Privacy
What we collect, and what we deliberately do not
There is no account, so there is no profile
ImOnFHIR has no sign-up, no login, and no user record. We do not know who you are, and there is no profile to sell, leak, or hand over. Everything below is about anonymous, aggregate measurement of a website.
Payloads
The FHIR you paste into a Lab tool is never sent to any analytics service, in any form — not its contents, not its size, not a hash of it, not the name of a file you uploaded. The Washer and Compare do not send it anywhere at all; the Validator sends it only to our own validation sidecar. The security page has the per-tool detail and the automated network-silence test that proves it.
The Lab is for synthetic or properly de-identified data. Please do not paste real PHI into it.
Analytics
| What | Where | Identifiers kept |
|---|---|---|
| Vercel Analytics — a closed list of seven usage counters | Every page, including the Lab | None. No cookie, no device id. |
| Google Analytics 4 — page views and referrers | Public pages only. Never a Lab tool, never /licenses. | None retained. Cookieless mode, so no _ga cookie and no persistent client id. |
Google Analytics runs with client_storage set to ‘none’. That is the setting that stops it writing a _ga cookie or minting the persistent client_id it normally uses to recognise a returning browser. Google Signals, ad personalization and remarketing are all switched off in code, and our Content-Security-Policy names no advertising endpoint — so even if one of those were enabled by mistake in the Google console, your browser would refuse the request.
The address we report is rebuilt, not passed through. We send the site origin plus a path from a list of known public routes; query strings and fragments are discarded unconditionally, and an unrecognised path is reported as a single placeholder rather than as typed. Nothing you enter anywhere on this site can travel in a URL.
Cookies
We set none. Not for analytics, not for advertising, not for sessions. That is why you have not been asked to dismiss a consent banner — there is nothing to consent to. The Lab stores a few of your own preferences (which view you last used, for instance) in your browser’s local storage; that never leaves your machine and is not readable by us.
The compromises, written down
A privacy page that lists only wins is not being honest about the trade.
- Our visitor numbers are wrong, on purpose. Without a persistent identifier, every visit looks like a new browser. Unique-visitor and returning-visitor figures are inflated and session counts are unreliable. We accept worse analytics rather than set a tracking cookie.
- Google still sees your IP address when a public page loads the tag, as any third-party request would. This is why the Lab tools and /licenses are excluded entirely rather than merely configured carefully.
- Some settings live in Google’s console, not in our code. Data retention, Enhanced Measurement, and the account-level Google Signals switch are configured by us in the Google Analytics admin and cannot be verified by our tests. Our commitments there: Signals off, advertising features and Google Ads links off, data sharing with other Google products off, Enhanced Measurement off, retention at the minimum. The Content-Security-Policy is the layer that still holds if any of those were changed.
Who else is involved
The full subprocessor list — hosting, database, DNS, email, monitoring — is published on the security page, alongside every outbound destination our servers contact and whether your payload is in it. Security teams should start at the whitelisting guide, which lists every domain a browser will reach.
Questions, or a correction
Write to security@imonfhir.com. If something on this page is wrong or has gone stale, that is worth reporting as much as a vulnerability is.