Legal

Privacy Policy

Last updated: 6 November 2026 (contact-form transfers and retention)

1. Data Controller

The data controller responsible for your personal data is:

• Eleanor Watson, EthicsNet Ltd (Company number 11412076)
• 11 Kingfisher Business Park, Arthur Street, Lakeside, Redditch, United Kingdom, B98 8LG

For data protection queries, please contact us.

2. What Data We Collect

When you contact us through our website form, we collect:

• Your name
• Your email address
• The content of your message
• Timestamp of submission
• A record that you gave consent
• Technical request data that Formspree receives with the submission, such as your IP address

Please do not put health information or other sensitive personal data in your message: Formspree's privacy policy says its service is not to be used to collect it.

3. How We Use Your Data

We process your personal data for the following purposes:

• Responding to inquiries: We use your contact information to respond to your questions or feedback about our research.
• Research collaboration: If relevant, we may contact you about research opportunities or collaborations.

4. Legal Basis for Processing

We rely on a single legal basis for each purpose described in section 3:

• Consent (Article 6(1)(a) GDPR): We process the name, email address, and message you submit through the contact form, in order to respond to your inquiry, on the basis of the consent you give when you tick the consent box and submit the form. You may withdraw this consent at any time (see section 7).
• Legitimate interests (Article 6(1)(f) GDPR): Where relevant, we may later contact you about research opportunities or collaborations. We rely on our legitimate interest in pursuing and managing research collaboration for this follow-up; you may object to it at any time (see section 7).

5. Data Sharing

Your data may be shared with:

• Formspree: Our form processor (see their privacy policy)
• Research team members: Only as necessary to respond to your inquiry
• No marketing third parties: We never sell or share your data for marketing purposes.

Clinic and third-party services

Some features of this site, including the Clinic (our interactive diagnostic tool), contact third parties directly from your browser. These services receive data as described below, not through us:

• Anthropic, PBC (Clinic): If you choose an Anthropic cloud model, the Clinic sends the complete provider request directly from your browser to Anthropic. This includes your messages, the Clinic's system instructions and tool definitions, tool calls and results, request settings, and your Anthropic API key. The request does not pass through our application server. Anthropic's role, retention, and permitted use are governed by the agreement attached to your API account, rather than determined by this website. See Anthropic's privacy policy and usage policies.
• OpenAI, L.L.C. (Clinic): If you choose an OpenAI cloud model, the same categories of request data and your OpenAI API key are sent directly to OpenAI. The Clinic sets store: false, but that option is not a promise of zero provider retention. OpenAI's role, retention, and permitted use are governed by the agreement attached to your API account. Only the selected provider receives a request, and each provider's key is held separately in page memory. See OpenAI's privacy policy and usage policies.
• Model hosts (Clinic): The Clinic's transformers.js and WebLLM code is served from this site. When you first use semantic search or a local model, your browser downloads model files from Hugging Face and, for some compiled WebLLM files, GitHub. Those hosts receive ordinary request metadata such as your IP address, user agent, requested file, and timing. The Clinic does not put conversation text into those download URLs or requests.

Public MCP service

If you query the public MCP service at mcp.psychopathia.ai from an MCP client, the service receives the tool name and arguments you send and ordinary request metadata such as your IP address. It does not require an account. The service runs statelessly, with no sessions, stored events or database. It keeps no access log and does not log tool arguments or results. If a tool fails internally, it logs the tool's name and a technical error trace, whose error message could quote part of the failing input. The TLS proxy in front of the service sees request metadata such as IP addresses. How long the proxy's logs and the host's system logs are kept is set in the host configuration; that period is not yet documented here and is pending controller review.

Website hosting and analytics

This website is served by GitHub Pages through Cloudflare. Both receive ordinary request metadata, such as your IP address, browser and the page requested, when you load a page, and handle it under their own terms. What they retain, and what aggregate traffic figures their dashboards show us, is set by those services; we have not yet documented it. The pages do not load Cloudflare Web Analytics (the Cloudflare Insights beacon) or any other analytics script; we checked the site's source and the served home, framework, book and pattern pages on 5 November 2026. The only Cloudflare script any page loads is Turnstile, on the book's note panel, described in section 10.

International transfers

Some recipients and model hosts may process data outside the United Kingdom or European Economic Area. This can include Formspree contact submissions, a user-directed Clinic request to the selected inference provider, and request metadata sent while downloading model files from Hugging Face or GitHub. The applicable location, role, retention, and transfer mechanism depend on the current terms for the account and service you use.

