{
  "analytics": {
    "endpoints": [
      "POST /_care/event",
      "POST /_care/event/<name>",
      "GET /_care/script.js"
    ],
    "personalData": false,
    "cookies": false,
    "deviceStorage": false,
    "received": [
      "the event name (for example \"pageview\" or \"signup\")",
      "the page address, of which only the site name (host) and the path are kept (query strings and #fragments are dropped, except utm_source, utm_medium and utm_campaign; ref or source stands in for a missing utm_source). A part of the path that looks like an email address is replaced by \":email\", and such a utm value is dropped",
      "the referring site, of which only its host name is kept (for example \"google.com\")",
      "the screen width (to tell phone, tablet and desktop apart) and the browser language",
      "optional event properties set by the app, which must not contain personal data: names or values that look like an email address, and values that look like a browser User-Agent or an IP address, are refused"
    ],
    "used": [
      "the IP address and the browser identifier (User-Agent), only in memory, to make a visitor code and to rate-limit; they are never written anywhere",
      "the country, from the network provider (Cloudflare) header"
    ],
    "visitorCode": "A visitor is counted with a code made from a random value that changes every day (UTC) plus the IP address and browser identifier. The random value is deleted at the end of the day, after which the code cannot be traced back to anyone or matched with any other day. So the same person on two days counts as two visitors; nobody is followed across days or across sites.",
    "neverStored": [
      "IP addresses",
      "User-Agent strings",
      "cookies or device identifiers",
      "names, email addresses or account ids",
      "query strings and fragments of page addresses",
      "fingerprints"
    ],
    "retentionDays": 750
  },
  "customerCare": {
    "endpoints": [
      "POST /_care/feedback",
      "POST /_care/bug",
      "POST /_care/message",
      "POST /_care/waitlist",
      "GET|POST /_care/unsubscribe"
    ],
    "personalData": "only what the person types into the form and sends",
    "note": "Feedback, bug reports, messages and waitlist signups keep what the person wrote, including an email address if they gave one (a contact message and a waitlist signup need one, to answer). Nothing is added from the device beyond the site (host) it was sent from, the browser name, operating system, device type, country and language. The IP address is not stored. Email addresses are stored encrypted (AES-256-GCM), with a keyed hash to find them for an erasure or export request. Every waitlist signup can be removed by its unsubscribe link. Requests that are still open are kept until they are answered, and signups until they are removed: the periods below start then.",
    "retentionDays": {
      "resolvedRequests": 730,
      "spam": 30,
      "attachments": 180,
      "backups": 7
    },
    "erasure": "Ask the site that sent you here to delete or export what you sent; they can find and remove everything sent with an email address at once."
  }
}