Privacy Policy

Last updated: August 2026

This Privacy Policy describes how FluTrack (“FluTrack”, “we”, “us”) handles information when you visit flufollower.com and use its features. We have written it to be read, not to be endured. If anything here is unclear, contact us via [email protected] and a real person will answer.

Who we are

FluTrack is an independent publisher that turns public-domain CDC respiratory surveillance data into a plain-English, state-level threat level for flu, RSV and COVID-19. We are the data controller responsible for the information described in this policy. FluTrack is an independent project and is not affiliated with, endorsed by, or sponsored by the Centers for Disease Control and Prevention (CDC) or any government agency.

FluTrack is published by Oak and Main Developers LLC, which is the data controller for the information described in this policy. Our registered mailing address is 2108 N St., Sacramento, CA 95816, United States. You can reach us about anything here at [email protected], or send an access or deletion request directly to [email protected].

What we collect

We collect as little as the site can function on. In practice that falls into three narrow categories.

Information you give us

The only personal information you actively provide is what you submit to the surge-alert form: your email address and the state you want alerts for. We use those two fields solely to send the weekly-at-most alert you asked for. We do not require a name, a password, or an account.

Information collected automatically

Like almost every website, our hosting provider records standard server logs when a page is requested — typically your IP address, the time of the request, the page fetched, and your browser's user-agent string. These logs exist for security, abuse prevention, and understanding aggregate traffic.

Analytics

We use Cloudflare Web Analytics to measure aggregate site use. It is provided by Cloudflare, Inc. We use it to understand aggregate page performance and visits; it is not used to create cross-site advertising profiles. For its current processing details, see Cloudflare's privacy documentation. We review this configuration whenever the analytics implementation changes.

Two details worth stating plainly, because they are the reason this is not behind a consent prompt: Cloudflare Web Analytics is cookieless and writes nothing to your device, and we do not attempt to identify individual visitors from it. Every processor we use is listed by legal entity, with its lawful basis and retention, in our vendor register.

Approximate location — only when you ask for it

The home page offers a “Use my location” button. It does nothing unless you tap it and your browser then grants permission. If you do, your device provides approximate coordinates, which are sent once to the U.S. Federal Communications Commission's public Area API geocoder (geo.fcc.gov) purely to resolve which U.S. state you are in. That state is used to pre-select the picker for you and nothing more. We do not store your coordinates or your resolved location — the value is discarded as soon as the picker is set. If you never tap the button, no location is ever requested.

Cookies and browser storage

FluTrack itself sets no cross-site tracking cookies. The only data the site keeps on your device is three small entries in your browser's localStorage, which stay on your machine and are never transmitted to us:

• flutrack-theme — remembers whether you prefer the light or dark appearance.
• flutrack-state — remembers the last state you looked at, so the picker can restore it on your next visit.
• flutrack-consent — written only once you make a choice about non-essential storage, because we cannot honor a decision we do not remember. It records the categories you chose and when.

All three stay on your device, and none is a tracker. You can clear them at any time through your browser's “clear site data” controls, and the site will simply fall back to its defaults.

Advertising

FluTrack currently serves no advertising at all. It is free and is intended to be supported in part by advertising in future, and this section describes the controls that are already in place for when that happens — they are implemented now, not promised.

Advertising and analytics storage start in a denied state for every visitor, not only where a prompt is legally required, and no advertising or analytics tag can load until you have recorded a decision. You can inspect and change that decision at any time on our privacy choices page, where rejecting is offered exactly as prominently as accepting, and withdrawing is as easy as granting. If your browser sends a Global Privacy Control signal we treat it as a decision to reject, record it automatically, and never prompt you.

When advertising is enabled, third-party advertising partners that serve ads on the site may set their own cookies or use similar technologies to measure and, in some cases, personalize the ads you see — but only after you have allowed it. Those partners operate under their own privacy policies, which we do not control, and each will be named by legal entity in our vendor register before it is switched on.

One limit we place on ourselves regardless of consent: we do not permit ad targeting based on precise location, alert status, threat level, symptom, diagnosis, pregnancy, age, or inferred vulnerability. A respiratory data utility must not become a channel for severity-targeted health marketing, and this rule is set out in full in our advertising disclosure. You can manage or opt out of interest-based advertising from participating companies through the industry choice tools at the Digital Advertising Alliance, the Network Advertising Initiative, and, in Europe, Your Online Choices. Most browsers also let you block or delete third-party cookies directly.

Affiliate links

Some pages may contain affiliate links, where we can earn a small commission if you buy something through them, at no extra cost to you. Following such a link may pass standard referral information to the destination merchant, governed by that merchant's own privacy policy. Affiliate revenue never influences the threat levels we report — the index always reflects the CDC's figures alone. We explain these relationships in full on our affiliate disclosure page.

