Legal

Version 1.0 — effective 22 September 2026.

This is a short document because there is not much to say. We designed the site so that we hold nothing that identifies you, and this page tells you exactly what that means, what we do hold, and what we cannot do as a result.

Who we are

Private Anecdata is run by an individual in Oregon, United States, who will be named here when the project incorporates. Every commitment on this page binds the operator now and any successor entity then; see Terms §4 and §11. Contact: the contact page. Oregon law governs. The complete list of third parties involved in running the site is in Subprocessors; it has [two] entries.

What a report contains

When you contribute, you answer a fixed set of multiple-choice questions about one compound: which compound, how you used it (route, dose range, frequency), where it came from (the kind of source, never the vendor), how long you took it, whether you had it tested, what you were hoping for and what you observed, any effects from a fixed list with when they started and whether they stopped, whether you are still taking it, and — optionally — an age band and sex. Every question offers only rounded answers: a dose range rather than a milligram, a duration bucket rather than dates, a kind of source rather than a name. There is no free-text question anywhere on the report form, and nothing you could type there is ever stored: the server accepts only values from the fixed lists. (The page contains one invisible text box that exists to catch automated submitters; anything in it causes the submission to be discarded.) The complete field list and every allowed value is in the schema.

The server adds the day it received the report — the day, not the time — and a random secret value used only to commit the report to the public append-only log described in How we count reports. That is the complete record.

What we do not ask for and do not record

No name. No email address. No account. No phone number. No location of any granularity — not your country. No date of birth. No cookie, and no identifier stored in your browser. No free text. No vendor, pharmacy, clinic or brand.

We do not log your IP address with any request. The web server’s access logging is off. Two exceptions, stated because they are true: if a TLS connection fails before it becomes a request, the web server writes the failing address to a process log; and if the web server cannot reach the application (for example during a restart), it logs the error with the address, headers and path deleted by our configuration. Both logs live in memory and expire within a day. The application keeps no request log. The hosting configuration is published in the repository so this can be checked.

Two things touch your network address without recording it. To limit abuse, the application computes a hash of your address together with a random value that changes every hour, keeps the count in memory only, and never writes it to disk; after an hour it is unrecoverable even by us. Our host necessarily sees network traffic to reach us; what it retains is stated in Subprocessors and Legal process.

The site loads nothing from anyone but us: no analytics, no fonts, no scripts, no embedded content, no CAPTCHA service. Your browser’s network panel should show one host. This is enforced by a check that fails our build if it is ever untrue.

We do not track you, so “Do Not Track” and “Global Privacy Control” signals are honored by construction. We do not sell personal information, share it for advertising, or use it for profiling, because we do not have it.

De-identified by design

A report is not linked to you. It contains no direct identifier, no persistent identifier, and no field that could serve as one. The questions are coarse on purpose, so that the record cannot be matched to a person from what it contains. We have published an analysis of how distinctive a single report is on several combinations of fields, and we re-run it on the real store before every release and publish the summary; see the schema and the Uniqueness of the store section at the end of any release page.

We commit, publicly and without exception, that we will not attempt to re-identify any individual from any report, and that we will not allow anyone else to. We do not search the store for a particular person’s report for any reason, including at that person’s request; doing so would itself be an attempt at re-identification. The reports themselves are never released to anyone in any form — see What we publish — so there is no recipient who could attempt it either. This commitment is the one this statement exists to carry, and it binds us from the moment the first report is accepted.

What we publish

Only the aggregate statistics listed in the release specification, which will be witnessed in a public log before the first report is accepted and cannot be extended without notice. Small groups are suppressed. Individual reports are never displayed, published, shared with researchers, licensed, sold, or transferred, de-identified or otherwise, to anyone, for any reason, including in a sale, merger, insolvency or wind-down of the operator. The one exception we cannot rule out is valid legal process, which could compel production of the store; Legal process explains what that would obtain, and nothing in the store identifies anyone. If this project ends, the store is destroyed; see Shutdown.

What we cannot do

We cannot find, correct, or delete your report after you submit it. Nothing in the report points back to you, and we keep nothing that does — so we have no way to tell which report is yours, and no way to confirm that a request about a report comes from the person who submitted it. This is the ordinary condition of a survey that collects no identifiers, and it is the reason the design protects you: the same property that stops us from finding your report stops everyone else. The form says this plainly on the final screen before you submit. If it is not acceptable, do not submit.

