Privacy Policy
Validity · Operated by The Little Guy LLC
Effective: [DATE] · Last updated: [DATE]
The short version
Your assessment answers never leave your device. The questions you answer and the scores computed from them are processed in your browser, on your phone or computer, and are not transmitted to us or stored on our servers. We cannot see them. We could not hand them over if we were asked.
We know what you paid us, what email you used, and roughly how the site is being used in aggregate. That is close to all of it.
We sell nothing. We share nothing for advertising. We run no third-party tracking pixels, no ad networks, and no affiliate links. Members fund Validity; that is why we do not need to monetize you.
The rest of this document explains that in detail.
1. What we collect
Account information
Your email address, and authentication data needed to sign you in. If you create an account, we know you exist and how to reach you.
Payment information
Payments are processed by Stripe. Card numbers go directly to Stripe and never touch our servers — we never see or store them. From Stripe we receive a customer identifier, your subscription status, and enough billing metadata to know what you are entitled to and to send you legally required billing notices. Stripe processes this as an independent controller under its own privacy policy.
Health and assessment information — read this carefully
When you take the assessment you answer questions about habits, measurements and symptoms. Those answers, and the scores derived from them, stay on your device.
Concretely:
- The questions are answered in your browser or app.
- Scoring is computed locally, on your device.
- The answers and scores are stored in your device's local storage.
- None of it is transmitted to Validity's servers. We have no database table for it.
- If you clear your browser data, uninstall, or switch devices, that information is gone. We cannot restore it, because we never had it.
- You can export your data to a file you control, and restore it yourself on another device.
This is a deliberate architectural choice, not a policy promise we could quietly reverse — the data path does not exist. If we ever build server-side storage for assessment data, it will be an opt-in feature announced before launch, never a silent change.
Usage information
We collect aggregate, non-identifying information about how pages are used — which topics are viewed, general traffic patterns, error reports — to know what to build next. Server logs may briefly hold IP addresses for security and abuse prevention.
We do not run third-party analytics that build advertising profiles, and we run no advertising pixels of any kind.
What we deliberately do not collect
We do not ask for your name, address, phone number, date of birth, government identifiers, or precise location. We do not connect to wearables, health apps, or medical records. We do not buy data about you from anyone.
2. Why we use it
- To provide the service — sign you in, show you what you have paid for.
- To bill you — process payments, send renewal reminders and receipts you are legally entitled to.
- To support you — answer your emails.
- To improve Validity — aggregate usage patterns tell us which topics to expand.
- To keep it working — security, fraud and abuse prevention.
- To meet legal obligations — tax, accounting, and lawful requests.
That list is exhaustive. We do not use your information for anything else, and specifically not for advertising, profiling, or sale.
3. Who we share with
We do not sell your personal information. We do not share it for cross-context behavioral advertising. We have never done either and the business model does not require it.
We share only with vendors who run the service on our behalf, under contract, and only what they need:
| Who | What they get | Why |
|---|---|---|
| Stripe | Email, payment details you enter with them, subscription status | Processing payments |
| Supabase | Account records and site content | Database and authentication |
| Vercel | Requests to the site, server logs | Hosting |
| [Email provider] | Your email address | Sending billing notices and account email |
None of them receives assessment answers or scores, because those never leave your device.
We may also disclose information if legally compelled, to protect rights or safety, or to a successor in a merger or acquisition — in which case we will notify you and this policy continues to apply until you are told otherwise.
4. Your rights
Whoever and wherever you are in the US, you may:
- Know what we hold about you
- Get a copy of it
- Correct it
- Delete it, and close your account
- Not be discriminated against for exercising any of these
Email support@validity.health. We will verify it is you — usually by replying to the email address on the account — and respond within 45 days.
Residents of California, Colorado, Connecticut, Virginia, Washington, Nevada, Texas and other states with comprehensive or health-specific privacy laws have these rights by statute, including the right to appeal a refusal.
Consumer health data. Washington's My Health My Data Act, Nevada's SB 370, and similar laws impose specific duties on consumer health data. Our position is straightforward: assessment answers never reach us, so there is nothing for us to sell, share or disclose.
5. How long we keep things
- Account information — while your account is open, then deleted within [30] days of closure.
- Billing records — as long as tax and accounting law requires, typically 7 years. We cannot delete these on request.
- Server logs — [30] days.
- Assessment data — never held by us. It lives on your device until you delete it.
6. Security
Encryption in transit everywhere. Passwords are hashed, never stored in readable form. Card data never reaches us. Access to production systems is limited and authenticated.
No system is perfectly secure, and we will not claim otherwise. If a breach affects your information we will notify you and any required regulator promptly, as the FTC Health Breach Notification Rule and state breach laws require.
7. Children
Validity is for adults 18 and over. We do not knowingly collect information from anyone under 18. If we learn we have, we delete it. If you believe a child has created an account, email support@validity.health.
8. Cookies and tracking
We use cookies only for things that must work: keeping you signed in, and remembering preferences.
We set no advertising cookies, no cross-site trackers, and no third-party marketing pixels. There is no ad network embedded in this site. Because of that, there is no behavioral advertising to opt out of, and Global Privacy Control signals are honored by default — there is nothing to switch off.
9. Where we operate
Validity serves US residents and our systems are hosted in the United States. We do not currently offer the service in the EU, UK or elsewhere.
10. Changes
We may update this policy. For material changes we will email registered members and post the new effective date here before the change takes effect.
One commitment worth stating plainly: if we ever change the on-device architecture so that health data reaches our servers, that will be an opt-in choice you make deliberately, announced in advance — never a quiet edit to this page.
11. Contact
The Little Guy LLC
Privacy questions and data requests: support@validity.health
Corrections to published content: corrections@validity.health
Email is our designated method for submitting privacy requests. We reply from a monitored address and will verify your identity before acting on a request about an account.