Your data is yours

This is a commitment, not a contract

No lawyer drafted this and it is not trying to sound like one. It is the way we work, written down so you can hold us to it. If any of it stops being true, this page changes before the practice does.

What this site does today

Using the diagnostic means signing in — you give us an email address, we send you a link, and that address becomes your account. Your uploads and reports are stored under it so you can come back to them. Reading the site asks nothing of you.

Browsing this site stores nothing about you on our own machines — not an email address, not a log of the pages you opened. When you request a sign-in link, your network address is held in memory for up to an hour, for rate limiting only; it is never written to disk or logged. What you upload under your account is stored under the rules below, and nothing else is. Something else does count your visit, and the next paragraph is that.

Two things switch it off, and short of those, every page here loads Google Analytics: being signed in, and opening a page through a private link. A script arrives from googletagmanager.com and reports the page you opened to google-analytics.com, and what goes with it is what a browser tells any site it asks for a file: which page, when, where you came from, your language, your screen size, and your network address, which Google turns into an approximate location. It writes a pair of cookies on your device so a returning browser can be told from a new one. What comes back to us is counts — how many people read a page, and roughly where from. We are not given your address and we cannot pick you out of it. Signed-in pages carry none of this: no script, no request to Google, nothing new written. Neither does a page opened through a private link — if the link you followed carries a key that opens it, that page is not measured at all, and whoever sent it to you is not told that you opened it. A cookie already on your device stays until it expires or you clear it, because we can stop writing one and cannot reach into your browser to take it back.

If you have an account, your uploads and reports are stored so you can come back to them. They are held while your account exists and deleted in full — every row, immediately — when you delete it. You can delete your account yourself, on the account page, and we will not ask why. You always keep your own copy.

We send you email for one reason: the sign-in link you asked for. There are no newsletters, no product announcements and no marketing of any kind, and your address is stored as the name of your account and nothing else.

Four things are kept, and every one of them is kept on YOUR device rather than ours: the light-or-dark choice, if you make one; a copy of the stylesheet and brand images so the site loads fast and works offline; the films, the walkthrough or a venue's, if you ever press play on one, which your browser holds for up to a year so a second viewing costs you nothing; and the pair of cookies Google's analytics script writes, described above. Clearing your browser's data for this site removes all four. We never see the first three at all, and the fourth is read by Google rather than by us.

The honest edge of this: the site runs on somebody else's hardware, the way every site does. We keep no request log of our own and we read nothing from the host about who visited — the counts we do have come from the analytics described above and from nowhere else. The infrastructure between you and us is not ours to make promises about, so we do not make any.

The walkthrough film and the venue films are files held at Cloudflare rather than on our own machine, so the pages that carry them ask your browser for something from an origin that is neither ours nor Google's. Nothing is fetched until you press play — until then each film is a still picture and nothing else. On a private preview, the kind of page opened only by a link sent to a venue, that still picture is held at Cloudflare too, so opening the page asks Cloudflare for it. When you do press play, your browser asks Cloudflare for the film directly, and Cloudflare sees your network address the way any host sees whoever asks it for a file. Cloudflare tells us nothing about who asked for the film, and puts no script of its own anywhere on the page.

When a venue shares its numbers

The rest of this page is about the diagnostic proper: what happens when a venue hands over ninety days of its own transactions and we work on them WITH the venue rather than in a browser tab. These commitments cover everything a venue puts in our hands — every upload and every report is a venue's numbers just the same, held under the account that sent them.

It stays yours

A venue's transaction and door data is the venue's property. Handing it to us does not change that and does not give us rights to it. We use it for one thing — working out the answer for that room — and for nothing else, ever.

Not every number about a venue is the venue's property. A posted occupancy, a licence, a filing, a figure a venue has published itself — those are public records, and we read them the way anybody can, without asking. When we show one we say where it came from and link to it, so you can check it rather than take our word. What being public does NOT do is give us any claim on the rest: a venue whose occupancy is posted on a wall has not handed us its till.

When the two meet, the venue wins. A report we work out from your export and a public record together is treated as YOURS, entirely, because it could not exist without your numbers — so every promise on this page covers it. Mixing in something public does not turn your report into ours, and it never will.

Nobody is named without saying yes

Anonymous by default, and the default is not negotiable: no venue is identified in anything public, in any case study, in any figure or in any conversation, unless that venue has explicitly agreed to it. And we ask AFTER the report is in your hands, never before — asking first turns a favour into a price, and you cannot judge what you are agreeing to until you have seen what we found.

illustrative example So there are two ways a venue comes to be named here, and neither of them is yours: what you will never see is a figure worked out from a venue's own data sitting under that venue's name, unless they read it first and told us yes. A real venue appears only where every figure on the page is either a public record we link to or our own simulation, labelled as simulated right where it is shown. And we keep an invented venue for the same purpose, so you can see the difference. It is called Pigfox Cantina.

Confidentiality runs one way

We keep what you share confidential. You owe us nothing in return — no reciprocal agreement, no obligation to keep quiet about us, nothing to sign. Tell whoever you like whatever you like about the work; the obligation is ours and it does not have a matching clause.

Never sold, never shared, never fed to a model

We do not sell your data. We do not pass it to third parties. We do not pool it into a dataset, use it to train a model, or build anything on top of it beyond the diagnostic you asked for. If we ever want to use a number of yours for anything else, that is a question we ask you, and the answer we assume in the meantime is no.

The sample dataset published on this site is generated by our own simulation, not derived from anybody's real venue. That is the point of it.

Kept while you keep it, deleted on request

An export and its report are kept while your account exists and deleted in full when you delete it — sooner, on request, without being asked why.

That is the whole of it. If something here is unclear or you want a commitment this page does not make, it is a fair thing to raise when we speak.