Privacy
This site grades companies on whether their privacy policies answer a plain question. It would be indefensible for its own notice to be vague, so this one is specific. Here is everything collected, why, for how long, and what isn't collected at all.
1. Reading the site
Nothing is collected. There are no accounts, no analytics, no tracking pixels, no advertising network and no cookies. Every page is static, and the built pages make no requests to any other domain: no fonts, no scripts, no images, not even a favicon service. Sponsor logos are files on this server. That's checkable. Open the network tab and you'll see requests to this domain and nowhere else.
Verdicts do link to companies' own policies, and the advertising page links to a payment provider. Those are links. Nothing is fetched from them, and nothing about you goes anywhere, until you choose to click one and leave.
One thing is stored in your browser: a theme value remembering whether you chose light or dark. It never leaves your device and isn't a cookie. Clearing site data removes it.
The exposure report is built entirely in your browser. Which apps you select is never transmitted. The weekly email beside it is separate and optional, and section 3 says what it stores.
2. If you send a correction
The correction form is the only way to send anything, and only if you choose to. It stores exactly four things: whether you are reporting an error or suggesting a service, which verdict it concerns, your message, and your email address if you supply one. It's optional and the form works without it. No IP address, no browser fingerprint, no referrer, and no identifier tying one submission to another.
It's used to check the correction and, where you left an address, to reply to you. It's never used for anything else, never sent to anyone, and there's no mailing list to be added to.
Submissions are held for 12 months from the day they arrive and then deleted, by a job that runs every day. A correction that changes a verdict is published on the page it concerns, and what appears there is the correction itself: never your email address, and never your name unless you ask to be credited.
3. If you subscribe to the weekly email
The sign-up on the change feed and your stack stores three things: your address, the apps you chose to watch (or none, for everything), and the time you clicked the confirmation link. Two random tokens sit beside them, one for confirming and one for unsubscribing. No IP address, no browser details, no record of which emails you opened or which links you followed. The emails carry no images and no per-reader links, so there's nothing to record.
Nothing is sent until you confirm, and an unconfirmed address is deleted after 14 days. One email goes out on Tuesdays, only in weeks where a policy moved, and every one carries an unsubscribe link and the standard one-click unsubscribe header. Unsubscribing deletes the row. It isn't kept as a suppression. What is kept is a count per day of how many people confirmed and how many unsubscribed, as numbers with no address attached, so the site can tell whether the email is worth sending. The address is used for this email and nothing else, and it's never given to anyone.
4. Who processes it
The site is served by Cloudflare. Correction submissions and email subscriptions are stored in a Cloudflare database, and the weekly email is sent through Cloudflare's email service, in each case as a processor acting on our instructions. Like any host, Cloudflare handles the network request that delivers a page to you, which necessarily includes your IP address. We don't receive that data, and we don't ask for it. The figures read back are aggregate counts of requests and countries, which is what the traffic panel on this site is built from. Since 5 September 2026 they also include a daily count of requests per page and per referring site, reduced to the site's host name before it's written down, together with Cloudflare's own count of how many distinct addresses it saw that day, which reaches us as a single number. Since 14 September 2026, for requests that failed with a server error, they include a count per browser or crawler name and per network operator, so a day of faults can be told apart from readers being turned away, and since 22 September 2026 the same counts, by path as well, for requests answered not found or redirected, so a scanner can be told apart from a broken link. That second report is for running the site and isn't published. No individual visitor appears in either. Cloudflare also adds error-reporting headers to every site it serves by default, which ask your browser to tell Cloudflare about connections that fail. Those are switched off here. No header on this site asks your browser to report anything to anyone, and you can confirm that from the response headers of any page.
Nothing is shared with anyone else. There's no advertising network, no data broker and no analytics provider. Sponsors buy a labelled rectangle and are told how many page views the site had. They're never told anything about who saw it, because that isn't known.
5. Your rights, and how to use them
If you sent a correction with an email address, you can ask for a copy of what is held, ask for it to be corrected, or ask for it to be deleted, and it will be deleted, not anonymised and kept. Because nothing else is collected, there's nothing else to ask about. If you've never used the form, this site holds nothing about you at all.
Write to contact@isittrainingonme.com, which is read by a person. If you are in the UK or the EU and think this has been handled badly, you can complain to your national data protection authority. In the UK that's the Information Commissioner's Office.
Who the controller is. This site is run by one person, Josh, in the UK, not a company, and he is the controller, the same person the about page names. A verdict should stand or fall on the sentence it quotes and the archived copy behind it, not on who wrote it, which is why the name isn't on every page. It isn't a way of being hard to reach. If you're exercising a right over your own data, or you have a complaint that needs a full name, ask at the address above and you'll be given it.
6. When this changes
This notice describes the site as it is on 22 September 2026, not as it's intended to be. The rule for anything new is that this page says what it collects before the sign-up appears. The weekly email in section 3 was described here the day its sign-up appeared, and an earlier version of it was removed because it took addresses for a service that didn't exist, which is the failing this site was built to document.
This site archives what companies published and shows the before and after when they rewrite it without saying so. Applying that to ourselves: every change to this page is listed here with its date, so the history of the page is on the page.
- — 28 August 2026: First published.
- — 4 September 2026: Cloudflare's error-reporting headers were switched off, and section 4 says so. The daily count of requests per page and per referring site, starting 5 September, was added to section 4.
- — 5 September 2026: Section 3 added for the weekly email, with the per-day confirm and unsubscribe counts kept beside it. The single distinct-address number read back from Cloudflare was added to section 4.
- — 14 September 2026: Section 5 names the operator, as the about and press pages have since 4 September. Section 6 no longer promises email alerts "if ever built", since section 3 describes them. The failed-request counts by browser and network name were added to section 4. A daily job now deletes submissions after 12 months, which section 2 had promised without anything yet doing it. This list was added.
- — 22 September 2026: The weekly email had gone out on Mondays, not Tuesdays, from 7 to 21 September: the worker's schedule used a weekday number that Cloudflare reads as Monday. Corrected; the first Tuesday email is 29 September. Nothing about what it collects changed.
- — 22 September 2026: Section 5 names the operator as Josh, as the about and press pages now do. Nothing about what the site collects changed.
- — 22 September 2026: Rewritten in plainer English, with no change to what is collected. Section 4 now also mentions the daily counts, by path, browser name and network, of requests answered not found or redirected, which the site's own report started keeping on 22 September.