Privacy

Information we collect

Nothing you provide. There is no account, no sign-up, no log-in, no newsletter, no comment system and no contact form anywhere on this site. Every page is readable without giving anything. The only way to reach us is the email address at the foot of this page, and if you write to it we hold your message and your address for as long as it takes to deal with what you wrote.

What the tools on this site do with what you type. Three boxes accept input: the NAD+ price normalizer, and the “Find a seller” filters on the seller index and on each board. All three run entirely in your browser. Nothing typed into them is sent to us, stored by us, or written to a server, and there is no server here that could receive it.

What is collected automatically. Google Analytics 4 records which pages are opened and in what order, how you arrived, the browser and operating system you are using, and an approximate location. That location is derived by Google from your network address; what Google does with the address is governed by Google’s own policies, not by this page. Separately, the host serving these pages keeps ordinary request logs — see Hosting and server logs.

What is collected when you click out to a seller. Seller links go through a /go/ redirect on this domain, and the click is recorded as an analytics event naming the seller, the page it left from and the position of the row. Those are facts about the page, not about you. If an alternative-seller box is shown to you on the way out, that is recorded as an event too. See Outbound seller links.

Links to our reviews. With analytics enabled, we record the review opened, the page containing the link, its placement and its visible text. Query strings and URL fragments are excluded. This helps us understand which guides help readers find a relevant review.

What is never collected. No name, no email address unless you send one, no postal address, no payment details, no account credentials. No health information of any kind: this site holds no diagnosis, no prescription, no dose, no weight, no lab result and no insurance detail, because nothing here ever asks for one. Nothing on this site asks your age, and nothing here builds a profile of you across visits.

How we use it

What is collected is used for five things and nothing else:

• to serve the pages and keep the site available and secure;
• to reply to an email you send us;
• to see which pages, boards and reviews are actually read, so the reading is worth doing;
• to attribute an outbound click to the page and the row it came from, so a referred sale can be credited to this site by the affiliate network;
• to comply with the law where we are obliged to.

It is not used to advertise to you, here or anywhere else. Google Analytics runs on this site with advertising features switched off: Google Consent Mode denies ad_storage, ad_user_data and ad_personalization on every page load, on every page. Nothing measured here builds an advertising audience or follows you off this domain.

Analytics and tags

This site loads one analytics vendor: Google Analytics 4, operated by Google. It is loaded from googletagmanager.com on every page and reports to google-analytics.com. It tells us which pages are read, how readers arrive, and roughly where in the world they are.

That is the complete list, and it is the complete list of third parties these pages contact at all. There is no Google Tag Manager container, no Google Ads tag, no Meta pixel, no Microsoft/Bing UET tag, no session recorder and no A/B testing script. The two typefaces are downloaded when the site is built and served from this domain, so reading a page here contacts no font host either.

Custom events include an outbound provider click, an internal review-link click when analytics consent is enabled, and four events describing the alternative-seller box — that it was shown, that its offer was taken, that the original link was followed instead, and that the box was dismissed. Each carries seller slugs, a page label, a row position and, for a dismissal, how it was closed. Review-link events carry the review, source page, placement and link text. These custom parameters describe links and providers; Google Analytics processes them with the measurement described above.

Nothing measured here is sold, and nothing is shared with anyone for advertising. This site runs no display-ad or programmatic-ad network. It carries labeled affiliate provider placements and may show an alternative provider before an outbound visit. We may earn commissions from these links. The arrangement and its effect on placement are explained on the disclosure page. A commission changes nothing about a figure published here: prices are read from the seller’s own public pages and printed with the date they were read, whoever pays.

Analytics cookie choices

Analytics is on by default and starts when the page loads. This is a US-audience site and we treat it as an opt-out, not an opt-in: a notice tells you it is running, and one click denies analytics storage — here, or from the notice.

Checking your current analytics setting…

We also honor Global Privacy Control. If your browser or an extension sends that signal, analytics storage is denied automatically and you need not click anything. Your choice lives in this browser only, so clearing site data resets it and another browser or device is a separate decision.

The opt-out denies Google Analytics storage and deletes the analytics cookies already on this device. Outbound-click and alternative-provider events use that same consent setting. Google’s tag still loads and may send cookieless consent and measurement signals; this control does not block every request to Google. Our internal review-link event is not sent when analytics consent is denied. Google also publishes a browser add-on that opts you out of Google Analytics on every site at once, if you would rather decide it in one place.

