Privacy Policy

This page describes exactly what Supplement Skeptic (supplementskeptic.com) collects, who else sees it, and what you can do about it. It is written against the site's actual code, not against a template. If something here does not match what the site does, that is a bug and we want to hear about it: [email protected].

The short version

We run Google Analytics 4 on every page. It sets cookies and gives Google your IP address and browser details.
We do not ask for your email unless you type it into the newsletter box or the contact form. If you do, it is stored on Cloudflare.
Purchase links are ClickBank affiliate links carrying a tracking tag. Once you click, you are on the vendor's site and under their policy, not ours.
We do not sell personal information, and we do not run advertising networks or retargeting pixels.
There is no cookie consent banner on this site. That is a deliberate disclosure, not an oversight — the opt-out routes are described below.

Who runs this site

Supplement Skeptic is an independent editorial desk that reviews heavily marketed dietary supplements. It is operated as a private publishing project and funded by affiliate commission. The controller for the purposes of UK GDPR and EU GDPR is the operator of supplementskeptic.com, reachable at [email protected]. We have not appointed a Data Protection Officer, because the scale of processing described below does not require one.

What we collect when you just read a page

Analytics

Every page on this site loads Google Analytics 4 through Google's gtag.js library, measurement ID G-GJMKXD8YSQ. It runs on page load, on every visit, for every visitor. It collects:

A randomly generated client identifier stored in first-party cookies (_ga and _ga_GJMKXD8YSQ) so repeat visits can be counted as one person rather than two.
Your IP address, which Google uses to derive an approximate location. We enable Google's anonymize_ip setting, so the last octet of an IPv4 address (or the last 80 bits of an IPv6 address) is discarded before the address is stored or used.
Your browser user agent, screen size, language, referring URL, and the pages you view.

We use this to see which reviews get read and which search terms bring people here. We do not use GA4's Google Signals, advertising features, demographics reporting, or audience export. Google acts as our processor for analytics data and also as a controller for its own purposes under its own terms. Google's handling is governed by the Google Privacy Policy.

Outbound click events

When you click a purchase link, the page fires a GA4 event named purchase_link_click. The event carries the product slug, the position of the button on the page, the page type, the review's verdict, the link's visible text, and the path of the page you clicked from. It does not carry your email, your name, or anything you typed.

The same click also writes a record of that click into your own browser's localStorage under the key ss_clicks, capped at the 50 most recent clicks. That data stays on your device. It is a debugging aid for us when a reader reports a broken link and reads it back to us. You can clear it at any time by clearing site data for supplementskeptic.com in your browser settings.

Server logs and hosting

The site is hosted on Cloudflare Pages. As with any web host, Cloudflare processes your IP address, user agent, and the request itself in order to serve the page, terminate TLS, apply security filtering, and mitigate abuse. This happens before our code runs and we cannot disable it. Cloudflare's handling is governed by the Cloudflare Privacy Policy.

Fonts

Typefaces are loaded from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Requesting a font file discloses your IP address and user agent to Google. Google states that Google Fonts does not set cookies. If this matters to you, blocking those two hosts leaves the site fully readable in a fallback typeface.

What we collect when you give us something

Newsletter signup

If you submit the newsletter form in the site footer, the following is written to a Cloudflare Workers KV store owned by this site:

Your email address, lowercased and trimmed.
A source tag identifying which form you used (for example footer).
A timestamp.
Your browser user agent, truncated to the first 200 characters.
The two-letter country code Cloudflare derives from your connection. We do not store your IP address alongside it.

The lawful basis is your consent, given by submitting the form. Withdrawing it is one email to [email protected] and we delete the record.

Contact form

If you use the contact form, we store your email address, the subject category you selected, your message (truncated at 5,000 characters), a timestamp, your truncated user agent, and the same country code. We use it to answer you and to act on corrections. We do not add contact form submissions to the newsletter list, and we do not use them for marketing.

Both forms write to the same Cloudflare KV namespace. Access to it is limited to the site operator through the Cloudflare account that owns it. It is not connected to any CRM, email service provider, or advertising platform.

Digital product checkout

A small number of pages on this site — the Label Decoder and the tools pages — embed a Whop checkout for a paid digital download. If you buy one, the transaction is processed entirely by Whop. Your card details are never transmitted to, handled by, or stored on Supplement Skeptic infrastructure; the checkout is Whop's embedded component running inside our page. Whop is the merchant of record for those purchases and its handling of your payment and account data is governed by its own privacy policy. We receive order notifications from Whop, not card data.

Affiliate links and ClickBank

Supplement Skeptic earns commission when a reader buys through a purchase link. Nearly all of those links are ClickBank hoplinks. They look like this:

https://hop.clickbank.net/?affiliate=…&vendor=…&tid=seo_skep_<product>

The tid value identifies which of our reviews sent the click. It is a page label, not a person. It contains no identifier for you and is the same string for every reader who clicks the same review.

When you follow one of these links, ClickBank sets its own cookies to attribute a later sale, and then forwards you to the vendor's sales page, which will set cookies and run trackers of its own. From that moment you are on a third party's site under a third party's policy. ClickBank's processing is governed by its own privacy notice, and each vendor's by theirs. We have no access to, and no control over, what those parties collect. We never receive your name, address, or payment details from a ClickBank sale — only aggregate commission reporting.

The site's Referrer-Policy is set to strict-origin-when-cross-origin, so an outbound click discloses only https://supplementskeptic.com to the destination, not the specific page you were reading.