If you write to us asking us to locate or remove a report, we will reply by pointing to this section. Please do not describe your report in that message: a description of your report next to your email address is more identifying than anything we hold. Do not send it. A message sent through the contact page is the one thing you can type on this site. It is stored on our server, forwarded to the operator’s mailbox at the provider named in Subprocessors, used for nothing but replying, and deleted once we have replied and in any case within 30 days of receipt. Give an email address only if you want a reply; it is deleted with the message.

Age

The site is for adults. The youngest age band the form offers is 18–24. Do not contribute if you are under 18.

Where this service is offered

This service is offered from the United States, in English, under Oregon law. It is not directed to, and we do not monitor, people in the European Economic Area, the United Kingdom, or Switzerland.

Changes

This statement is versioned. Every version is in the public repository, and the hash of each version is submitted to a public transparency log when it takes effect, so a change cannot be quiet or backdated. A change that reduces what we promise here does not apply to reports received before it took effect — and since we cannot separate reports by contributor, in practice it cannot apply to the store at all.

Words we do not use

We do not call reports “anonymous.” No data is beyond all possible association with a person, so we tell you what we hold and what could still give you away — see What we can and cannot promise — instead of using a word that promises more than anyone can deliver. “De-identified” has a specific meaning: no identifiers, reasonable measures against re-identification, a public commitment not to attempt it, and contractual limits on anyone who receives the data. Those are the four things this page describes.

Version 1.0 — effective 22 September 2026. Plain language throughout; where a term has a legal function, the function is stated.

1. Agreement

These terms are a contract between you and the operator of Private Anecdata (“we”) — at present an individual in Oregon, United States, to be named in the Privacy statement when the project incorporates. You agree to them in one of two ways: by pressing Agree and submit on the final screen of the report form, which says in the same box that pressing it means agreement to these terms; or by using anything we publish. If you do not agree, do not submit a report and do not use the published releases. Nothing else on the site — reading it, or filling in the form without submitting — creates any agreement or any record.

2. Nothing costs anything, ever

There is no fee, subscription, paid tier, or paid feature, and there never will be. We do not sell anything, list any vendor, carry any advertising, sponsorship or affiliate link, or accept payment from anyone with an interest in any compound. This is a commitment, not a current state.

3. Contributing a report

You may submit a report if all of the following are true:

• You are at least 18.
• The report describes your own use of one compound, from your own experience. Not someone else’s, not a hypothetical, not a summary of what you read.
• You have answered as accurately as the fixed choices allow.
• You are a person filling in the form. No automated submission, no scripted submission, no submission on behalf of a vendor, clinic, seller, or their promotion.

You may report on more than one compound. Report each course of one compound once.

Submission is final. A report is not linked to you, we hold nothing that could link it, and we cannot find, change or delete it afterwards. The form says so in the box next to the Agree and submit button. You receive no receipt and no reference number, on purpose — any such thing would be a link.

We may exclude a report from the published statistics if it fails validation or if the patterns described in the release specification suggest it is fabricated, duplicated, or part of a coordinated submission. Excluded reports are not deleted; they remain counted in the committed log and are listed in every release by position and reason code. We do not know whose they are.

4. What we promise about your report

This section is the reason the project exists, and it is written to survive us.

1. No report is ever disclosed. We will not display, publish, share, license, sell, rent, transfer, or otherwise disclose any individual report, any part of one, or the store of reports, in any form — de-identified, pseudonymised, aggregated below the published thresholds, or otherwise — to any person or organisation, for any reason. This includes researchers, academic or commercial; it includes any buyer, successor, assignee, creditor, trustee or receiver in a sale, merger, reorganisation, insolvency or wind-down; and it includes us in any future form. If the project ends, the store is destroyed under the published shutdown protocol, not transferred. The one thing this promise cannot cover is valid legal process, which could compel production of the store; what that would and would not obtain is stated in Legal process, and nothing in the store identifies anyone.
2. We will not attempt to re-identify anyone, and we will not permit anyone else to. See Privacy.
3. We publish only what the release specification allows, and change it only by the witnessed amendment process it describes.
4. We hold no identifier, and we will not add one. No account, key, receipt, cookie, or token that links a report to a person will be introduced for reports already submitted.

These promises are made for the benefit of every person who has contributed a report. They are irrevocable as to any report received while they were in force. We intend every contributor to be able to enforce them, and we intend a court to treat them as binding on any successor. A later change to these terms does not weaken them for reports already received.

