Exactly what this site collects
I sell governance. It would be absurd to run a site that could not answer the questions I ask other people. So here is the full inventory.
Correction, 17 August 2026.Between 24 July and 17 August 2026 this page was wrong. It said no IP address was retained. In fact every analytics event carried the visitor’s address, and the analytics provider expanded it into an approximate city, postcode and coordinates — including on the events that record starting and completing the diagnostic. The anonymous diagnostic rows in the database were not affected and still carry no address; the analytics record of the same visit did, and this page said it did not.
The cause was a setting that read as a protection. The address was stripped from the request inside the browser, and the receiving service treats an absent address as an instruction to use the one on the connection instead — so stripping it was what published it. It went unnoticed because the fault was invisible in the browser’s network tab, which is where this page invites you to check: the properties were added after the request left. Nothing was sold, shared, or joined to a form submission. The configuration is fixed and verified. Removing the address, and the location derived from it, from the records already collected — keeping only the visit counts — is the remaining step.
| What | When | Why | Retention |
|---|---|---|---|
| Diagnostic scores Four layer scores, sector, jurisdiction, action class, volume band | When you complete the diagnostic | To build a sector benchmark. No organization name, no email, no identifier, no IP address is stored with it — the row cannot be traced back to you. | 24 months |
| Inquiry details Name, email, organization, situation, timeline | Only when you submit the contact form | To respond to you. This is the only place identity is attached, and you attach it deliberately. | Until the conversation concludes, then deleted on request |
| Subscriber email | Only if you subscribe | To send new writing. | Until you unsubscribe |
| Diagnostic delivery email Address, sector, overall score band | Only if you ask for the PDF by email | Sent with the generated PDF to Resend for delivery, and stored as a contact record so a conversation can follow. It is held separately from the anonymous diagnostic row and the two are never joined — your answers stay unattributed. If you would rather leave nothing, use Print or save as PDF, which sends nothing anywhere. | Until you ask for erasure; Resend applies its own operational email-log retention |
| Teardown request Name, email, organization, the link or file you send, your notes | Only if you request an asynchronous teardown | To read the artifact and write the critique back to you. An uploaded file is forwarded to me by email and is not retained in the site’s storage — only its filename and size are recorded, so the request can be tracked. | Until the critique is delivered and the thread concludes, then deleted on request |
| Anonymous usage events Page viewed, diagnostic started/completed, per-question progress and time-bucket, how far articles are read, time-on-page bucket, page performance numbers, error counts, booking link clicked, form submitted | As you use the site | To see which pages are useful, where people give up, how far articles are read, how fast pages load, and which article preceded a diagnostic. Processed by PostHog. Configured with memory-only persistence, manual bounded events, no autocapture, no session recording, no person profiles, and no IP address. Each event carries a fixed placeholder where the address would go, and the analytics project is set to discard connection addresses on arrival — both, because either one alone fails silently. Every property that leaves your browser is a bounded category or a number: no form values, answers, organization names, email addresses or free text, and no URL, referrer, search term or user-agent string. The analytics library attaches those by default; they are removed before the request is sent. Durations are reduced to four coarse buckets before capture. Requests are proxied through this domain. | 12 months |
| Abuse-prevention counters Salted one-way SHA-256 digests derived from the requesting network address and, where a form supplies one, the email address and its domain | When a public form or report endpoint is called | To enforce a narrow request limit. Each value is salted and one-way hashed before it reaches storage, so no address, email or domain is recoverable from a counter row. A row holds a digest, a token count and a timestamp — nothing else. Counters are never joined to form or diagnostic records, and are not used to recognize a returning visitor. The email domain is counted with a deliberately generous allowance: several people from one organization arriving together is expected, not abuse. | Deleted once the counter has refilled and can no longer deny anything — at most 24 hours |
| Referrer tag e.g. utm_source=article | With the above | To know which page led somewhere useful. | With the record it belongs to |
What this site does not do
- No cookies. There is no consent banner because nothing here requires consent. Two things can be written to your device, both in local storage, neither ever read by the server, and both removed by clearing site data. If you use the light/dark toggle, your choice is saved under the key
theme, holding the single wordlightordark, so the page does not flash the wrong palette next time. And a browser of mine that I have marked as my own — so my visits can be excluded from this site’s figures — stores the keyvj_ownerholding the character1. It is set only by opening a link I know, never by anything you do, so on your device it does not exist. That flag replaced the previous way of recognizing my own visits, which was to read the IP address off stored events. - No advertising tags, tracking pixels, session recording, cross-site tracking, or third-party fonts. PostHog is the disclosed analytics processor; the bounded event client is loaded from the first-party proxy and uses the configuration described above.
- No IP address is stored — not by the application, not by the analytics processor, and not tied to diagnostic responses. Hosting, network and email providers necessarily process connection metadata in transit under their own security logs and retention terms.
- Nothing is sold, shared or passed to a data broker. Ever.
- The diagnostic works whether or not the storage layer is reachable — the report is computed in your browser.
Your rights
Under India’s DPDP Act and the GDPR you can ask for access, correction, or erasure of anything identifying you. Since diagnostic rows carry no identifier, the practical scope is inquiries, subscriptions, report requests and teardown requests — the four places you hand something over deliberately. Write to vikram@vikramjha.work and it will be handled within 30 days.
Where it lives
Form, subscription and anonymous diagnostic records live in managed Postgres with transport encryption required by the connection. Operational email is processed by Resend. Usage events are processed by PostHog through the first-party proxy. Access to application records is limited to the practice principal through a token-protected operational view; production-provider access controls remain part of the deployment boundary.
If this page and the site’s behavior ever disagree, the page is the commitment and the behavior is the bug — tell me and I will fix it, and say so here, as above. Most of what is written above is verifiable from your own browser’s network tab in about thirty seconds, and that is rather the point. One honest limit, learned the hard way: the network tab shows what leaves your browser, not what a processor adds after it arrives. That gap is exactly where the August defect lived, so the claims that depend on it — the discarded IP address, the retention period — rest on the processor’s configuration rather than on anything you can see from here.