What we collect about you
Almost nothing, and nothing that identifies you. We wrote this by reading the site’s code, so it describes what the site actually does rather than what a template assumes.
Updated : the site now counts page views as daily totals, set out under What we count.
What the site leaves out
- No cookies. The site sets none, for counting, preferences and advertising alike. One tool keeps a note in your browser instead: the buying checklist remembers the items you tick, in your browser’s local storage, so a tick survives a visit to another page. It stays on your device and is never sent to us.
- No tracking. Nothing follows you from page to page or from site to site. The site gives you no identifier and builds no profile.
- No analytics company. The application ships without an analytics library, tag manager, pixel or session-recording tool. The page counts described below are the site’s own, kept in its own database.
- No accounts. With sign-up and login absent, a profile has nowhere to live.
- No advertising, and nothing sold or shared. The only thing our counter keeps is the daily totals below, and we do not sell, rent or share them.
What we count
To learn which pages are read, the site keeps daily totals in its own database. When a page opens, your browser sends one short message naming the page, and the site adds one to a few separate counters for that day:
- The page, by its path alone, such as /cbg/sleep. The rest of the address, after a question mark or a # sign, is never sent or kept; the one exception is a campaign tag, below.
- The width of your browser window, as one of three bands: under 640 pixels, 640 to 1023, or wider. A narrow window on a desktop counts in the narrowest band.
- The country the request came from, as a two-letter code that the hosting provider adds to each request. Our code never reads your IP address.
- Where a visit began, on its first page only: the website that linked you, reduced to its domain name (google.com or perplexity.ai, say), and the link’s campaign tag (utm_source) if it carried one: kept only when it is one of a fixed list of names, such as chatgpt.com or newsletter, and counted as “other” otherwise.
- A few named actions, as totals: running a search, opening a search result, a search that finds nothing, following a link to PubMed, printing a compound card and playing the endocannabinoid system animation. What you searched for, and which result you chose, are never sent.
Each counter is a number on its own, such as “views in the narrowest band on 23 September: 41”. No counter is linked to another, so no record describes a visit or a person. On a very quiet day a few separate totals, read together, could still reflect a single visit; only the site’s owner can see them.
What we never collect
- Your IP address. The hosting provider sees it in order to deliver the page (see below); our code neither reads nor stores it.
- Your browser’s user-agent string. The counter checks it in passing to skip obvious bots, and keeps none of it.
- Any identifier. No cookie, device ID or fingerprint, and nothing in your browser’s storage for counting.
- Anything you type, search queries included, or any text from a page. With JavaScript on, the search box keeps your query in your browser: it travels after a # sign, which browsers do not send. Without JavaScript, or from a link to a results page, the query is part of the address (?q=…), which reaches the hosting provider like any address; our counter still never reads or keeps it.
- Full addresses. Not the query string or # fragment of any address, apart from the campaign tag above, and not the address of the page that linked you, only its domain name.
- Your location beyond the country, and anything that would link one count to another.
Where the counts are kept, and for how long
The totals are stored in the site’s own database, a Postgres database hosted for the site by Neon, and not with an analytics company. Totals more than 400 days old are deleted with the first count the site records each day.
Only the site’s owner reads them: on a private statistics page that asks for a password and that search engines are told not to index, or with the owner’s own tools.
Turning counting off
If your browser sends a Global Privacy Control or Do Not Track signal, nothing is counted. A browser that reports the signal to the page sends no message at all, and the server discards any message that carries either signal. Blocking JavaScript has the same effect. There is nothing to accept or decline, because counting stores nothing on your device.
What the server has to see
Serving a page means seeing who asked for it. Vercel, a commercial hosting provider, serves the site, and like any web server it processes the request data it needs to return a page: your IP address, the address requested, and your browser’s user-agent string. It keeps short-lived request logs of its own, under its own privacy policy. Of that request data, our code uses the page requested to serve it and reads the user-agent string only to skip bots when counting. Our counter keeps no record of individual visitors, and we build no profile from the host’s logs or combine them with other data.
The Atlas assistant, and what would change
One feature would change the picture. CBG Atlas has a research assistant, Atlas, which is switched off behind a server flag. Turn it on and your questions to it would go to a third-party model provider to be answered, a materially different privacy position from everything above.
We describe it while it is still hypothetical, so that any new data flow arrives in plain view. If Atlas is enabled, the policy changes in the same release, before the feature reaches a reader.
Why the policy is short
Most privacy policies run long because the practices behind them are complicated. Ours are simple, and a policy padded with options held in reserve would fall short of the standard the rest of the site holds itself to.
The policy describes current practice, and it changes only when the practice does. Peregrine Biopharma funds the platform and holds no editorial authority.