Privacy Policy

Overview

WhatIsBrainFog.com ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

Data controller

Paul Coskun operates WhatIsBrainFog.com. For data protection inquiries, contact hello@whatisbrainfog.com.

Legal basis for processing (GDPR Article 6)

We process personal data under the following legal bases:

• Legitimate interest: Site analytics to understand what public pages people visit, where they go next, and where the interface breaks or causes difficulty. PostHog records public-page navigation and clicks, browser errors, and masked session replays. Replays show public page content and scroll positions. Input values, personal tool results and private areas remain hidden. PostHog is disabled on private routes and does not create person profiles. We also use GA4 in a restricted measurement configuration. GA4 advertising storage, advertising data, personalization, remarketing, and Google Signals are disabled. Neither tool is used for ad targeting on this site.
• Legitimate interest: Server logs and security monitoring (Cloudflare) to protect the site and its users.
• Contract performance: Account features, if you create an account, to provide the service you requested.
• Consent: Optional tool, saved item, check-in, handout, access form, and My Fog sharing choices. You choose what to submit and which optional sharing choices to turn on.
• Consent: Email subscriptions. When you ask us to email you a handout or access link, we send your email address to our mailing provider (Resend) for delivery.

1. Information we collect

1.1 Information you provide

• Contact Information: If you email us at hello@whatisbrainfog.com, we receive your email address and any information you include in your message.

1.2 Information collected automatically

• Server Logs: Our hosting provider (Cloudflare) automatically logs standard web request data, which may include:
  • IP address
  • Browser type and version
  • Operating system
  • Pages visited and timestamps
  • Referring URL
• CDN Data: Cloudflare may collect data for security and performance purposes as described in their privacy policy.
• Analytics Data (PostHog): On public pages, PostHog receives page paths, navigation and click events, basic browser and device information, and browser error details such as error messages and stack traces. We use session replay to see public page content, navigation and scroll positions when reproducing interface problems. We mask input values and personal tool results before replay data leaves the browser. We remove query strings and URL fragments. PostHog is disabled on My Fog, Buddy, account, authentication, review, admin, internal, journal, story-analyzer, community, email, access, unsubscribe, and reader-backing routes. We do not identify signed-in users to PostHog or create PostHog person profiles.
• Analytics Data (Google Analytics 4): GA4 measures page visits, traffic sources, and device types. Advertising storage, advertising data, personalization, remarketing, and Google Signals are disabled. GA4 may set a first-party analytics cookie to distinguish visits.

1.3 My Fog and optional account data

When you use optional interactive features, we may collect:

• My Fog account data: If you use My Fog, the site may store your Brain Fog Check answers and result, saved causes, saved checks, Fog Today check-ins, selected confounders, optional notes, optional intervention tags, linked saved causes, and linked repeatable checks so your account can show your own map and recent trend.
• My Fog consent choices: We store whether you allow account storage, research use, or commercial aggregate sharing. Signed-in My Fog needs account storage. Research and commercial aggregate sharing are optional and default to off. Older accounts may retain a historical community-sharing choice, but that feature is retired and doesn't publish any notebook content.
• Retired sharing records: Existing My Fog records may retain a historical sharing timestamp. WBF no longer provides a Community page, sharing controls, or community feed endpoints. These records are not publicly displayed and remain covered by the account export and deletion controls described in this policy.
• Optional tool and saved-item submissions: If you use a browser-based checker, saved item, or check-in feature, the site may store the values needed to show your saved work or sync it across devices when you are signed in.
• Handout and access forms: If you ask us to send a handout or early-access link by email, we send that address to our mailing provider so it can deliver the message. We may also retain hashed metadata about the request source for abuse prevention and basic reporting.
• Accounts and syncing: If you opt into account features, the account service stores the minimum data needed to identify the account and sync saved items. If you save supported tool results while signed in, we send those values to our Cloudflare Workers + D1 backend so you can see them across devices. If you use browser-only tools without signing in, those values stay in your browser's local storage and are not sent to the server.