Third parties, named

Google LLC — Google Analytics 4 (usage measurement) and Google Fonts (typeface delivery).
Cloudflare, Inc. — hosting, CDN, TLS, security filtering, and the Workers KV store that holds newsletter and contact submissions.
ClickBank (Click Sales Inc.) — affiliate attribution and commission reporting on outbound purchase links.
Whop Inc. — checkout and payment processing for the paid digital downloads on the Label Decoder and tools pages.

That is the complete list of third parties that receive data through this site. There is no ad network, no retargeting pixel, no session-replay recorder, no heatmap tool, no chat widget, and no data broker. The site's Content-Security-Policy restricts scripts to our own domain plus Google Tag Manager, Google Analytics, and Whop, so a fifth party cannot quietly appear without a code change.

Do we sell your data?

No. We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act as amended by the CPRA. We have never done so. The site does not participate in any advertising exchange, and the interest-cohort=() Permissions-Policy header sent with every page opts this domain out of Google's Topics/FLoC interest-based advertising cohort.

How long we keep things

Newsletter records: kept until you unsubscribe or ask for deletion. There is no automatic expiry.
Contact form messages: kept while a correction or query is open, and deleted on request. We do not intentionally retain resolved correspondence indefinitely, but we also cannot promise an automated purge that does not exist.
Google Analytics data: subject to Google's own retention settings on the property. Event-level and user-level data expires on Google's schedule; aggregate reporting persists.
GA4 cookies: _ga and _ga_GJMKXD8YSQ expire two years after they are last set, unless you clear them sooner.
The ss_clicks localStorage record: lives on your device until you clear site data, and is capped at 50 entries.
Cloudflare logs: retained under Cloudflare's own schedule, not ours.

Your rights under GDPR and UK GDPR

If you are in the UK, the EEA, or Switzerland, you have the right to request access to the personal data we hold about you, correction of inaccurate data, erasure, restriction of processing, portability of data you gave us, and to object to processing. Where processing rests on consent — the newsletter, principally — you can withdraw that consent at any time without affecting processing already carried out.

In practice the only data we hold that identifies you is an email address you typed in yourself, and the message attached to it. Send a request to [email protected] from the address you used and we will act on it within 30 days. We will ask you to confirm control of the address, which is the only verification step available to us, and we do not collect further identity documents to satisfy a request.

Analytics data held by Google is pseudonymous and not keyed to anything we can link back to you, so we cannot retrieve or delete an individual's analytics record on request. The opt-out routes below are the effective remedy for that data.

You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office; in the EEA it is the data protection authority for your country of residence.

Your rights under CCPA and CPRA

If you are a California resident, you have the right to know what personal information is collected, used, and disclosed; the right to delete personal information we hold about you; the right to correct inaccurate personal information; the right to opt out of sale or sharing; and the right not to be discriminated against for exercising any of them.

The categories collected are set out above: identifiers (email address, IP address, cookie identifiers), internet activity (pages viewed, links clicked, referring site), and geolocation inferred at country level. We do not collect sensitive personal information as the CPRA defines it, we do not collect biometric or precise geolocation data, and we do not knowingly collect information about anyone under 16.

Because we do not sell or share personal information, there is no "Do Not Sell or Share My Personal Information" mechanism to operate. Requests to know, delete, or correct go to [email protected]. An authorised agent may act on your behalf with written permission from you.

How to opt out of analytics

There is no consent banner on this site, so analytics is not gated behind a click. These are the routes that actually work:

Install Google's official Google Analytics Opt-out Browser Add-on, which blocks gtag.js from sending data on every site you visit.
Use a content blocker (uBlock Origin, Privacy Badger) or a browser with tracking protection on by default (Firefox strict mode, Brave, Safari). GA4 is blocked by all of them out of the box. The site is fully functional with analytics blocked; nothing here depends on it.
Send Global Privacy Control from your browser. We honour a GPC signal as an opt-out of sale or sharing under the CPRA — which, since we do neither, we are already compliant with by default.
Block googletagmanager.com at DNS or hosts-file level.
Clear cookies for this domain to reset the analytics client identifier.

Children's privacy

This site covers dietary supplements and is written for adults making purchasing decisions. It is not directed at children. We do not knowingly collect personal information from anyone under 13 (or under 16 in the EEA and UK). If you believe a child has submitted an email address through one of our forms, email [email protected] and we will delete the record.

International transfers

Google, Cloudflare, ClickBank, and Whop are US-headquartered and operate global infrastructure, so data described on this page may be processed in the United States and other countries. Each of those providers offers its own transfer mechanism for EEA and UK data, typically the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. We rely on the mechanisms those processors publish; we do not operate a separate transfer framework of our own.

Security

The site is served over HTTPS with HSTS enabled. Submitted email addresses are held in a Cloudflare Workers KV namespace scoped to this project and reachable only through the Cloudflare account that owns it. Form endpoints validate and length-cap every field before writing. No system is perfect, and we will not claim otherwise; what we can say is that the volume of personal data held here is deliberately small, because the least risky record is the one that was never collected.

Changes to this policy

When the site's data handling changes, this page changes with it and the date at the top is updated. We do not maintain a version archive, so if a specific historical wording matters to you, keep a copy.

Affiliate disclosure — how the commission works and what it does not change.
Editorial policy — independence, corrections, and what we refuse to publish.
Medical and product disclaimer.
Contact — the form described above.

Contact

Questions, access requests, deletion requests, or corrections to this page: [email protected]. We aim to reply within 48 hours and are obliged to respond substantively to a formal rights request within 30 days.