What this site collects, and what it does not

Search queries

When you use the search box, the phrase and the number of results it returned are logged, along with the page you typed it on and the link you followed from the results. This is how gaps in the library get found: a phrase that returns nothing is a page that should exist.

Your IP address is not stored. It is converted to a one-way hash using a random value that is regenerated every day and never written to disk, so the same visitor is an unrelated value tomorrow and the record cannot be traced back to an address. That hash exists only to count distinct people within a single day and to stop one client flooding the endpoint.

A search on this site can reveal an interest in a health condition, which is sensitive information. That is precisely why the address is discarded: the phrase is kept, the person is not. Search records are deleted automatically after 180 days.

Approximate location

Search records carry a region — for visitors in the United States, Canada and Australia that is the state or province; elsewhere it is the country. It is worked out by looking your IP address up in a geolocation database held on this server. The address is used for that lookup and then dropped: it is not written down, and only the name that comes back is stored on the record.

No address is ever sent to a geolocation service, and no third party is contacted when you search. Where the database has no answer, the fallback is your browser's timezone, which narrows someone to a broad area and no further. A region worked out this way is approximate, is wrong for anyone on a VPN or a corporate network, and is never a street or a person.

IP geolocation by DB-IP (https://db-ip.com), CC BY 4.0

Visit statistics

Public pages load Statcounter, a third-party analytics service, to count visits and see which pages people read. Statcounter receives your IP address, the page address you are on, and your browser's general details, and sets a cookie to recognise a returning browser. That data is held by Statcounter under their own privacy terms, not ours.

If you would rather not be counted, any browser setting or extension that blocks third-party analytics will stop it, and nothing on this site will break as a result. The Statcounter opt-out also works.

Not present on any page: advertising networks, social media tracking pixels, session recording, fingerprinting scripts, or any tag whose purpose is to follow you to another site.

The contact form

If you write to us, the name, email address, organisation and message you enter are stored so the enquiry can be answered, together with the date and the page you came from. That is ordinary correspondence and it is treated as such: it is not added to a marketing list, not sold, not shared, and not used for anything except replying to you. Enquiries are kept until the matter is closed and then deleted on request.

Please do not send personal medical details. The form asks you not to, and there is no clinical service behind it that could act on them.

Questions and answers under the monographs

If you post, your email address is stored. It is kept so that the person who runs this site can contact you about what you wrote — to ask a question about it, or to tell you it was published or was not. It is not shown on the page, not sold, not shared, and not added to any marketing list. It is also never used to identify you publicly: your posts appear under a generated name of two ordinary words, and that name is the only thing other readers ever see.

Alongside the address the site keeps a keyed one-way hash of it. That is what maps you to the same generated name every time, including if you post from another device.

Every post is read by a person before it appears. Until it is approved it is visible only to you, marked, on the page you wrote it on. Nothing you write is published automatically.

No IP address is stored with a post. Posting limits are counted in memory and forgotten when the server restarts. A cookie holds a random session token so you stay signed in; the database stores only a hash of it.

You can delete any post of yours from the page at any time, and you can remove everything you have written together with your generated name and your stored address in one step, from the same page. Both take effect immediately and neither needs to be requested from anyone. Posts written by the site's own editorial desk are marked as such on the page.

What is never collected

• No password, and no account beyond the generated name described above. Nothing to sign up for, nothing to remember.
• No advertising or cross-site tracking cookie set by this site.
• No payment details. Nothing is for sale here.
• No health information about you, beyond what you might type into the search box or choose to write in a message.

Your rights

If you are in the UK, the EU or another region with equivalent law, you can ask what is held about you, ask for it to be corrected, and ask for it to be deleted. For search records the honest answer is that there is usually nothing to retrieve — without your address there is no way to identify which rows were yours, which is the point of collecting it that way. For a contact form message we can find it by the address you used and delete it on request. For questions and answers you do not need to ask: the delete controls are on the page, next to your posts.

Ask through the contact form. It is read by one person.

Changes

If what is collected changes, this page changes with it and the date at the top moves. There is an automated check in the build that fails if the code and this page disagree.