1.4 Buddy conversations

When you write to Buddy, we send your message and the recent conversation to Cloudflare Workers AI so Buddy can reply and follow what you've already said. Buddy cannot read your My Fog notebook.

• Not saved to your account by default: The visible conversation stays in that browser. When you next open Buddy, it will not restore an unsaved conversation if more than 24 hours have passed since the last message. The server keeps a smaller working memory for up to 24 hours so Buddy can ask the next question without starting over.
• Optional account saving: If you are signed in, you can choose Save this chat. Only then is the full transcript stored with your account so you can continue on another device.
• Deletion: Stop saving deletes the account copy but leaves the browser copy on that device. New chat deletes the current account copy and Buddy's working memory, removes the browser copy, and starts a separate conversation.
• No AI training: WBF does not use Buddy messages to train or fine-tune an AI model. Buddy messages are not added to Community, research datasets, published content, or editorial summaries.

1.5 Interactive and improvement data

To operate the site and improve weak spots over time, we may collect:

• Tool outputs: saved items, check-in values, tool results, and feedback from optional interactive features.
• Search and navigation events: broad usage data such as page views, search terms, and feature interactions.
• Reviewed feedback and quality data: submitted feedback may be used to improve prompts, triage copy, and quality review.
• Aggregate reporting: counts and summaries that help us see where the site is confusing, incomplete, or underused.

1.6 Information we don't collect

• Advertising or affiliate tracking: We do not run display ads, affiliate links, or third-party marketing pixels on the public site.
• Full payment card information: PayPal processes reader contributions. WBF does not receive or store your full card number or card security code. PayPal holds payment-method and payer-account details under its own privacy statement.
• A mandatory account: You can browse and use much of the site without signing in.

1.7 Reader contribution data

If you choose to contribute, WBF stores provider references, amount, currency, payment state, and timestamps. We also store the account link when you contribute while signed in or redeem a single-use account-linking code. WBF shows the code itself once after checkout and stores only its cryptographic hash. PayPal email is not used to link a contribution to a WBF account. If you ask for a receipt by email, we pass that address to our mailing provider (Resend) to send the receipt. WBF doesn't store the address or attach it to the contribution record. The receipt repeats the amount, gives the name that may appear on your statement, and includes the account-linking code so you don't lose it if you close the page.

Contribution records are used to confirm payment state, manage recurring cancellation, answer receipt questions, and handle receipts, refund requests, disputes, reversals, and chargebacks. WBF keeps them separate from My Fog and other health information and doesn't include them in health exports, research consent, Community posts, or commercial health summaries.

2. How we use information

We use the information we collect for:

2.1 Site operations

• Responding to inquiries you send via email
• Maintaining site security and preventing spam/abuse
• Reviewing submitted feedback and preventing abuse
• Technical troubleshooting

2.2 Site improvement and aggregate reporting

We may use aggregated or review-layer data for:

• Quality review: spotting confusing prompts, weak results, and pages that need better guidance.
• Editorial updates: improving cause pages, handouts, and comparisons based on recurring failure modes.
• Aggregate statistics: understanding which features are used, where people stop, and where trust or usability breaks down.
• My Fog aggregate insights: if enough people have opted in, creating de-identified grouped summaries of people's causes, their check-ins, and what they report as helpful. These summaries leave out groups below a minimum size.
• Moderation and abuse prevention: keeping spam, scraping abuse, and unsafe submissions under control.

3. Cookies and tracking

We use two analytics tools:

• PostHog: public-page navigation, click analytics, browser error capture, and masked session replay. It uses session storage rather than cookies, receives no account identity, and is disabled on private routes.
• Google Analytics 4: site traffic measurement with advertising storage, advertising data, personalization, remarketing, and Google Signals disabled. GA4 may set a first-party analytics cookie.

We do not use Facebook Pixel, advertising cookies, or third-party marketing pixels. No health data from this site is shared with any advertising platform.