5. Using what we publish

Releases — the tables, figures and files under /releases/ — may be copied, quoted, redistributed and built upon on these conditions:

• Attribution and link. Name Private Anecdata and link to the specific release. Every figure carries its own denominator and caveat inside the image; do not crop them out.
• No re-identification. You will not attempt to identify any contributor, to link any published figure to any individual, or to combine releases with other data for that purpose. This obligation survives any other use you make of the data.
• No promotion. You will not use anything we publish in the advertising, marketing, sale, or promotion of any product, vendor, clinic, or service, or to imply that Private Anecdata endorses, rates, or recommends anything. We rank nothing and endorse nothing; see Analyses we will never run.
• No misrepresentation. Present published numbers as what they are: self-reported, unverified counts, not evidence of effectiveness or safety.

Those four conditions are the licence for the releases: we grant everyone a free, worldwide, non-exclusive right to copy, redistribute and build upon them on those conditions and no others. The documents on this site are offered under the Creative Commons Attribution 4.0 licence (CC BY 4.0). The site’s code is offered under the MIT licence.

6. What this is not

Nothing on this site is medical advice, a recommendation to use, obtain, or avoid any compound, a statement that any compound works or is safe, or a statement about the legal, regulatory, or anti-doping status of any compound in any place — we make none, anywhere on this site. Many of the compounds reported here have little or no published human evidence, and some have no approval for human use from any regulator. Reports are self-reported and unverified. The counts we publish are counts of what people said, not measurements of what happened.

Anecdotal evidence, including consumer-experience surveys, is never sufficient to substantiate a claim about a health product. Talk to a clinician. If you are subject to anti-doping testing, consult your national anti-doping organisation or GlobalDRO; we offer no view on the status of any compound.

This is not a research study. There is no investigator, no protocol, no enrolment, no follow-up, and no institutional review. It is a census of what people report, published as counts.

7. Integrity of the site

You will not interfere with the site, probe or overload it, submit through automation, attempt to access the store, or attempt to reconstruct individual reports from published releases or from differences between releases. We may block traffic that appears to do any of these. We keep no record that would let us identify who did.

8. No warranty; limitation of liability

The site and everything published on it are provided as they are, without warranty of any kind. To the fullest extent the law allows, we are not liable for any loss or harm arising from use of the site or reliance on anything published on it, including any decision about any compound. If liability cannot be excluded, it is limited to one hundred US dollars. Nothing in these terms limits liability that cannot be limited by law.

9. Law and disputes

Oregon law governs these terms, without regard to conflict-of-laws rules. Any dispute is brought in the state or federal courts sitting in Multnomah County, Oregon, and you consent to their jurisdiction. Nothing in this section prevents a contributor from enforcing section 4 wherever we or a successor can be found.

10. Changes

These terms are versioned. Each version is published in the public repository and its hash is submitted to a public transparency log when it takes effect. A change applies to reports submitted and uses made after its effective date, subject always to section 4. If a change would reduce what section 4 promises, it does not apply to any report received before it — and since we cannot separate reports by contributor, in practice it cannot apply to the store at all.

11. General

If any part of these terms is unenforceable, the rest stands. These terms, the Privacy statement, and the documents they link are the whole agreement. Our not enforcing a term is not a waiver of it. You may not assign these terms; we may assign them only to a successor that assumes section 4 in full, and section 4 binds any successor whether or not it does.

Contact: the contact page. Please do not describe your report in a message to us; see Privacy.

Version 1.0 — effective 22 September 2026.

This page states what we hold, for how long, and what we do when someone with legal authority asks for it. It is written so that a contributor can read it before deciding whether to submit.

What we hold

The submission store, as described in SCHEMA.md: one row per report, containing only the coarsened, controlled-vocabulary fields listed there, a received date at day granularity, and a per-row secret salt used for the Merkle log. That, plus any contact messages not yet deleted (below), is the complete list.

The submission store and the site hold none of: IP addresses, user agents, session records, cookies, accounts, email addresses, names, exact timestamps, exact doses, vendor names, locations, or any free text. (A message you send through the contact page is the one place free text, and optionally an email address, reaches us; see Contact messages below.) Access logging is disabled on the web server, the reverse proxy, and the application. There is no CDN, WAF, or third-party edge in front of the origin. The configuration that disables logging is in the public repository.

We also hold: the public source code; the release artifacts, which are public; the exclusion list (the reports left out of the published tables, listed by log position in every release), which is public; and ordinary operational records (billing with our host, DNS, certificates) that contain nothing about any contributor.

