Privacy policy

The short version

This is a static analytics site. We don't run ads, we don't use tracking cookies, and we don't sell or share personal information. We measure how the site is used with a privacy-preserving analytics tool that sets no cookies, records no sessions, and never captures what you type. The only personal data we hold is the email address you give us if you subscribe to the briefing.

What we collect

Newsletter signup. If you subscribe, your email address is stored with our email service provider (Buttondown) and used only to send the data briefing. Every email includes an unsubscribe link; unsubscribing removes you from the list.

Server logs. Our hosting provider keeps standard web server logs (IP address, user agent, pages requested) for security and capacity purposes. These are not used to identify or profile visitors.

Local preferences. Features like "Save as my market" store your choice in your own browser (localStorage). That data never leaves your device and we cannot see it.

Product analytics

We use PostHog (US region) to understand which parts of the site are useful. It is configured deliberately, and the configuration is part of this policy:

What is recorded. Page views, and a fixed list of named product events such as saving a market, running a saved analysis, exporting a CSV, opening the methodology for a modelled figure, or reaching a free-tier limit. The complete list is enumerated in the site's source at /assets/analytics.js; nothing outside that list is sent.

What is not recorded. No cookies are set. There is no session recording and no “autocapture”, so we never receive the contents of a form, the text you select, or what you type. Event properties are restricted to a fixed allow-list of non-identifying values (things like which page family, which metric, which tier), and any value longer than 64 characters is truncated before it is sent.

How you are counted. A random identifier is stored in your browser's localStorage so a return visit is not counted as a new person. It contains nothing about you, it is not a cookie, it is not shared with anyone, and clearing site data removes it. We do not create a person profile for anonymous visitors.

Opting out. We honour the browser Do Not Track setting: with it enabled, nothing is sent. Any content blocker that blocks PostHog also works, and the site is fully functional without analytics.

What we don't do

No advertising or ad networks. No advertising or cross-site tracking, no session recording, no automatic capture of clicks or text, and no analytics cookies. No sale, rental, or sharing of personal information. No profiling. The site's data content is aggregate public CMS data and contains no beneficiary-level or personally identifiable health information.

Your choices and rights

You can unsubscribe from the briefing at any time via the link in any email. You may request access to, or deletion of, any personal data we hold (in practice: your email address) by contacting info@medicareinsights.org. Depending on where you live, you may have additional rights under laws such as GDPR or CCPA; we honor such requests regardless of jurisdiction.

Changes

If this policy changes, the new version will be posted here with an updated effective date, and material changes will be noted in the changelog.