Cookies and browser storage

Google Analytics sets two cookies — _ga and _ga_<stream> — holding a random identifier for the browser rather than for you. They are the only cookies this site sets. Your analytics choice itself lives in this browser’s local storage under cookie-consent, which is not a cookie and is never sent to us.

If you see an alternative-seller box on the way out to a seller, a counter is stored under nadprices.exit-intercept.v1 in session storage, holding how many boxes this visit has been shown and which sellers they were shown for, so the same box cannot appear twice. It exists to interrupt you less. It is cleared when you close the tab, it never leaves your browser, and we never read it.

With analytics enabled, an ordinary link to one of our reviews can store one pending review-click record under nadprices:review-click in session storage. It contains only the review path, source page path, link placement and visible link text. The destination reads and removes it before sending the event to Google Analytics; records older than 30 seconds are ignored. It cannot build a backlog and is cleared when the tab closes. This lets the link open immediately without waiting for analytics.

Disabling analytics cookies denies Google Analytics storage and deletes those two cookies from this device in the same click. Following an outbound link to a seller may cause that seller, or the affiliate network between us, to set cookies under their own policies — see below. You can block cookies in your browser settings; this site reads without them.

Hosting and server logs

The site is hosted by Vercel Inc., which processes ordinary request data to serve pages and to protect the site from automated abuse: IP address, user agent, requested URL, referrer and timestamps. That processing is Vercel’s and is governed by its own privacy policy. Those logs are not copied into any database of ours, because there is no database of ours.

Outbound seller links

Links to sellers pass through a /go/ redirect on this domain. For sellers that pay a commission, the redirect appends identifiers to the seller’s own link so the affiliate network (Katalys) can attribute a sale: this site’s publisher id and its name, the seller’s slug, a label for the page the click came from, the slot on that page it came from, the row’s position where the page is a ranked list, and an experiment arm where one is running. Those identifiers describe the page and the position, not you: none of them is derived from anything about you, and there is nothing in them that persists between visits. For sellers that pay nothing, the redirect appends nothing at all. Once you land on a seller’s site, that seller’s privacy policy governs, not this one.

Katalys is the only affiliate network this site uses. After the redirect hands you over, what the network and the seller collect, set and retain is theirs and is governed by their policies. Neither of them receives anything you typed into a tool here, because nothing typed into a tool here leaves your browser. Whether a given seller pays this site is stated beside paid provider links and explained on the disclosure page.

Who else receives data

We do not sell your personal information, and we do not share it for advertising. Three parties are involved in serving and measuring this site, and this is all of them:

• Google — Google Analytics 4, subject to the storage choice and cookieless signals described above. Google processes this measurement under its own published terms and privacy policy.
• Vercel — hosting and request logs, as described above.
• Katalys — the affiliate network, and only at the moment you follow a link to a seller that pays this site.

Beyond those three, data may be disclosed where the law requires it, or where it is necessary to establish or defend a legal claim, or to protect the safety of readers or the public. There is no data broker, no retargeting vendor, no email list and no customer list, because there is nothing here to put on one.

Your rights and how to use them

You may ask what personal information this site holds about you, ask for it to be corrected or deleted, and object to analytics. Write to contact@nadprices.com. We aim to answer a request within 30 days.

The honest answer to most requests is that we hold nothing. There is no account, no email address on file unless you sent one, and no identifier that could be matched to you, so there is usually nothing to look up, export or delete. Saying so is not a refusal — it is the whole record. If we do need to confirm who you are before acting, we will ask for the least that will do it, and we will not create a record of you in order to answer a request about records of you.

The fastest route for the one thing this site actually controls is the button under Analytics cookie choices. It takes effect on the page you are reading. Requests about data held by a seller, or by the affiliate network, have to go to them; we cannot reach into their systems and would not want the ability.

California residents (CCPA and CPRA)

If you live in California, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the right to know what personal information has been collected about you and how it is used, to have it deleted, to have inaccurate information corrected, to opt out of the sale or sharing of it, to limit the use of sensitive personal information, and to not be treated differently for exercising any of those rights.

