Privacy

What you hand over on purpose

Four places on this site ask you for anything: the newsletter box, the free tools, the contact form, and the assessment's results screen. The last three have sections of their own below. The newsletter box appears on the weekly brief page, at the foot of some articles, and in front of each free tool's first result.

• Buttondown, the mailing list service, receives your email address. That is the whole of it.
• Every issue has an unsubscribe link, and using it takes the address off the list.

The free tools

The review reply generator and the automation ROI calculator run in your browser. What you type into them is not sent to us, to an AI service or to anyone else.

• Before a tool shows its first result, it asks for your email address. That is the newsletter subscribe described above: Buttondown receives the address and nothing you typed into the tool, and the address joins the weekly newsletter. Once you have given it, the other tools show their results without asking again.
• Two things are remembered in your own browser and never sent anywhere: vetted:free-tools:subscribed, that you have given an address; and, for this tab only, a vetted:free-tools: key per tool holding what you typed, so a reload does not lose it.
• Email it to me opens your own mail app with the result filled in and your address in the To line. We do not send that email and never see it.

See the free tools

The contact form

The form on the contact page sends what you type to us when you press Start the conversation, and not before.

• It sends your name, your email address, your business name or website, what you wrote, and the two one-tap answers if you picked them. With them go the page you came from on this site (or the other site's name), any utm tags on the link you arrived by, and the time.
• It is stored securely with Upstash, in the same database as the page views and under its own key, where only our team reads it. Stored messages are deleted after a year: each new message clears out any older than that, and the whole list deletes itself if a year passes with none. Only the latest 500 are ever kept.
• Where email delivery is switched on, a copy is also emailed to our inbox through Resend, the email service. An email we receive stays in our inbox like any other, and is deleted if you ask.
• Your network address is not saved. It is read once, to stop one machine sending the form over and over: a scrambled form of it is held in the server's memory for ten minutes and never written down.
• Nothing you send is published, and nothing adds you to the mailing list.

See the form

The assessment

Twelve questions, scored in your browser. The answers live in the page's memory while you are on it, and they are kept only if you send them to us from the results screen: to get the roadmap by email, or to get our take.

• Until you send them, nothing writes an answer to disk, to a server, or to any storage your browser keeps. Close the tab and they are gone.
• If you ask for the roadmap by email, the form sends your email address, your twelve answers, and whether you ticked the box for the Friday brief. We email you the roadmap once, through Resend, the email service. It is a message you asked for, not a newsletter, and it adds you to no list.
• If you tick the box for the Friday brief, we pass your email address to Buttondown, the mailing list service, and nothing else. Buttondown emails you to confirm before you are on the list.
• If you press Send to us on the results screen, the form sends your name, your email address, your note if you wrote one, and your twelve answers. The score, the band and the six area scores are worked out again from the answers on our side and kept with them, so we can reply with a follow-up.
• Either way, what you sent is kept where a message from the contact form goes: stored securely with Upstash under the same key, where only our team reads it, with the score, the band and the six area scores worked out from the answers, and for the roadmap, whether the email went. Answers sent for our take are also emailed to our inbox through Resend where email delivery is switched on. Stored copies are deleted after a year, with only the latest 500 of every kind together ever kept. Your network address is not saved, and neither form adds you to the mailing list unless you tick the box.
• The roadmap link carries your answers after the # in the URL. Browsers do not send that part of a URL to a server, so the roadmap is drawn on your own machine from a link only you have. Forward the link and you forward the answers with it.
• Buttondown never receives an answer, and the roadmap link never carries an address.

What a page view records

When you open a page, your browser tells this site which one. The site works out roughly where the request came from, the way any web host can, and keeps the place instead of the address it came from.

• What is kept is the page, a city, region and country, a point on the map rounded to about 11km, and the time. Your network address is read once, to stop one machine flooding the count: a scrambled form of it is held in the server's memory for a minute and never written down.
• This record sets no cookie and keeps no identifier, so two pages you open are two separate records in it that nothing connects.
• If your browser sends Do Not Track or Global Privacy Control, nothing is recorded, and your browser does not send the request at all. Crawlers, link previews, prefetches and browsers driven by a program are not counted either.
• Page views are public. The page at /activity shows each one as a sentence like "someone from Winnipeg viewed the tool directory", for anyone to read.
• Page views are deleted after 30 days, and only the most recent 1,000 are ever kept.
• They are stored with Upstash, which runs the Redis database they live in.

Google Analytics

On vetted.tools, this site runs Google Analytics 4, Google's measurement service, so we can see which pages are read, how people find them, and what to write next. It is the one third-party script on the site, and it is separate from the page-view record above.

• What it collects: the pages you view and how long you stay, the site or search that sent you, your device type, browser, operating system, screen size and language, roughly where you are (city and country, which Google works out from your network address and does not store), and things you do on a page that it measures by default, such as scrolling to the foot of it, clicking a link that leaves the site, or downloading a file.
• It sets first-party cookies named _ga and _ga_SPZ0N2QDCY, which hold a random identifier so that two visits from the same browser count as one visitor. They last up to two years.
• What it collects goes to Google, which processes it for us, under Google's own privacy policy (policies.google.com/privacy). We see it as totals and reports; we do not use it to identify you and do not join it with anything you send us.
• If your browser sends Global Privacy Control or Do Not Track, the tag is never loaded: no cookie is set and nothing is sent to Google.
• You can also block or clear cookies for vetted.tools in your browser, or install Google's own opt-out add-on (tools.google.com/dlpage/gaoptout), which stops Google Analytics on every site.
• It does not run on any other address this site is reachable at, such as its preview links.

What happens whether you do anything or not

• This site is static files on Vercel. Vercel keeps the request logs every web host keeps: the URL asked for, when, the browser's user agent, and the network address it came from. We do not read them page by page and nothing joins them to a person.
• One third-party script, Google Analytics, described above. Nothing else from another company runs on a page here.
• The only cookies are Google Analytics' two, described above. The site's own page-view record and everything else here set none.
• A few small things are kept in your own browser and never sent anywhere: vetted:entrance, and a vetted:entrance: key for each page with an opening drawing, for this visit only, so an opening animation does not replay on every click; theme, if you chose light or dark in the footer; vetted:tools-view, the layout you picked for the tool directory; sound, if you turned the click sounds off; one vetted:playbook: key per use case whose steps you have ticked off; and the free tools' keys, described above.
• The fonts are served from this domain rather than from Google Fonts, so reading a page here does not tell a font host you were here.

Pictures other companies serve

One kind of image on this site is fetched by your browser from a host that is not ours, which means that host sees a request the way any host does.

• A few tool marks are generated avatars from api.dicebear.com, for the tools that have no logo of their own. They are sent with a no-referrer policy, so that host is not told which page of ours you were reading.
• Every other picture, including the tool logos and the cover image each tool's own site publishes, is fetched by this domain's own image service rather than by you, so the tool's server sees our server and not your browser.

Links that leave

• When we link out to a tool's own site, or to a source cited at the foot of a page, the link carries two utm tags naming this site. That is so the site you land on can see the visit came from here.
• That is the whole of it: no redirect, no affiliate tag, nothing that identifies you.
• Outbound links are marked noreferrer, so the site you land on is not told which page of ours sent you.

Asking about any of this

Write to hey@vetted.tools. If you want an address taken off the mailing list and would rather not use the unsubscribe link, say so and it goes.