Privacy
This site is a reference work. Reading it requires no account, sets no analytics, and collects nothing about you. The short version: there is no tracking here, and we do not accept health information even if you try to give it to us.
Effective 30 August 2026.
What we do not collect
- Health data of any kind. No symptom logs, no conditions, no biometrics, no intake forms. This is a structural rule rather than a policy preference: the schema has nowhere to put it, and adding one is a decision that has to be written down and argued for.
- Analytics. There is no analytics or product-telemetry script on this site. Page views are not counted, sessions are not recorded, and nothing you do here is measured.
- Advertising and third-party trackers. None. Nothing here is sold, shared, or brokered, and no advertising network is given a way to observe you.
What we do collect
Only if you sign in, which nothing on the public site requires:
- An email address. Sign-in uses a one-time link sent to your address, so there is no password to store and none is stored. The address identifies your account and is not used for anything else.
- A session cookie. Set by our authentication provider to keep you signed in. It is not an advertising or measurement cookie, and there is no other cookie on this site.
Our hosting and database providers keep ordinary server logs, which include IP addresses, as every web server does. We do not join those logs to accounts or use them to build a profile.
Processors
Two, both of which act on our instructions: Vercel hosts the site, and Supabase provides the database and authentication. The reference data behind the graph is fetched from public sources, listed on the attribution page — those are sources we read, not parties we send anything to.
Your account
If you have one, you can ask us to delete it and the address attached to it, and we will. Since an account holds an email address and nothing else, there is little to export — but ask and we will send you what there is. Write to privacy@catalystproject.ai.
How long we keep it
An account and its email address are kept until you ask us to delete them. Server logs held by our hosting and database providers roll off on those providers’ own schedules, measured in days rather than years. We do not keep a separate copy of them.
Where it is held
On infrastructure operated by Vercel and Supabase, which may process and store data in the United States and other countries. If you are reading this from the UK or the EU, that is an international transfer, and it is made under the standard contractual terms those providers offer for it.
Your rights
Wherever you are, you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. You can object to what we do with it, ask us to restrict it, and withdraw consent where consent is what we relied on. Since an account holds an email address and nothing else, most of these are quick.
Write to privacy@catalystproject.ai. If you are in the UK or the EU and think we have handled your data badly, you can also complain to your data protection authority — in the UK that is the Information Commissioner’s Office. We would rather you told us first, but you do not have to.
Children
This site is not directed at children, and accounts are not intended for anyone under 16. If you believe a child has given us an email address, tell us and we will delete it.
Changes
If this changes — most likely when the shop opens and orders bring a shipping address with them — the date at the top changes with it, and the new terms will describe the new practice rather than being widened in advance to permit it.