Short version: almost nothing

If you just take the test

Nothing leaves your browser. Every number is computed on your own phone or laptop. The panel is handed from the test to the result page inside the tab itself, and it is gone when you close the tab, which is why the result page tells you to write down anything you want to keep.

A test you have started is kept in the same place, for the same length of time. From 21 September 2026 each measurement is saved as you record it, so a reload or a stray back button offers to pick up where you left off instead of throwing away ten minutes. It lives in that one browser tab, it is never sent anywhere, and closing the tab still erases it. We chose that over storing it properly on your device precisely because a half-finished health panel sitting on disk is a promise we did not want to make.

Two small preferences are remembered on your device so you don't re-enter them: whether you use inches or centimetres, and the target age you last looked at. Nothing else, and neither is sent anywhere.

There are two exceptions. The first is Google Analytics. Until 18 September 2026 this page said there were no analytics of any kind. That is no longer true, so the sentence is gone rather than quietly softened.

What that means concretely. Every page loads one script from Google, and Google is told which page you looked at, roughly when, what browser and device you are on, and your approximate location from your IP address. A cookie is set so that a second visit is not counted as a new person. That is ordinary website analytics and it is how we find out whether anybody finishes the test.

What Google is not told: anything you measured. Your results never enter a URL and never leave your browser except on the consent you tick, so there is no path by which a heart rate or a walking speed reaches an analytics request. The pages are the only thing counted, not the numbers on them.

The second exception is a counter we run ourselves, added on 18 September 2026 for one reason: to find out whether anybody is using this. Three times in a visit. When you press Begin, when you reach the end, and when a result page draws a panel. The site records one row.

The row holds an age band, your sex, the time and, when you reach the end, the names of the tests you filled in. Not your exact age, which is rounded to a five-year band before it is sent. No email address, no account, no cookie and no identifier of any kind, which means the rows cannot be joined back together into a person or into a visit. No IP address. And no measurement. Not a heart rate, not a walking speed, not a time on one leg.

The test names were added on 22 September 2026, and they are names only. That somebody measured their aerobic capacity; never what it was. Two of the nine rows need a heart-rate watch, and there was no way to tell whether anyone was doing them, which is worth knowing, because if nobody is, those rows should be built differently or dropped. The list can only contain the nine row names this site already publishes, so it cannot carry anything else.

We considered storing everybody's results instead, because it would answer more questions. We decided against it. A full panel is nine physical measurements next to your age and sex, and that combination is close enough to a fingerprint that calling it anonymous would be a stretch. There is a box further down this page that asks your permission for something like it, and it is still switched off.

There are still no advertising tags, no tracking pixels, and no fonts or images loaded from anybody else's server.

If you give us your email

You are asked after your results are on screen, never before, and the boxes are separate because they are separate decisions.

• Remind me to retest. Your email address and your results are stored, so the next panel can be shown against this one. Your results are stored against your address. That is what makes the comparison possible, and it means they are not anonymous.
• Send me new writing. Your address only. A few times a year. The same list is reachable from the subscribe box at the foot of the writing pages, and from the "not right now" box on the front page. All three put you on one list, and there is only one list. Either way you have to click the link in the confirmation email first. An address that never confirms is never sent to.
• Add my results to the reference dataset. Recorded as your answer, but nothing is being written to that dataset yet. It is waiting on a legal determination about whether the table really is de-identified. Your permission is kept for when it is; it is not a licence to start today.

Untick all of them and nothing about you is stored at all.

If you write to me

The form at the foot of the writing pages stores what you typed, your email address, and which page you wrote it from. Nothing else. There is no column for your name, and none for your IP.

It is never published. It is not a comment section, and the table it goes into has no column that would let it become one: nothing marks a note as approved or visible, because nothing renders notes anywhere. Your words go to one person: from 18 September 2026 a note is emailed to Aditya when you send it, with your address and the page you wrote from, so that it is actually read. Before that date it was only stored, and the honest word for that is unread.

Your address is kept so that person can reply, and for nothing else. Writing to me does not subscribe you to anything. Those are two separate forms and two separate records.

To have a note deleted, ask. Write again and say so, or reply to any email from us, and it goes. If you also subscribed, the one-click delete link in your confirmation email removes your notes along with your address, in the same action.

What we never store

Your IP address. There is no column for it. The limit that stops a script hammering the signup endpoint counts requests in memory and forgets them on every deploy, specifically so that no address is written down. An IP beside a health result is the field that makes everything else identifiable again.

That is a statement about our database, and it would be misleading on its own now that analytics exist: Google sees your IP address, as it does on most of the web, and uses it to work out roughly where you are. We never receive it and never store it.

Your name, your location, your device, and anything you did not type into a box.

Deleting it

Every email we send carries a one-click delete link, including the first one. It removes your address, your results and any notes you have sent together, in one action, with no sign-in and no reply to a support address. All three go in a single database transaction, so there is no state where one survives the others. A confirmation mail that cannot also delete you is a subscription trap.

You also have to confirm by clicking that first email before anything is sent to you. Ignore it and the address expires unconfirmed.

Selling it

No. Not to advertisers, not to insurers, not to data brokers, not as part of anything. There is no version of this product where your panel is the thing being sold.