Privacy
Last updated 8 September 2026. This page describes what actually happens, and each claim below was verified against the running deployment rather than assumed.
Do not upload identifiable patient data. This service runs on ordinary commercial hosting. There is no Business Associate Agreement, and it is not configured for HIPAA-regulated protected health information. Use de-identified, synthetic, or your own test notes.
What happens to a note you submit
When you choose a file, it is read in your browser using the browser's own file API. The file itself is never uploaded.
When you press Match, the text currently in the box is sent to this site's own server so it can be compared against the trial corpus. There it is held in memory for the length of that single request, used to compute the result, and discarded when the request ends. It is not written to disk, not placed in a database, not retained after the response, and not used to train anything.
We verified this by submitting a note containing a unique marker string and then searching the platform's retained logs for it. The marker did not appear.
What is recorded
Being precise matters more than sounding reassuring, so here is the whole picture, including the parts we do not control.
| Data | Retained? | By whom |
|---|---|---|
| The text of your note | No | — |
| Files you select | No — never leave your browser | — |
| Results of a match | No | — |
| Request metadata: timestamp, HTTP method, URL path, status code, duration | Yes, briefly | Vercel, our hosting provider |
| Your IP address and coarse region | Yes, briefly, at the network edge | Vercel |
| Your browser's local calendar date, sent so that computed eligibility dates are correct in your timezone | Appears in request metadata | Vercel |
| Three counters: a visit, a document loaded, a match run | Yes — as running totals only, never as a record of one visit | This site |
| The host of the site you arrived from, if it is one of a short list named in the source (otherwise counted as “other”) | Yes — as a running total per site | This site |
| Your answer, if you choose to give one, to the single optional question the tool asks after a match: which of five words describes you | Yes — as a running total per answer | This site |
Those last two rows are new as of 8 September 2026 and are described in full below. You can read them at any time: the figures are public.
Log retention and handling are governed by Vercel's privacy policy. We do not export, analyse, or link these logs to anything.
What this site does not do
- No accounts. There is no sign-up, no email address, no password, no profile.
- No cookies. The site sets none, for any purpose.
- No third-party analytics and no trackers. There is no Google Analytics, no Vercel Analytics, no pixel, no session recording, no fingerprinting, and nothing that could follow you to another site. This site keeps three of its own counters, described below.
- No third-party requests. The page loads only its own
HTML, CSS and JavaScript. This is enforced in the browser by a Content
Security Policy of
default-src 'self', so a third-party request would be blocked even if one were added by mistake. - No advertising, and nothing is sold or shared.
You can confirm all of this yourself: open your browser's network panel and watch what the page requests, or read the source, which is the same code that is deployed.
The three counters
A free tool with no sign-up has no other way to know whether anyone is using it. So the site counts three things, and the honest way to describe what it keeps is this: integers, not records. Each event adds one to a number. Nothing is appended to a list, so there is no entry for any particular visit to be found in — a property of how it is stored, not a promise about how it is handled.
- Visits — the page was opened.
- Documents — a note was loaded into the box.
- Matches — a match was run.
There is a fourth. After a match has run, the tool asks one optional question — who you are — and offers five answers. Choosing one adds one to that answer's total. Ignoring it is the default and is what most people will do. Nothing is asked before a match, nothing is ever required, and the answer is a word from a fixed list rather than a free-text box, so there is nothing in it that could identify you even if you wanted it to. It exists because anonymous traffic cannot tell an engineer reading about the compiler from a coordinator who would use it.
Alongside them, one count per referring site: if you arrived from Hacker News, the number next to “hacker news” goes up by one. Only the host is looked at, only hosts already named in the source are recognised, and everything else is counted as “other”. A full referring URL is never stored, because one can contain a search query or the path of a private page.
What the counters do not involve:
- No identifier. No cookie, no stored ID, no hashed IP address, no fingerprint. Nothing recorded can tell whether two visits came from the same person, which is what makes these aggregates rather than a history of anybody.
- Nothing from your note. Not its text, not its length, not what it matched. A counter is not a good enough reason to begin keeping the one thing this service exists not to keep.
- Nothing shared. The numbers are not sold, exported to an ad network, or joined to anything.
One flag is stored in your browser — sessionStorage,
not a cookie — so that reloading the page in the same tab is not counted
twice. It is never sent anywhere and it is erased when you close the
tab.
Two ways to check all of this rather than believe it: the numbers are
published at /stats.html from an endpoint you
can open yourself, /api/pulse; and the roughly
hundred lines that do the counting are
deploy/api/_counters.py,
which is the code that is deployed.
The counters live in a Redis key-value store operated by Upstash, written to by this site's server. Your browser never contacts it, and what is sent to it is a key name and the number one.
Links to ClinicalTrials.gov
Every trial links to its record on ClinicalTrials.gov. Following one takes
you to a US National Library of Medicine site with its own privacy policy.
We send no information about you along with that link — the page sets
Referrer-Policy: no-referrer.
Children
This is a professional research tool and is not directed to children. We knowingly collect nothing from anyone, of any age.
Changes and contact
If this page changes materially, the date at the top changes with it. For questions about privacy, or to raise a problem with the service, contact gelle.learning@gmail.com.