Privacy

What the CDC Assistant stores

The CDC Assistant is optional. The whole site works without it, and nothing below happens unless you open the assistant, ask it something, and then click 👍 or 👎 on an answer. Typing a question alone sends nothing: the assistant answers from a data file your browser has already downloaded.

When you do click 👍 or 👎, your browser sends one record to the project's database (a Supabase Postgres table named assistant_feedback). It contains exactly these fields:

• The last question you typed (question), cut to 2,000 characters. This is your own text, so please do not type passwords, connection strings or personal details into the assistant.
• The topic the assistant matched to your question (intent_id). It can be empty when nothing matched.
• Your vote (helpful): yes for 👍, no for 👎.
• The time of the vote (ts).
• A random ID (id) generated in your browser. It is not linked to you; it only lets a retried send be recognised as a duplicate.

The site's own code does not collect a name, an email address, an account, a cookie value or an IP address. The purpose is narrow: to see which questions the assistant answers badly so the answers can be improved.

If sending fails, the vote (including the question text) waits in your browser and is retried on a later visit, for up to 14 days or 8 tries, then dropped.

The Change Feed Playground

The Change Feed Playground is a separate, optional tool that works differently from the rest of the site. It talks to the same Supabase project as the assistant, so please read this section before you type anything real into it. Use made-up data.

• When the page opens, it contacts the database to see whether it is reachable and, if it is, opens a live connection. That happens without you clicking anything, so the database host sees your IP address as soon as the playground loads. The code that does this is loaded from a CDN (see below).
• Change events are public. When you insert, update or delete a row, or emit a snapshot, the event is added to a database table called events: a random ID (id), a timestamp (ts_ms), the operation (op), and the row values as you typed them (after, and before too while the "include before" box is ticked, which it is by default). Anyone can read that table and receives new events live, and other visitors' events can appear in your workspace too. Do not enter real names, emails or other personal data.
• Shared scenarios are reachable by link. "Copy Share Link" stores a snapshot of your workspace (table layout, rows, events and comparator settings, up to about 1 MB) in a table called scenarios under a random ID. The table cannot be listed, but anyone who has the share link can open the snapshot.
• Deleted after 30 days. A scheduled database job runs every day and deletes playground events and saved scenarios that are older than 30 days. Because the job runs once a day, a record can last up to about 31 days. When a scenario is deleted, its share link stops working, so a link you copy will expire after about 30 days. The 30 days are counted from the server's time when the record is stored, so a device's clock cannot change it. Visitors' browsers can only add records (and, for events, read them): they cannot change or delete any, so you cannot delete your own events or scenarios sooner; you can ask for earlier removal (see "Asking about or deleting your entry").
• Stays on your device: your workspace, your onboarding and template choices, feature toggles and a small buffer of usage counters are kept in local storage. The usage counters are not sent anywhere.

The newsletter signup

The newsletter has a signup form on its page and in the footer, with one field: your email address. The newsletter is run by Buttondown, a separate company.

• What is sent: the email address you typed, plus what any request reveals to the receiving site (your IP address and browser details).
• To whom: Buttondown (buttondown.com), which then sends its own confirmation and newsletter emails. This site does not keep the address.
• When: only when you press Subscribe. The form is an ordinary web form: your browser sends it and you continue on Buttondown's site. Nothing is sent as you type, and the site loads no script from Buttondown. Buttondown's own pages, where you continue after pressing Subscribe, may set cookies under its privacy policy.

Buttondown handles the address under its own privacy policy. As the newsletter's sender, the maintainer, Christopher Ennis, can see the subscriber list in Buttondown.

To unsubscribe, use the unsubscribe link Buttondown normally includes in its emails. You can also write to the maintainer on LinkedIn to ask about your address. The "Asking about or deleting your entry" section below is for anonymous assistant and playground entries, not for newsletter subscribers.

What stays on your device

Your browser's local storage holds a few things that are never sent anywhere:

• the assistant's chat history (the last 20 messages);
• your reading progress and scorecard answers;
• your theme and reading-depth choices, and what you type into a few interactive tools.

Clearing the site's data in your browser settings removes all of it.

Cookies and analytics

The site's own code does not set cookies. It does count visits with GoatCounter, which sets no cookies either; see "Visit counts" below.

Separately, if you use the newsletter signup, the Buttondown page you continue to may set its own cookies.

Some features load things from other companies, which can behave differently. If you click play on an embedded YouTube video, YouTube's player loads and may set its own cookies. The Change Feed Playground loads its Supabase library from jsDelivr, which can see your IP address, and contacts Supabase when it opens. Details are under "Third-party requests".

