WEBSITE PRIVACY · REVIEW EDITION
Your curiosity. Your choice.
This notice describes the standalone Vitalog website, not the XB Lifelog phone app. It must be reviewed and approved before public forms are opened.
When you write to us
Enquiries save the name, email, organisation, phone number and selected dial-code country, optional address and address country, optional professional profile/CV link and message you choose to submit in our private website inbox. We use these details to respond and discuss your enquiry. An email notification may be sent to the relevant Vitalog departmental inbox. Saving an enquiry does not automatically publish your name as a contributor.
Journal comments save your name, email and comment. Only approved comments and the submitted display name appear publicly; the email stays private. Please do not include passwords, payment credentials or sensitive personal details in messages or comments.
Journal subscriptions require email confirmation before broadcasts. We retain your name, email, consent and confirmation status, and campaign delivery records. Every broadcast includes an unsubscribe link; unsubscribed or deleted readers are excluded from future sends. We record SMTP acceptance or failure, not email-open pixels or individual click tracking. Enquiry spam phrases send matching new messages to recoverable Trash, where the owner can review or restore them.
Website journey analytics and your choice
Vitalog uses first-party journey analytics to improve this website: pages visited, selected navigation and form-completion events, the referring website name and approximate country. A random session identifier connects events during a visit. A separate random browser identifier estimates unique browsers and new or returning visits across days, months and years. Records contain a keyed hash of that identifier and its first-seen time, not the cookie itself. They are pseudonymous, not guaranteed anonymous. Analytics do not contain form text, names, email addresses, raw IP addresses or URL query strings. We do not sell or share these records for advertising, fingerprint visitors or track them across other websites or devices.
Our current regional policy enables journey and repeat-visit analytics by default in Kenya and the United States, with an opt-out through Privacy preferences in every page footer. Other identified countries require an explicit Allow choice first. When the country cannot be identified, analytics are enabled by default under the site owner's selected fallback. This fallback is not a determination that tracking is legally permitted everywhere: geolocation failures and VPNs can misclassify visitors. You can turn analytics off regardless of location.
Approximate country is looked up locally from the connection IP. No IP is sent to an external geolocation service. A Global Privacy Control or Do Not Track signal stops journey and repeat-visit analytics, even after an Allow choice. A saved refusal always overrides regional defaults. Consent is not inferred from scrolling or continued browsing, and old browser-stored Allow choices cannot renew expired consent. A change to this analytics policy invalidates old Allow choices, but preserves refusals.
Cookies and browser preferences
A necessary session cookie protects forms and administration. A signed privacy-choice cookie lasts up to 180 days. The vitalog_analytics cookie groups visits until 30 minutes of inactivity. The separate vitalog_browser cookie has a fixed lifetime of up to 180 days from issue, not an indefinitely renewed lifetime. Both are first-party, HttpOnly and SameSite=Lax, and Secure on HTTPS, and are only set for accepted events when tracking is permitted by the current policy and your choices. Browser storage remembers a privacy choice only when you make one, along with theme, motion and Journal reader settings. Turning analytics off stops future collection and clears both analytics identifiers; it does not disable necessary security cookies or erase records already collected.
What the numbers mean
Unique-visitor figures are estimates of browsers, not identified people. A different device, private browsing, cleared cookies or the identifier expiring can count as a new browser. Older session-only records cannot identify returning visitors. First-seen browsers received their identifier within the selected reporting period. Returning browsers and repeat visits have an earlier recorded page-view session; this includes returning during the same reporting period. A browser can belong to both groups, so those counts must not be added together. Removed history can prevent recognition of an earlier visit. Country and period totals are not additive because the same browser can visit across several buckets or countries.
Analytics history remains stored until the site owner runs the private retention cleanup. That command removes events older than 90 days, including their browser links; it is currently unscheduled. Reports only show history still available and cannot reconstruct removed or previously uncollected visits.
Keeping and protecting information
Analytics are retained for up to 90 days when the scheduled retention job runs. Enquiries, comments and subscription requests are retained for follow-up and moderation until we remove them; archiving an enquiry does not delete it. Access is restricted to authorised administration. Private backups also contain this information and must be stored securely. The hosting provider may maintain separate connection and security logs.
For questions, corrections or removal requests, contact info@vitalog.me. Retention, legal disclosures and a verified request-handling process remain launch-review items.
Links and local review
External websites have their own privacy practices. Local development stores test submissions on the development PC and sends no outbound mail. Enabled website forms store submissions on our private hosted server and may send notifications. Enabled contribution pages load PayPal’s secure payment buttons automatically. PayPal may receive connection/browser information and use its own cookies and privacy practices. The PayPal SDK is not loaded on other pages. Payment details are handled by PayPal’s checkout; the website does not receive card numbers. A payment or subscription is initiated only after you choose a payment button, and billing requires approval in PayPal’s checkout.
Display preference
When you switch light or dark mode, a functional cookie remembers only that choice for up to 180 days. It contains no visitor identifier and does not enable analytics. Browser storage may also remember display and reader preferences.