This site does not sell or share personal information as the CCPA defines those terms, does not use or disclose sensitive personal information for any purpose beyond what the law permits without a right to limit, and does not knowingly collect personal information from anyone under 16, let alone share it for cross-context behavioral advertising. The advertising purposes in Google Consent Mode are denied on every page load.

This site honors the Global Privacy Control opt-out preference signal. If your browser sends it, analytics storage is denied before the tag is configured, with no form to fill and no request to make. Cookieless signals may still be sent as described above. To exercise any other right, write to contact@nadprices.com with “California privacy request” in the subject line. An authorized agent may make a request on your behalf with written proof of authority.

Other US state privacy rights

A growing number of states now give residents comprehensive privacy rights that look much like California’s: to confirm whether data about them is processed and get a copy of it, to correct it, to delete it, to opt out of targeted advertising, sale and certain profiling, and to appeal a refusal.

Rather than keep a list of states here that would be out of date the next time a legislature sits, this site applies the same answer to every US resident: those rights are honored on request, at the address below, whichever state you are writing from. It costs nothing to do that, because the answer is the same everywhere. This site engages in no targeted advertising, no sale of personal information and no profiling that produces legal or similarly significant effects, so there is nothing in those categories to opt out of. If we ever decline a request, we will say why and tell you how to appeal it.

Visitors from the EU, the UK and Switzerland

This is a United States publication about United States sellers, written for readers shopping in the United States, and it is not marketed to the European Economic Area, the United Kingdom or Switzerland. Most of what is indexed here cannot be bought from those places at all.

If you visit anyway, the GDPR and the UK GDPR still give you rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw a consent you gave, and the right to complain to your national data protection authority. Those rights are honored at the address below. The lawful bases relied on are consent for analytics, legitimate interests in serving and securing the site and in attributing an outbound click that has already been made, and legal obligation where the law requires something.

Two things are worth saying plainly rather than burying. First, this site runs analytics on an opt-out basis, which is what US practice contemplates and is not prior opt-in consent; if you are somewhere that expects opt-in, use the opt-out button above or send Global Privacy Control to deny analytics storage. Cookieless signals may still be sent as described above. Opting out does not undo measurement that already happened. Second, no special-category data under Article 9 is processed here, and no decision about you is made by automated processing within the meaning of Article 22, because no decision about you is made here at all.

Children

This site is written for adults, is not directed to children under 13, and does not knowingly collect their data. Nothing here asks anyone’s age, because nothing here asks anyone anything. If you believe a child has sent us information, write to the address below and it will be deleted.

How long anything is kept

This site operates no database and keeps no records of readers of its own, so on our side there is nothing to retain. What exists is held by the three parties named above, under their arrangements:

• Analytics. Event data sits in the Google Analytics property for this site and is deleted according to that property’s data-retention setting and Google’s own policies. It is not copied anywhere else.
• Server logs. Request logs belong to the host and are rotated on the host’s schedule, not ours.
• Email. A message you send is kept as long as it takes to answer it, and for a reasonable period afterward so a correction can be traced back to who reported it.
• Your own browser. The consent key stays until you clear site data; the alternative-seller counter is gone when the tab closes.

Security

Every page is served over HTTPS. The strongest thing that can be said about security here is structural rather than technical: there are no accounts, so there is no password to steal; there is no database of readers, so there is no reader database to breach; and nothing you type into a tool on this site ever leaves your browser, so it cannot be taken from a server it never reached. What little exists sits with Google and with the host, under their own safeguards.

No system is perfectly secure and nobody should claim otherwise. If you find a security problem with this site, the address below is the right place to send it.

International transfers

This site is operated from the United States and is served from infrastructure operated by companies based in the United States. If you read it from outside the country, the request and the analytics event it generates are processed in the United States and possibly elsewhere, on the networks of the providers named above and under whatever transfer safeguards each of them maintains. This site sends nothing of its own anywhere else.

Changes to this policy

This page changes when the site does. The date at the top states when the current version took effect, and it is the same constant every legal page on this site prints, so the four of them cannot disagree. A material change — a new vendor, a new thing collected, a new recipient — is written here in the same change that ships it, not afterward. Continued use after a revision is acceptance of it.

Contact

Privacy questions, requests and complaints go to contact@nadprices.com, which is the single address for everything on this site. Requests are handled by email. See also the terms of use and the disclosure page, which explains the commercial relationships this policy refers to.