PrivacyCopy Anchor Link

We use PostHog, hosted in the United States (AWS us-east-1), to understand how the tool is used so we can improve it:

• Pages visited, the path only (for example /chat), never the query string or fragment.
• Features used and timings, event names, counts and duration buckets: that a chat turn happened and how long it took, which tools the assistant used, whether a clarifying question was answered or dismissed, whether a report was opened or downloaded, whether a job was submitted or cancelled.
• For signed-in users, a pseudonymous account id, the random identifier our sign-in system assigns, plus your role (admin or user) and how you signed up (Google or email).
• Browser and device type, screen size, and the origin and path of the site you arrived from.
• Which elements you click. Which button or link, and where it sits in the page structure, never the words written on it.

What is never collectedCopy Anchor Link

• The questions you type into the assistant, its answers, or any generated SQL.
• Query results, addresses, block groups, or any value derived from the licensed datasets.
• Report or conversation titles.
• Your email address or name.
• Your IP address. It is discarded at ingestion and never stored, and no location is derived from it.
• The text of anything you click. Click tracking records which element, with the words masked before the event leaves your browser.
• Anything at all from these parts of the app, which are excluded from click tracking entirely: the assistant conversation, result and cohort cards, generated queries, the map, a compiled report, the address list on a job, the filter builder, and your settings page.
• The words on your screen in a session recording. Recordings are on, and they capture layout and interaction with every piece of text replaced by a placeholder before it leaves your browser. The parts of the app listed above are removed from the recording entirely, as are all network request and response bodies, the map canvas, and any embedded report.
• The text under a heatmap. Heatmaps and dead-click detection record where on a page people click, not what the element says.
• Page-speed measurements are collected as timings only, never the addresses of the resources being timed.
• Error messages and stack traces.

These are enforced in code, not by policy, on both sides. In the browser, an allowlist drops any event or property outside a fixed schema and rewrites every web address to its origin and path; text masking and the excluded regions above are set in the same file, and a test fails if any of those regions loses its marking. On our servers, each event is a typed record whose fields can only be fixed choices, counts, true/false values and our own random identifiers, so free text cannot be attached to one.

CookiesCopy Anchor Link

Analytics sets one first-party cookie (ph_…_posthog) and a matching localStorage entry, scoped to this host only. PostHog's default lifetime for it is 365 days (persistence). It holds a random device id and, once you sign in, your pseudonymous account id. Signing out drops the link to your account id and issues a new random device id. The sign-in system sets its own session cookies separately; those are not analytics.

Opting outCopy Anchor Link

• Do Not Track / Global Privacy Control. If your browser sends either signal, the analytics client in your browser sends nothing, and our servers drop any event for a request that carries it.
• Deletion. Ask us and we will delete the events and profile associated with your account id from the analytics provider.

Who processes itCopy Anchor Link

PostHog, Inc. AI model training on our data is disabled, PostHog's AI features are disabled, and access to the analytics project is limited to the project's operators. Events are retained for one year on our current plan, which becomes seven years if the plan changes (pricing), and the project is deleted when this work ends.