Privacy
This site asks for one thing — an email address, and only if you want alerts. Here is exactly what happens to it.
If you never sign up
We use Google Analytics to understand page visits and whether people request and confirm alerts. Google Analytics uses cookies to measure visits. We do not send your email address, ZIP lookup, or confirmation and unsubscribe tokens in our Analytics events. Advertising personalization and Google signals are disabled. A ZIP code typed into the lookup is used to match counties to providers and is never written to our database.
If you sign up for alerts
The list is exhaustive: your email address, which provider you asked to watch, two random tokens that make the confirmation and unsubscribe links work, and the dates you signed up, confirmed, and were last emailed. Your ZIP code is not stored even here — the lookup uses it to find your providers and then forgets it.
- Confirmation is required. Signing up sends one email with a confirmation link. Ignore it and you are never emailed again; the unconfirmed row is dead weight that sends nothing.
- Unsubscribing deletes. The link at the bottom of every alert removes the row outright. It is not a flag on a record we keep.
- Your address is never shared, sold, or rented — not to utilities, not to advertisers, not to anyone. It is used to send you the alerts you asked for and nothing else.
Abuse prevention
To stop someone signing hundreds of strangers up, the signup endpoint is rate limited. It records a one-way HMAC fingerprint of the IP address and the email — not the address or the email itself. The fingerprints cannot be reversed into the values they came from, and they are only ever compared against each other to count recent attempts.
Who else is involved
- Supabase hosts the database. Subscriber tables are readable only by the server, never by anything running in your browser.
- Resend delivers the email, and therefore handles your address in order to send it.
- Vercel serves the site and keeps standard server logs.
Getting your data removed
Use the unsubscribe link in any alert — it deletes immediately and needs no account or reply. If you never received one because you never confirmed, there is nothing that can reach you and the row holds only what you typed.
Everything above describes what the code does. The database schema and the alerts job are in the repository, and the methodology covers how the published figures are derived. If this page and the code ever disagree, the code is the bug and this page is the promise.