Privacy Policy

Med Match Forum (medmatchforum.com) is operated by an individual, not a company. This policy covers this site only. It does not cover the community-run Google Sheets that this site republishes discussion from — those are not ours, we do not control them, and you should check with whoever runs a given sheet about how it handles information.

There are no reader accounts, and we never ask for your name or email address. We set one anonymous first-party cookie whose only job is to stop the same browser from voting twice. Google Analytics runs on every page view, with cookies, and there is no cookie-consent banner. Anything you post is public and, by design, permanent.

Content you submit.Post and comment text you write is public and retained indefinitely. If a post or comment is hidden — automatically, for a low vote score, or by an admin — it is hidden from view, not deleted; it remains in the database with its vote history intact. Posts and comments store no author field of any kind: we have nothing to delete that identifies who wrote something, because we never captured it. Fame & Shame entries about specific programs, and any disputes attached to them, are republished the same way from the community spreadsheets.

Suggestions. The suggestion form stores only the text you submit and when you submitted it. No session identifier, no IP address, and no other identifier is attached to a suggestion — it is the least identifying thing you can send us on this site, and we have no way to connect it back to you or to anything else you may have posted.

Anonymous session identifier. When you first visit, we set a first-party, HTTP-only cookie (anon-session-id) containing a random UUID, valid for one year across the whole site. Its only purpose is to let one browser cast one vote per post or comment. It is not linked to anything you post or write. We cannot connect it to your real identity — but because it persists and can be used to correlate your voting activity across visits, we treat it as personal data.

Admin accounts. Site operators sign in with Google OAuth, restricted to a short allowlist of specific email addresses. This does not apply to readers or posters — it exists purely for the small number of people who moderate the site.

What we do not collect. We do not ask for names, we do not ask readers or posters for an email address, and there is no account system. We keep no request logs of our own beyond error/warning-level application logs. That said, we are honest that our hosting provider and our analytics provider necessarily process IP addresses as part of delivering and measuring the site — we are not in a position to claim we never see an IP address, because the infrastructure we run on does.

• anon-session-id — first-party, essential, HTTP-only, SameSite=Lax, 1 year. Prevents duplicate voting.
• sb-* — Supabase authentication cookies, set only when an admin signs in.
• _ga, _ga_* — set by Google Analytics (property G-3SN29DXEQ3) on every visit.

To be direct about this: there is no cookie-consent banner on this site, and Google Analytics loads on every page view regardless of any preference you might have. We do not currently honor Do Not Track or Global Privacy Control browser signals. If you want to limit this, your realistic options are your browser's own cookie controls (block or clear cookies for this site) or Google's Analytics opt-out browser add-on.

We use Google Analytics (GA4, property G-3SN29DXEQ3), loaded via a script tag on every page. GA receives the page URL, the referring page, coarse location derived from your IP address, your device and browser information, and a GA client identifier stored in a cookie. That data is held and retained under Google's own terms and retention settings, not ours — see Google's privacy policy and how Google uses information from sites that use its services. We also use Vercel Speed Insights, which collects page-performance metrics from visitors.

We use exactly four outside services to run this site:

• Supabase (United States) — our database, realtime updates, presence (viewer counts), and admin sign-in. It holds all site content, vote session identifiers, and admin email addresses.
• Vercel (United States) — hosting, serverless execution, scheduled sync jobs, and Speed Insights. Processing request metadata, including IP addresses, is an inherent part of serving pages over the internet.
• Google — three separate, unrelated touchpoints: (i) Google Analytics, as described above; (ii) a read-only pull of the community Google Sheets this site republishes — no visitor data is sent to Google as part of that; (iii) Google OAuth, used only for operator (admin) sign-in.
• Anthropic (Claude) — the applicant sentiment score and program summaries shown on program pages are produced by a batch job the site operator runs manually from a local machine against the production database. It is not part of serving your page view and does not run automatically. When it does run, the text of anonymous posts and comments mentioning a given program is sent to an Anthropic Claude model to summarize. Practically: do not put anything in a post or comment that you would not want sent to a third-party AI model.

• Run and display the forum and Fame & Shame content
• Prevent duplicate voting on the same post or comment
• Moderate content
• Generate the applicant sentiment score and program summaries — see how rankings work
• Measure traffic and site performance
• Reply to email you send us

Where GDPR applies, we rely on legitimate interests: operating a public discussion archive, preventing vote manipulation, and understanding site traffic. We keep this brief because it genuinely is — we do not have a Data Protection Officer, an EU or UK Article 27 representative, or Standard Contractual Clauses in place.

Content you post is retained indefinitely — that is the point of the archive. Hidden content is retained, not deleted. Votes are retained. The session cookie lasts one year. Google Analytics data is retained per Google's own settings, which we do not control.

You can clear the anon-session-id cookie in your browser at any time; doing so means your previous votes are no longer attributed to your browser and you will be able to vote again. You can block Google Analytics with your browser or an extension. You can ask us to remove specific content via our takedown process or by emailing medmatchforum@gmail.com.

We are upfront about a real limit here: because posts and comments carry no author identity at all, we generally cannot verify that a particular post is yours, and we cannot compile "all the data we hold about you" the way a service with accounts could. If you tell us which specific post or comment is yours, we can act on that content directly.

California (CCPA/CPRA). We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. Using Google Analytics is a disclosure to a service provider for analytics purposes.

This site is not directed at children, and we do not knowingly collect information from children.

Traffic to this site is encrypted with TLS. Admin access is restricted to a short email allowlist. No method of storage or transmission is perfectly secure, and we cannot guarantee absolute security.

Data described above is processed in the United States.

We may update this policy from time to time. We'll update the "Last updated" date above when we do. Because we hold no reader or poster email addresses, we have no way to notify you directly.