Privacy

Optional marketing analytics

We use PostHog to understand visits to our public marketing pages. The US default applies only after our regional notice appears. Elsewhere, we ask for acceptance before sending analytics or setting a visitor cookie. Rejecting also prevents cookieless analytics. Do Not Track and Global Privacy Control override acceptance.

When analytics is on, PostHog receives a random visitor identifier, the public page category, and selected link-click categories (express interest, open the 2027 check, or copy the agency link), form receipt/failure categories and scrubbed error locations in our compiled site code. A receipt is not proof of a unique new submission or email delivery. Error messages are excluded. We do not send form entries, check results, names, emails, full URLs, query strings, referrers, search terms, device models, or activity in the authenticated product. We do not create person profiles or link this identifier to an account. Our PostHog project has IP-address storage and location enrichment disabled. PostHog necessarily receives connection metadata when a request is made.

When analytics is on, PostHog uses secure, host-only cookies and local storage for a random browser identifier and session state. Cookies expire after up to 30 days and may renew with activity. Browser storage can retain identifiers until you disable analytics or clear storage; an explicit acceptance expires after up to 180 days. Rejection remains until you change it. A regional default is not saved as explicit consent, and earlier refusals are preserved. Use Privacy choices or Disable analytics in any page's footer. Disabling removes optional analytics cookies and SDK storage and stops further capture; it cannot recall events already received. Reaccepting creates a new identifier.

PostHog processes these analytics in its US cloud region. Its published event-query history windows are one year on free plans and seven years on paid plans. These windows limit which events can be queried; they are not automatic deletion deadlines. Cookie expiry and revoking consent do not delete events already received by PostHog. We do not promise deletion after 30, 90, or 180 days. See PostHog's event retention explanation.

For a question or deletion request, email hello@foxhill.works. We do not link analytics identifiers to your email and cannot locate your anonymous history from an email address alone. We will explain the deletion options available; we do not promise individual anonymous-event deletion that our provider does not support.

What we collect, and why

• Interest and access requests. Name, email, the audience page you submitted from (agency, trainee, or supervisor), organization when provided, and whatever optional fields you fill in. Used to review your request, reply, and send an invite if approved. Nothing else.
• The feature vote. Your forced-choice trials (the pair, your pick, which side, how long you took), your three social-validity answers, and your worksheet numbers only if you tick the box. All stored under a random session id that lives only in your browser tab. Not linked to your name or email, and we don't try to link it.
• The 2027 check. Nothing you enter is stored. We log one anonymous line per check (pathway and verdict) to count usage.
• Operational data. Rate limiting uses your IP address in memory only. Our firewall keeps a small sample of request metadata for a few hours. Application logs hold no IP addresses or user agents and are deleted after 30 days.
• Confirmation email. If you request access, you get one confirmation email. No list, no drip sequence, no resale.

What we don't do

• No advertising pixels, session recordings, or automatic collection of clicks, form contents, or errors.
• No pre-filled "industry average" numbers in the worksheet, and no storing it without the box ticked.
• No selling, renting, or sharing your information with anyone for their own use.
• No automated processing of email you send us. A person reads it.

Where it lives, and who touches it

Submissions live in Amazon Web Services (US regions), separate from the product databases. The site uses AWS for hosting and storage, and AgentMail for email at foxhill.works addresses. PostHog processes optional marketing analytics in the US. The site holds no health information and nothing about anyone's clients.

Retention and deletion

Access requests are kept while the preview program runs. Feature-vote responses are kept anonymously for planning. Application logs expire after 30 days.

To delete your request, email hello@foxhill.works from the address you used. We delete it and confirm in writing, usually within 7 days. Deleted records can sit in encrypted backups for up to 35 days. Feature-vote rows can be deleted too if you send the session id (foxhill_session in your browser's session storage) while the tab is still open; without it we can't find them.

Changes and contact

If this changes, the date above changes with it. Questions: hello@foxhill.works.