What this site knows about you.

What the site does not do.

• No analytics. There is no Google Analytics, no Plausible, no Fathom, no heatmap, no session recorder. I do not know how many people visited this page, and that is a trade I made on purpose.
• No tracking pixels, no advertising networks, no social media embeds.
• No third-party content. The fonts, the styles, the scripts and the images that make up this site are all served from this domain. Nothing on the page is pulled in from Google, from a CDN, or from anyone else - including the fonts, which are hosted here rather than loaded from Google Fonts, precisely so that viewing this page does not introduce you to a company you did not choose to visit.

About cookies, including what I cannot tell you.

Stemalytics sets no cookies. Nothing in this site's code creates one, reads one, or changes behaviour based on one. But the company that hosts this site does set cookies, from the web server before any page runs, and describing that accurately matters more to me than claiming a clean sheet I do not have.

• A cookie named __dpl. It is set on every page load and lasts 24 hours, refreshing each time you load a page. It comes from the hosting platform's server, not from anything on the page.
• A cookie named __cf_bm. It appears in some browsers and not others, and lasts about half an hour. This one belongs to Cloudflare, which sits in front of the site.

What I do not know.

What is inside them. The hosting platform's documentation does not explain either cookie's purpose or its format. I can tell you their names, how long they last, and that the server sets them rather than the page. I cannot tell you whether they recognise you as a returning visitor, and I am not going to guess about that here. I have asked, and when I have a straight answer this page will carry it.

What I do know.

Nothing on this site reads them. Your browser does send them back to stemalytics.com on each request, because that is what a cookie is - but they go to the server that set them, and no request to anywhere else was observed. There is no analytics service for them to reach, because there is no analytics service. I never see them, and nothing anywhere turns them into a count of visitors. What the hosting company does with them on its own servers is outside my sight, which is exactly why it is written here rather than left out.

Why there is no cookie banner.

Both cookies are set by the server before the page loads, so a banner could not prevent them - it would only ask your permission for something already done. I would rather tell you plainly what is set than collect a click that changes nothing. If I learn these cookies do more than keep the site running, this page changes, and so does that decision.

What is stored in your browser.

• Your theme choice. If you switch between light and dark, that preference is saved locally under the name stemalytics-theme so the site does not forget it. It stays in your browser and is never sent anywhere.
• Your scroll position, kept for the length of the tab session so the back button returns you where you were.

Those two are everything this site itself stores in your browser, and both are settings rather than identity. The cookies above are not in this list because this site does not set them - the server does, before the page runs.

What happens if you apply to the founding cohort.

This is the one place the site collects anything, and only because you typed it.

The form asks for your name, your email address, your shop's name, your city and your state. You can also tell me which point-of-sale system you use and anything else you want me to know - those two are optional. Nothing else is collected alongside it.

Where it goes.

• A database. The row is stored in a PostgreSQL database hosted by Supabase, in their Northern Virginia region, in the United States.
• An email to me. One notification is sent to hello@stemalytics.com through Resend, so I know you applied. It contains exactly what you typed.
• Nowhere else. It is not sold, not shared, not uploaded to a mailing list tool, and not used to advertise to you anywhere. There is no mailing list.

Who reads it.

I do. Stemalytics is one person right now, so the honest answer to "who has access to my application" is: me, and the two companies above whose systems it passes through.

You will not get an automated email.

Applying does not trigger a confirmation message. I reply personally, which takes longer and means more.

How long it is kept.

I keep applications while the founding cohort is open. When the twenty-five seats are filled, I will delete the applications of anyone not in the cohort unless they have asked to stay on the list.

Getting it deleted.

Email hello@stemalytics.com and ask. I will delete it and tell you when it is done. You do not have to give a reason and it will not be held against a later application.

The parts I cannot avoid.

Two things happen that are true of essentially every website, and leaving them out would make this page cleaner and less accurate.

• Server logs. The company hosting this site records requests - the page asked for, the time, the browser's user-agent and the IP address. That is how web servers work. I do not use these logs to build any picture of a visitor, and I do not combine them with anything else.
• Service providers. Supabase stores the database and Resend delivers the email. Both are United States companies and both can technically see what passes through their systems. They are named here rather than hidden behind the phrase "trusted partners".

Children.

This is a tool for businesses. It is not directed at anyone under 13 and I do not knowingly collect anything from them.

If this changes.

If I add anything that collects data - analytics, a mailing list, a support chat widget - this page changes first, and the date at the top changes with it. I am not going to add analytics quietly and update the policy later.