Collect less; explain what remains.

The current application does not provide user accounts, payment processing, chat, or unrestricted user-generated content. Calculator inputs are intended to remain in the browser or URL and must not contain personal information.

Hosting and security infrastructure may process ordinary network data such as IP address, request time, route, status, and user agent. The final operator, processor, retention, and contact details remain a production release gate.

Optional measurement is consent-gated. After a visitor explicitly allows optional analytics, the site loads Google Analytics 4 to count a validated, allow-listed set of events (page views, calculator completions, comparison completions, directory actions). It sends no calculator values, prompts, search terms, email addresses, full URL queries, or session inputs. Microsoft Clarity session recording is also consent-gated, masks text input, and does not record the closed submission page.

Aggregate pageview measurement is also collected by a self-hosted Plausible instance served from analytics.krillion.quest. It sets no cookies, performs no fingerprinting, and stores no personal data. An incoming IP address is read only to derive a coarse country label, is not written to storage, and is discarded when the request completes.

Rejecting optional analytics must not disable model pages, sources, the directory, or the calculator.

The prepared correction and directory-submission flow accepts an optional contact email only when an editor may need clarification. The Worker encrypts it before storage, restricts review to named operators, never publishes it, and deletes it with the full submission after 30 days. Minimal audit metadata contains no submission body or email and is deleted after 365 days.

The public submission feature remains disabled until the final operator, jurisdiction, privacy contact, D1 data location, reviewer access, production Turnstile, deletion checks, and this notice are approved for production.