Visit counts

The site counts visits with GoatCounter, a privacy-friendly analytics service. It sets no cookies and shows no consent banner, because it stores nothing in your browser and keeps no personal profile of you.

• What is counted when you open a page: the page path and title, the page you came from (the referrer), your browser name and version, your operating system, your screen width, your language, and your country, which GoatCounter works out from your IP address. Per GoatCounter, the results are stored as totals per day or hour, so the browser and country figures cannot be linked to each other or to you.
• What is not kept: according to GoatCounter's privacy policy it does not store your IP address, your full browser identification string or any tracking ID. To avoid counting a repeat visit twice it holds a short-lived random string in its server's memory for up to 8 hours; that string is not written to its database. There is no cross-site tracking: the counts are not combined with data from other sites.
• Who handles it: GoatCounter (goatcounter.com, operated by an individual in Ireland, with servers in Finland and Germany) processes the counts on the maintainer's behalf. Your browser loads a small script from gc.zgo.at and sends the count to this site's address at goatcounter.com, so those two hosts see your IP address as any host you contact does. The maintainer reads the totals in GoatCounter's dashboard.
• Do Not Track is respected. If your browser sends a Do Not Track signal, the script is not loaded and nothing is sent to either host. Content blockers that block the script have the same effect, and nothing on the site depends on it.
• How long: the totals contain no personal data. By default nothing deletes them on a schedule; the maintainer can delete the whole GoatCounter site, and with it all the totals, at any time in GoatCounter's settings (GoatCounter says copies can remain in its backups for up to 30 days).

Third-party requests

The pages are hosted on GitHub Pages, so GitHub receives each page request as any web host does. Fonts, styles and the site's own scripts are served from the site itself, except the visit-count script described below. A few features load something from another company, and any request to another host necessarily shows that host your IP address and browser details:

• gc.zgo.at and goatcounter.com: the visit-count script and the count itself, on every page except the playground; skipped when your browser sends Do Not Track (see "Visit counts").
• cdn.jsdelivr.net (the jsDelivr CDN): the Supabase browser library on the Change Feed Playground.
• img.youtube.com: a video thumbnail on the Tooling page.
• www.youtube-nocookie.com: only if you click play on that video, which then loads YouTube's player.
• buttondown.com: only when you press Subscribe on the newsletter form, as described under "The newsletter signup".
• Supabase, the database host: when you send an assistant vote, and whenever you open the Change Feed Playground, as described above.

These companies handle those requests under their own privacy policies, and Supabase may keep its own technical logs of the requests it receives. Links on the site to other websites are ordinary links: nothing is sent until you follow one.

How long we keep it

Assistant feedback records are kept for 12 months. A scheduled database job runs every day and deletes records older than that, so no one has to remember to do it. This policy took effect on 2026-10-09.

This applies only to assistant feedback. Change Feed Playground events and saved scenarios are kept for a much shorter time: 30 days. A separate scheduled job runs every day and deletes playground events and saved scenarios older than that, so a record can last up to about 31 days before it is removed, and a playground share link stops working once its scenario is deleted. The 30 days start from the database server's time when the record is stored; a visitor's device clock cannot change that. The playground also asks you, on the page, to use made-up data only. This policy took effect on 2026-10-09.

Newsletter subscribers are a separate case: Buttondown, not this site, keeps your address for as long as you are subscribed. What it keeps after you unsubscribe is set by its privacy policy and its own clean-up schedule.

Who can see it

Assistant feedback: the site's maintainer, Christopher Ennis, reads the records in the Supabase dashboard. Your browser is only allowed to add records: it cannot read any back, and visitors cannot see each other's questions. Supabase, as the database host, also has technical access to the service it runs.

Change Feed Playground: events are readable by anyone, and other playground visitors see new events live while they are stored. A saved scenario is readable by anyone who has its link (see above) until it is deleted after 30 days. Visitors' browsers can only add playground records, and read events; they cannot change or delete any record.

Asking about or deleting your entry

You can ask what is stored or ask for an entry to be deleted. The private route is a message to the maintainer on LinkedIn, or an email to the address on the contact page. You can also open a GitHub issue, but issues are public: say only that you want to be contacted about a deletion, and send the details privately.

Never paste your question, a playground share link or any other private text into a public issue. A share link is a key: anyone who holds it can open that saved scenario.

Because nothing identifies you, an entry can only be found if you can tell us the exact question you asked and roughly when you asked it. Without that we cannot tell which record is yours, and it will be deleted automatically within 12 months anyway (playground records within about 31 days). For a saved playground scenario, send the share link privately (LinkedIn message); for playground events, tell us roughly when you used it and what you entered.

Changes to this page

If what the site stores changes, this page is updated in the same change and the "Last updated" date at the top of this page moves. The full history is in the public Git log.