· The fine print ·
Privacy.
The short version: we collect an email if you subscribe to the newsletter, and anonymized pageviews if you don’t opt out. That’s it. We don’t sell your information, we don’t share it for advertising, and you can opt out of analytics on this page.
Section 1
What we collect.
Newsletter signups.If you subscribe to our seasonal alerts, we collect your email address and the date you subscribed. Nothing else — no name, no postal code, no birthday.
Anonymized analytics.If your browser doesn’t send a Do Not Track or Global Privacy Control signal and you haven’t opted out, we record anonymous pageviews. We record which page you visited and when. We do not record your IP address, your name, your device fingerprint, or any identifier we could use to recognise you on a return visit.
One custom event.The tick-risk meter on the home page sends an event when you change its dropdowns — just the province, species, and month you selected. No identifier attached.
Section 2
What we don't collect.
- Your name, address, age, or any contact info beyond the email you give us.
- Your IP address (we ask our analytics provider to anonymize it before storage).
- Your browser fingerprint or device ID.
- Any advertising or marketing IDs.
- Health information, search queries, or anything inferred from those.
- Your activity on other websites.
Section 3
Where your information goes.
We use three service providers. Each receives only what it needs to do its job. None of them share with us a profile of who you are.
- Beehiiv(United States) — our newsletter platform. They receive your email when you subscribe and they send the alerts. They don’t receive anything about your visits to the site itself.
- PostHog(United States) — our analytics platform. They receive anonymized pageview events and the one custom event from the risk meter. No identifiers attached.
- Cloudflare(worldwide) — the company that hosts and serves the site. They handle the underlying request routing and TLS. They generate short-term access logs for security and abuse prevention; we don’t mine those logs for analytics.
These providers are all located in the United States. By using woodticks.ca you acknowledge that your information may be processed there.
Section 4
How long we keep it.
- Newsletter email: until you unsubscribe, then removed from active lists within 30 days.
- Analytics events: 12 months, rolling. Older events are deleted automatically by our analytics provider.
- Cloudflare access logs:retained according to Cloudflare’s standard policy (typically a few days for performance / security purposes).
Section 5
How to opt out, unsubscribe, or delete your data.
Newsletter:every email we send includes a one-click unsubscribe link in the footer. Click it once and you’re off the list.
Analytics:toggle the switch in Section 11 below. The setting is remembered on this browser. You can also turn on Do Not Track or Global Privacy Control in your browser — we honour both automatically.
Data deletion request: email [email protected] from the address you used to subscribe, or describe what you’d like removed. We’ll confirm within 30 days.
Section 6
We do not sell or share your information.
Plain language
No sale. No sharing. Full stop.
We do not sell your personal information.
We do not share it for cross-context behavioural advertising (CCPA/CPRA language for ad-tech profile sharing).
We do not participate in any data broker arrangement, ad network, or third-party advertising platform.
If we ever change this, we will say so on this page before any sale or share happens.
Section 7
Categories of information we collect.
Using the categories named in California’s privacy law (CCPA/CPRA), so they line up with the rights you may be exercising:
- Identifiers— email address (only if you subscribe).
- Internet or network activity— anonymized pageviews and one custom event from the risk meter (opt-out available).
No other CCPA categories apply — we don’t collect commercial information, biometric data, geolocation, sensory data, employment information, education information, inferences for profiling, or sensitive personal information.
Section 8
Your rights.
Depending on where you live, different laws give you specific rights. We honour them no matter where you’re from. To exercise any of these, email [email protected].
- Access and correction (Canada / PIPEDA, Quebec / Law 25): ask what we hold about you and have it corrected.
- Erasure and portability (EU / GDPR, UK / UK GDPR): ask us to delete your data or send you a copy.
- Withdrawal of consent (Canada / CASL, Quebec / Law 25): you can withdraw consent for the newsletter or analytics at any time.
- Opt out of sale or sharing (California / CCPA): we never sell or share for advertising; this opt-out is automatically true for everyone.
- Limit use of sensitive personal information(California / CCPA): we don’t collect any.
Section 9
Automated signals we honour.
- Do Not Track (DNT)— if your browser sends it, we never start analytics. Firefox “Strict” mode and a handful of privacy browsers send DNT by default.
- Global Privacy Control (GPC)— if your browser sends it, we opt you out of analytics immediately on page load. Firefox, Brave, and DuckDuckGo browser send GPC by default. California law explicitly recognises GPC as a valid opt-out signal.
Section 10
Children.
This site is written for adults. We don’t knowingly collect information from anyone under 16. If a parent or guardian discovers we’ve received information from a child, email [email protected] and we’ll remove it.
Analytics opt-out
Your choice
Opt out of analytics.
We also honour the Do Not Track header and the Global Privacy Control signal automatically. If either is on, analytics never start — you don’t need to do anything here.
Section 12
Contact.
Privacy questions or requests: [email protected].
If you’re not satisfied with how we’ve handled a privacy concern, you can also contact:
- Canada: Office of the Privacy Commissioner of Canada.
- Quebec: Commission d’accès à l’information du Québec.
- California:California Attorney General’s Office (oag.ca.gov/privacy).
- EU/UK: your national or member-state Data Protection Authority.
Last reviewed