FluTrack

Transparency

Vendor register

Every third party that touches data from this site, named by legal entity — what each one does, why we are allowed to use it, what it sees, how long it keeps it, and how to have it deleted.

Named, not described by role

A privacy policy that describes vendors by category — “a reputable email provider”, “a privacy-respecting analytics service” — cannot be checked against what the site actually loads. This register names the legal entity behind each one, and is generated from the same configuration the Privacy Policy reads, so the two cannot disagree.

Processor Purpose Lawful basis Data categories Retention Deletion path Class & status
Cloudflare, Inc. Site hosting, CDN and edge security (Cloudflare Pages) Serving the site; security and abuse prevention Legitimate interest (operating and securing the service) IP address, request time, URL requested, user-agent (server logs) Short operational window, then deleted or aggregated by Cloudflare [email protected] EssentialLive
Cloudflare, Inc. Cloudflare Web Analytics Aggregate page performance and visit measurement Legitimate interest — cookieless and storage-free, so it sets nothing on your device Page URL, referrer, coarse device/browser class, performance timings Aggregate only; no visitor-level profile is created No visitor-level record exists to delete AnalyticsLive
Cloudflare, Inc. Workers KV (surge-alert subscription store) Storing the email address and state you submit for surge alerts Consent (you submit the form) Email address, chosen state, submission timestamp, country, user-agent Until you unsubscribe or ask us to delete it [email protected] EssentialLive
Resend, Inc. Transactional email delivery for surge alerts Sending the surge-alert emails you subscribe to Consent (you subscribe, and can withdraw at any time) Email address, delivery metadata Until you unsubscribe; delivery logs per the processor’s own retention [email protected] EssentialEngaged — no alert email has been sent yet
U.S. Federal Communications Commission Area API geocoder (geo.fcc.gov) Resolving “Use my location” to a U.S. state, on tap only Consent (you tap the button and grant browser permission) Approximate coordinates, sent once and never stored by us Not retained — discarded as soon as the state picker is set Nothing is stored, so there is nothing to delete EssentialLive
U.S. Centers for Disease Control and Prevention Open data API (data.cdc.gov) Fetching public-domain surveillance data directly in your browser Legitimate interest (delivering the requested content) Your browser’s own request metadata, sent to the CDC, not to us Governed by the CDC, not by FluTrack Contact the CDC; FluTrack holds no record of these requests EssentialLive

Last updated: August 2026

How to read the “class” column

  • Essential — needed for the site to work or to stay secure. Not subject to a consent prompt, and documented here instead of being buried.
  • Analytics and Advertising — non-essential. Anything in these classes that writes to your device is denied until you record a decision on our privacy choices page. Cloudflare Web Analytics is classed as analytics but is cookieless and stores nothing on your device, so it never engages that gate; we list it here rather than pretending a prompt governs it.

Jurisdictional basis

FluTrack is operated from and hosted in the United States, and covers U.S. respiratory surveillance. Where the EU/UK GDPR applies, our lawful bases are the ones named in the table: consent for the surge-alert subscription and for the optional location lookup, which you can withdraw at any time, and legitimate interest for serving and securing the site and understanding aggregate usage. Under the California Consumer Privacy Act, we do not sell personal information and we do not share it for cross-context behavioral advertising. We honor Global Privacy Control as an opt-out signal where it applies.

Deletion and access requests

Write to [email protected] and tell us what you would like. We will honor requests to access, correct or delete the information associated with your email address. Where a row above says nothing is stored, there is genuinely no record to retrieve or erase — the “Use my location” lookup is discarded the moment it resolves to a state.

When this register changes

We review this register whenever the analytics or advertising implementation changes, whenever a processor is added or removed, and at each release. Changes are recorded in our corrections and changelog. If you spot something here that does not match what the site actually loads, please tell us — that mismatch is exactly the problem this page exists to prevent.

Vendor documentation

Not medical advice

The information on FluTrack is provided for general informational purposes only and is not a substitute for professional medical advice, diagnosis, or treatment. Always seek the advice of a qualified health provider with any questions you may have regarding a medical condition.