Our hosting provider (Cloudflare) may set essential security cookies to protect against malicious traffic. These are strictly necessary for site operation and are not used for ad targeting.

For more information, see our Cookie Notice.

4. Data sharing

We do not sell or rent personal information for advertising or marketing.

We may share information only in the following limited circumstances:

• Service Providers we rely on, by name:
  • Cloudflare (hosting, CDN, DDoS + bot protection, edge logs)
  • PostHog (public-page analytics, browser error capture, and masked session replay with no account identity or person profiles)
  • Resend (transactional email delivery for handouts, access links, and opted-in updates; your email address is sent to Resend so they can deliver the message you asked for)
  • Cloudflare Workers + D1 (the backend for optional account, saved-item, and check-in features, plus opt-in subscription metadata for abuse prevention and delivery)
  • Cloudflare Workers AI (processing Buddy messages and recent chat context to produce each reply)
  • PayPal (processing optional reader contributions and holding payment-method and payer-account data)
• Research and commercial aggregate sharing: If you turn on the matching My Fog consent choice, we may include your information in anonymous, grouped summaries. Partners never receive your individual logs, name, email, account record, or raw notes. Commercial sharing, if it happens, is limited to de-identified aggregate insights with minimum cohort thresholds and sub-cell suppression.
• Business transfers: If WBF goes through a merger, acquisition, reorganization, or sale of assets, account information may transfer as part of that transaction. Your privacy choices stay with your data where technically available, and you can still turn off optional sharing.
• Legal Requirements: If required by law, subpoena, or legal process.
• Safety: To protect the rights, safety, or property of our users or the public.

5. Data retention

Our hosting provider keeps server logs according to their data retention policies (typically 30-90 days). We keep email correspondence as long as we need to answer your inquiry.

Email addresses submitted for access or handout delivery stay in the mailing system until you unsubscribe, ask us to delete them, or we remove them operationally. We keep saved account data, My Fog check-ins, and consent choices as long as the related feature stays active or until deletion is requested where that option exists. If you withdraw optional research or commercial aggregate consent, future aggregate inclusion under that choice stops, though already-created de-identified aggregate reports may not be reversible.

WBF keeps contribution data while it's needed to manage the payment and linked account, and may keep financial records when legally required, including after account deletion. Where retention is required, WBF removes the account link when appropriate but doesn't delete the underlying financial record.

Buddy stops restoring an unsaved browser conversation after 24 hours without a message. Buddy's temporary server working memory expires after no more than 24 hours. WBF stores a Buddy transcript with your account only after you choose to save it. It remains there until you select Stop saving, start a new chat, or ask us to delete it.

6. Your rights

Depending on your location, you may have the following rights:

For EU/UK residents (GDPR/UK GDPR)

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing

For California residents (CCPA)

• Right to know what personal information we collect
• Right to delete personal information
• Right to opt-out of sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising your rights

To exercise any of these rights, contact us at hello@whatisbrainfog.com. You can also change optional My Fog sharing choices from the My Fog page while signed in.

We will respond to data subject access requests within 30 days of receipt, as required by GDPR Article 12.

7. Children's privacy

This Site is not intended for children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us.

8. International data transfers

Cloudflare hosts our site on servers worldwide. By using this Site, you acknowledge that your data may be processed in countries outside your residence.

PayPal operates internationally, so it may process payment data outside your country under PayPal's privacy terms. PayPal processes the payment through the operator's existing business account, which may display Sureokgo on some PayPal or statement surfaces. The WBF checkout itself is labelled WhatIsBrainFog.

9. Changes to this policy

We may update this Privacy Policy from time to time. We'll post changes on this page with an updated "Last updated" date. Your continued use of the Site after changes constitutes acceptance.

10. Governing law

This Privacy Policy shall be governed by and construed in accordance with the laws of New South Wales, Australia, without regard to conflict of law principles.

11. Contact us

For privacy-related questions or to exercise your rights, contact us at:
hello@whatisbrainfog.com