Retention

• Submission rows: retained indefinitely. There is no identifier with which to delete a specific row, and the rows are the dataset. See What we can and cannot promise.
• Web server, proxy, and application logs: no access or request log is written. Process logs (startup, certificate renewal, errors) are kept in memory and expire within a day. An address can reach them two ways: a TLS connection that fails before it becomes a request is logged with its address, and a handler error (for example a 502 during a restart) is logged with the request’s address, headers and path deleted by our configuration.
• Rate-limiter state: in memory only, keyed on a salted hash of the client address (for IPv6, its /64 prefix) with the salt rotated hourly and never written to disk. Nothing survives a process restart.
• Backups: the submission store is backed up. Backups contain the same fields as the store and nothing more. Backups are encrypted and retained for 30 days.
• Contact messages: a message sent through the contact page is stored on our server and forwarded to the operator’s mailbox. We delete it once we have replied, and in any case no later than 30 days after receipt. The mailbox provider is named in SUBPROCESSORS.md. We ask that you not describe your own submission in a message to us, because that message would be more identifying than anything in our database.

What our hosting provider holds

Our hosting provider is named in SUBPROCESSORS.md, with its region and a link to its own retention policy. To deliver the site, the provider necessarily receives the IP address of every request. We do not control the provider’s own network logging and we do not claim it does not exist. If that matters to you, the site will also be reachable as a Tor onion service at the address published in SUBPROCESSORS.md once it is live; over the onion service there is no IP for anyone on our side to receive.

What a legal request would obtain

If we are served with valid legal process requiring us to produce what we hold, we will comply with it. What can be produced is: the submission store as described above; any contact messages not yet deleted, including any reply address the sender gave; the public repository; the public releases; and our operational records. Nothing in the submission store contains a field that identifies a contributor, and we hold no auxiliary data with which to attempt an identification — which is also why a contact message must never describe a report.

We will not create, for the purpose of responding to a request, a linkage or analysis we do not otherwise perform. In particular, we will not run a content-based search of the store to locate a specific person’s report: that is the re-identification our design exists to prevent. We have publicly committed not to attempt it, and we will not.

We will challenge requests that are overbroad, that seek data we do not hold, or that seek to compel us to re-identify, to the extent the law permits. We will not describe this as protection for any individual contributor. It is a description of what we will do.

Preservation requests

A preservation request asks us to keep what we have and not delete it. Because we already retain submission rows indefinitely and write no logs, a preservation request changes nothing about what exists. It does not cause us to begin logging anything.

Notice

We do not have any contributor’s contact information, so we cannot notify any individual of a request concerning their report. If we receive legal process that concerns the submission store, and we are not prohibited from doing so, we will say so on this page, with the date and the general nature of the request. We do not operate a warrant canary and do not describe this page as one; no court has held that a canary protects anyone, and we will not imply otherwise.

Breach

If the submission store is accessed without authorization, what is exposed is the set of rows described above. Because no row identifies a person, we cannot notify individuals. We will publish notice of the event on this page and in the Integrity log section of the next release.

Operator: at present an individual in Oregon, United States, as stated in the privacy statement, until the project incorporates. Governing law: Oregon.

Every third party that receives any request from a visitor to this site, or that holds any part of the submission store. This list is short on purpose and is part of the product.

That is the complete list.

There is no CDN, no WAF, no DDoS-protection edge, no analytics service, no error-reporting service, no email service beyond the forwarding described here, no font host, no CAPTCHA service, no third-party JavaScript, no payment processor, and no data processor of any other kind. The contact-page forward is the only thing that ever leaves our server, and nothing about reports is ever in it; retention is as stated in LEGAL-PROCESS.md. The Content-Security-Policy header permits no external origin, and the build fails if any resource references one.

Registrar and DNS for the domain are operational vendors that see DNS queries in the ordinary way and receive nothing about any submission; they are named here for completeness: Porkbun (domain registrar and authoritative DNS).

Backups of the submission store are encrypted to a key held only by the operator, and kept on the same DigitalOcean server; no copy is held anywhere else. Backups contain the same fields as the store and nothing more.

Changes

Any addition to this list is a material change to what contributors were told when they submitted. An addition is published here at least one full release period before it takes effect, with a notice on the site.

Last updated: 22 September 2026. Operator: at present an individual in Oregon, United States, as stated in the privacy statement, until the project incorporates.