Privacy Policy
Effective October 30, 2026. Basic analytics are optional.
Optional first-party analytics
Analytics start only after you choose “Allow analytics.” Declining does not block content or Amazon links. If the browser sends Do Not Track, analytics are not sent. Consent choice is kept in local storage. With consent, a random browser identifier is stored locally and sent with page views and Amazon-button click events.
What event data contains
We store a random event ID, event type, random browser identifier, page path, product identifier for clicks, referring hostname only, device category derived from the user agent and a timestamp. We do not store raw IP addresses, full referring URLs, search queries, precise location or full user-agent strings in the analytics database. The hosting provider may separately process operational request logs under its own policies.
Measurement and retention
Page views count page loads after consent. Estimated unique visitors count distinct random browser identifiers in the selected period. Different devices and cleared storage can count the same person more than once, while shared browsers can combine people. Bots are filtered by obvious user-agent patterns, not perfectly detected. Events older than 13 months are removed during scheduled maintenance requests to the analytics API; until that cleanup runs, old records may remain. No advertising pixels or cross-site analytics service is installed.
Contact messages
The contact form stores your name, email address, message and submission time so the administrator can review and reply to your request. Do not send passwords, medical information or other sensitive data. Messages are not automatically emailed and remain in the admin inbox until the administrator deletes them. You can use the form to request access, correction or deletion of information associated with your email.
Administrative security
Admin sessions use a necessary HttpOnly, SameSite cookie with a 24-hour lifetime. Session tokens are stored as hashes. Login and contact rate limiting use hashed request identifiers with short expiry windows. Password verification runs on the server; no admin password is included in public page code.
Amazon and external sites
Following an Amazon affiliate link leaves this site. Amazon and other linked websites apply their own privacy, cookie and purchase policies. WattRoster does not receive your Amazon account details or order data through the outbound click tracker.
Your choices
Use “Privacy choices” in the footer to change analytics consent at any time. Declining removes the local visitor identifier and prevents new analytics events. Previously stored records are not automatically linked to an email or name. Local storage can also be cleared through your browser. This policy must be reviewed for the operator’s actual markets and legal obligations before public launch.