Third-party services

FluTrack is a static site, and we keep external dependencies deliberately few:

• Cloudflare, Inc. — Site hosting, CDN and edge security (Cloudflare Pages). Serving the site; security and abuse prevention. Lawful basis: Legitimate interest (operating and securing the service). Retention: Short operational window, then deleted or aggregated by Cloudflare.
• Cloudflare, Inc. — Cloudflare Web Analytics. Aggregate page performance and visit measurement. Lawful basis: Legitimate interest — cookieless and storage-free, so it sets nothing on your device. Retention: Aggregate only; no visitor-level profile is created.
• Cloudflare, Inc. — Workers KV (surge-alert subscription store). Storing the email address and state you submit for surge alerts. Lawful basis: Consent (you submit the form). Retention: Until you unsubscribe or ask us to delete it.
• Resend, Inc. — Transactional email delivery for surge alerts. Sending the surge-alert emails you subscribe to. Lawful basis: Consent (you subscribe, and can withdraw at any time). Retention: Until you unsubscribe; delivery logs per the processor’s own retention. Status: Engaged — no alert email has been sent yet.
• U.S. Federal Communications Commission — Area API geocoder (geo.fcc.gov). Resolving “Use my location” to a U.S. state, on tap only. Lawful basis: Consent (you tap the button and grant browser permission). Retention: Not retained — discarded as soon as the state picker is set.
• U.S. Centers for Disease Control and Prevention — Open data API (data.cdc.gov). Fetching public-domain surveillance data directly in your browser. Lawful basis: Legitimate interest (delivering the requested content). Retention: Governed by the CDC, not by FluTrack.

We name these providers by legal entity rather than describing them by role, and keep the full list — with purpose, lawful basis, data categories, retention and deletion route for each — in our vendor register. That register is generated from the same configuration this policy reads, so the two cannot drift apart. In every case a processor is used only for the narrow purpose stated and is not permitted to use your information for its own marketing. If a processor changes, the register and this policy change together and the change is recorded in our changelog.

Surge-alert emails and unsubscribing

If you subscribe to surge alerts, we will email you when CDC data shows respiratory activity climbing in your chosen state — at most about once a week, and often less. Every alert email includes a one-click unsubscribe link, and unsubscribing takes effect immediately. You can also ask us to remove you via [email protected]. Once you unsubscribe, we delete your email address and state from the alert list.

How long we keep information

We keep information only as long as it serves the purpose it was collected for. Subscription details (your email and state) are retained until you unsubscribe. Server logs are kept for a short operational window and then deleted or anonymized. Analytics are retained only in aggregate. Location data from the “Use my location” feature is never retained at all.

Children's privacy

FluTrack is a general-audience information site and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us an email address through the alert form, contact us at [email protected] and we will delete it.

Your privacy rights

Because we hold so little, exercising your rights is simple: email [email protected] and tell us what you would like. We will honor requests to access the information associated with your email address, to correct it, or to delete it. That address is monitored specifically for access and deletion requests, so use it in preference to the general mailbox.

Depending on where you live, you may have additional rights under laws such as the EU/UK General Data Protection Regulation (GDPR) or the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). In plain terms, that means you can ask us what we hold about you, ask us to delete it, and object to certain uses — and we will not treat you differently for asking. We do not sell your personal information, and we do not share it for cross-context behavioral advertising in exchange for payment. Where the GDPR applies, our lawful bases are your consent (for alert emails, which you can withdraw at any time) and our legitimate interest in keeping the site secure and understanding aggregate usage.

California residents

FluTrack is published from California, so this section sets out the CCPA/CPRA position explicitly rather than by reference. In the preceding twelve months we have collected one category of personal information as that term is defined by the CCPA: identifiers — specifically an email address, and the state you choose, only if you submit the surge-alert form. We collect it directly from you, for the sole purpose of sending the alerts you asked for, and we retain it until you unsubscribe or ask us to delete it.

• We have not sold personal information, and we do not sell it. We have never sold or shared personal information of any consumer, including anyone under 16.
• We do not share personal information for cross-context behavioral advertising.
• We do not use or disclose sensitive personal information for any purpose that would trigger a right to limit its use. We do not collect any.
• You may exercise your rights to know, access, correct, delete, and opt out by emailing [email protected]. You may use an authorized agent; we will ask for proof of authorization.
• We verify a request by confirming control of the email address the request concerns, which is the only identifier we hold. We aim to respond within 45 days.
• We will not discriminate against you for exercising any of these rights. The site is free, and nothing about it changes if you ask us to delete your information.
• We honor Global Privacy Control as a valid opt-out signal. It is respected automatically, with no action needed from you — see your privacy choices.

If you are a California resident and we deny a request, you may appeal by replying to our response; we will explain the decision in writing. You may also contact the California Privacy Protection Agency or the California Attorney General.

International visitors and data transfers

FluTrack covers U.S. respiratory surveillance and is operated from, and hosted in, the United States. If you access the site from outside the United States, the limited information described here — for example, an email address you submit for alerts — will be processed in the United States, which may have different data-protection rules than your home country. By using the site or subscribing to alerts, you understand that this transfer takes place.

Changes to this policy

We may update this policy as the site evolves or as the law requires. When we do, we will revise the “Last updated” date at the top of this page, and for material changes we will make the update prominent rather than quietly editing it in. Continued use of FluTrack after an update means you accept the revised policy.

Contact us

Access, correction and deletion requests: [email protected]. General questions and anything else about this policy: [email protected]. Either reaches a real person.

FluTrack is published by Oak and Main Developers LLC, which is the data controller for the information described here. Who is accountable for the site, and how corrections are recorded, is set out on our About page.