Privacy & telemetry posture

Analytics we use, and what they never receive

This site uses two third-party analytics services on its public pages. PostHog, a product-analytics service, shows us which pages and calls to action help visitors and how fast pages load. Google Tag Manager loads Google Analytics 4, which measures site traffic, and the tags that count conversions from our own advertising campaigns. Neither PostHog nor Google Tag Manager runs on sign-in, Lectio study, administration or team pages.

The PostHog script is served from this site's own origin at a fixed version, and your browser checks every event against a fixed list of allowed events and properties before it is sent. PostHog knows an anonymous visitor by a pseudonymous identifier. When you are signed in, PostHog knows you by your account’s internal identifier, and your PostHog profile holds your display name and your verified email address (see Known-user mode). When you react to a page or post, edit or delete a comment while signed in, that event also carries your verified email address and (except for a deletion) your display name (see Reactions and comments). Every other event is checked in your browser and any email address is removed before it is sent. Outside your profile and those events, PostHog never receives your name, email address, organization, phone number, anything you type into a form, the text of anything you select, or the full address of the page that sent you here (only its site). Your browser sends these events to this site's own address (/ingest), and this site's server passes them on to PostHog. It never passes on your cookies or the address of the page you were on. Events carry no IP address field; the server passes on your IP address only so that PostHog can tell which country a visit came from, as it could when your browser connected to PostHog directly. No session recording or heatmap is made.

Some events happen on pages where the PostHog script never runs, so this site's own server reports them to PostHog instead: starting, completing or being refused a sign-in, signing out, saving your profile, a graded knowledge-check answer and the review schedule it sets, a written explanation (its length, never its words), opening your learning record, a comment refused by moderation or spam checks, a submitted data lake request or guide signup, and organization changes such as creating an organization, assigning or ending a membership, a refused team action, or an assignment. The server checks each one against the same list of allowed events and properties. They carry choices and identifiers such as the sign-in method, whether an answer was correct and how confident you said you were, whether your email matched an organization, or which guide you signed up for. These server events leave out your email address, your name, anything you typed and the answer you chose; an organization is named only by its internal identifier, never its name or web domain. When reading tracking is on for your account, the server also keeps your PostHog profile current with the same display name and verified email address your browser gives it, and whether the account belongs to our team or an organization (so that internal traffic can be filtered out); the events themselves still never carry them. A signed-in reader is known by the account’s internal identifier; a form submitted without signing in, or an account that was erased, is never linked to a person.

Through Google Tag Manager, Google Analytics 4 records the pages you view, how you arrived (the referring site and campaign tags), your browser, device type and approximate location, and a short list of events forwarded from this site, such as a contact-form submission or a click on a consultation link. To recognize a returning browser it sets first-party analytics cookies named _ga and _ga_<ID>. Google receives your browser's IP address with each request, as with any web request. Analytics storage and advertising storage are granted for every visitor, because there is no consent banner; ad personalization is turned off. Conversion tags in Tag Manager may also set advertising cookies so a campaign's conversions can be counted. Google Analytics receives none of the form text, names or email addresses described above, and no session recording or heatmap is made.

The telemetry described in the sections below is first-party: collected by this site's own server, into this site's own database, for this site's own operational use.

Known-user mode (Lectio, sign-in)

Some Resource Hub pages offer an optional sign-in (a passwordless magic link, valid 15 minutes) to enable Lectio — this site's precision-education feature, which tracks whether a reader actually engaged with a specific resource, not just whether the page loaded. Signing in is never required to read anything.

Signing in turns on reading tracking (Lectio engagement) for your account: active reading time, scroll depth, comprehension checks and reactions on Netspective guides. It stays on for as long as you are signed in; there is no setting to turn it off, and signing out stops it. You can see your progress across the site from any guide, and you can delete your account's data at any time. Other uses of your account need their own consent scope: profile linkage (connecting your activity across sessions) or communications (contacting you about your engagement). An account with no activity is pruned after 24 months of dormancy by default.

Lectio data is also counted into public, de-identified reading benchmarks: for example, how many signed-in readers opened a page, their median active reading time, and the share who answered its comprehension check correctly. These totals never include your name, email, account, sessions or the times you read, and a figure is published only once at least five different readers stand behind it.

If you are signed in, PostHog also receives your account's internal identifier, so your visits can be understood together, and your PostHog profile is given your display name and your verified email address. Your email address and name are never added to other events, apart from the reaction and comment events described below. Detailed reading records (Lectio study events) are sent too, because reading tracking is on while you are signed in. Signing out ends this: later events are anonymous again.

Forms you send us

The architecture discovery request on the healthcare data lake page stores your name, work email, organization, role and what you are trying to fix, any optional details you add (organization type, cloud provider, project details), and your confirmation that the request contains no patient data. The checklist signup at the end of each healthcare data guide stores your work email and which guide it was for; we use it only to send that checklist and a note when the guide changes.

Both are read only by Netspective administrators and deleted after 24 months. To limit repeat submissions we store a keyed hash of your connection, never the address itself. Analytics never receive what you type into either form. To have a request or signup removed sooner, write to us at the address under Questions below.

Your analytics choices

There is no analytics consent banner: the anonymous measures above run from your first page. If your browser sends a Do Not Track signal, PostHog does not start and nothing is sent to it; Do Not Track does not change Google Tag Manager or Google Analytics 4. Signing in links analytics to your account and turns on reading tracking, as described above; signing out ends both. A content blocker in your browser can block either service.