carries everything in the list above: the type you chose, your message as you wrote it, your email address if you gave one, the page path, and that page’s title. On a brand correction it also carries the brand and the name and role you gave. Resend processes and stores that message in order to deliver it, as any email provider does. Nothing is emailed when you only READ a page: this applies solely if you choose to write to us.

We do not store the full URL, your user-agent, or your IP address with a submission. They are not collected at all, rather than collected and then discarded — capturing something and then choosing not to keep it is a decision one edit away from being reversed.

We use what you send only to look into what you raised and to reply if you asked us to. Resolved submissions are deleted from our database 90 days after they are closed. The emailed copy is a SECOND copy, held in our mailbox and in Resend’s delivery logs, and deleting the database row does not delete it. We are saying that rather than letting one retention sentence imply it reaches everywhere.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. No arrangement exists under which anything about you is handed to anyone for advertising, profiling or payment. One thing does leave us, and only if you write to us: what you wrote leaves us in order to reach our mailbox, because Resend delivers the notification. Resend is a processor we pay to deliver mail, not a recipient free to use it.

We do not build profiles, infer conditions, or target anyone.

We do not attempt to identify you, and the data we hold would not allow it.

Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy, to have it corrected or deleted, to opt out of sale or sharing, and not to be discriminated against for exercising any of that.

For almost everyone reading this, the honest answer to a request is that we hold nothing about you — because we do not collect it. If you have written to us through the feedback control, we hold what you sent, in our database and in the emailed copy of it. A deletion request covers both, and we will tell you when each is gone.

To make a request, use the feedback control on any page and say what you want. We will not ask you for more information than we need to find your submission, and we do not require an account. We honour Global Privacy Control: if your browser sends the GPC signal, we treat it as an opt-out of sale and sharing — which for this site is already our default.

This site is for adults and is not directed at children under 13. We do not knowingly collect anything from them.

If we change this policy we will change the date above.

If we ever start collecting something we do not collect today — analytics, cookies, advertising tags — or start sending what you give us to a company that did not have it before, this page will say so before it happens, not after.