Contact form (Formspree). Formspree, Inc.'s terms of service say it provides its services "from facilities in the United States", and its security page says they are "hosted with Amazon Web Services in the United States", so contact submissions are processed in the US. For that transfer, Formspree's security page says: "We rely on Standard Contractual Clauses (SCCs) as a data processor." Its privacy policy also says it needs to transfer personal information "to the US and to other jurisdictions as necessary to provide the Services". Its published sub-processor list names 27 companies, 26 of them in the United States.

What we could not confirm from Formspree's published pages, checked on 6 November 2026: it publishes no data processing agreement and no text of the clauses it relies on; it does not say whether it uses the UK International Data Transfer Agreement or the UK Addendum for transfers from the UK; and it does not say that it takes part in the EU–US Data Privacy Framework. Its documents also describe its role inconsistently: the security page calls it a data processor, while its terms of service describe its customers as "separate and independent data controllers". We have not confirmed that a signed data processing agreement covers this site's account.

6. Data Retention

A contact submission is kept in two places: our Formspree account, and the email inbox Formspree forwards it to, together with any replies.

• Period: we delete a submission, and the email exchange that follows it, 12 months after the last message in that exchange.
• How: Formspree's documentation describes no automatic deletion setting, so we delete by hand. Once a quarter, we delete from the Formspree dashboard and from the inbox every submission and thread whose last message is more than 12 months old. A submission is therefore deleted at the first quarterly run after its 12 months have passed.
• Sooner, on request: ask through the contact form and we delete your submission and the exchange within one month.
• Longer, only where the law requires it: for example while a legal claim is open, and only for as long as that need lasts.

Deleting a submission in the dashboard does not control Formspree's own records. Its privacy policy says it keeps information "for as long as your account is active" or "as needed to provide the Services", and that it retains "log files for internal analysis purposes", without stating a period. Its plans page lists a 30-day submission archive on the Free plan and an unlimited archive on paid plans. Browser-local Clinic data is controlled separately as described in section 9.

7. Your Rights

Under GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data
• Restriction: Limit how we process your data
• Portability: Receive your data in a portable format
• Object: Object to certain types of processing
• Withdraw consent: Withdraw consent at any time

8. Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• HTTPS encryption for data in transit
• Secure form processing through Formspree
• Limited access to personal data

9. Cookies and Browser Storage

This website does not set any cookies. We do not use analytics or marketing cookies. We do, however, use your browser's built-in Web Storage for functionality. Apart from the reader-notes key, which reaches us only when you send a note or open your private notes page, nothing stored in your browser is transmitted to us:

• Theme preference: Your dark-mode choice is saved under the pm-theme key in your browser's localStorage. It stays on your device and is never transmitted to us or any third party.
• Clinic conversation data: The Clinic stores a bounded, structured copy of messages, tool calls, and truncated tool results, together with model and interface preferences, in localStorage for reload recovery. It also removes any transcript saved by earlier versions of the Clinic. The conversation persists until you choose New Session or clear this site's data; the model and thinking-mode preferences persist until you clear this site's data. Cloud-mode requests transmit the current conversation to the selected provider as described in section 5, but the conversation is not transmitted to us.
• Clinic API key: A supplied Anthropic or OpenAI key is held only in the open page's memory, separately for each provider, and is cleared when you reload, leave the page, or close the tab. It is sent only in requests to the selected provider and is never transmitted to us. Earlier versions of the Clinic kept keys in sessionStorage; the Clinic now deletes those entries when it loads.
• Clinic model caches: Browser-managed HTTP Cache, Cache Storage, or IndexedDB may retain semantic-search and local-model files. Delete cached model removes the selected WebLLM model through its runtime. Clearing this site's data is the broader deletion route for caches that the interface cannot enumerate reliably.
• Book reader preferences: The Book reading view saves your reading position, last-visit time, bookmarks, and display settings (font size, line and paragraph numbers, sidebar state) in your browser's localStorage so the Book can restore where you left off. This data stays on your device and is never transmitted to us.
• Figure preference: The standalone framework overview stores its light or dark theme under pmfig-theme in localStorage.
• Private reader notes: On Book pages, the note panel keeps a random key and a short list of your notes in localStorage. The key is sent to us only with a note you choose to send, as described in section 10.

10. Private reader notes

Some pages let you send us a private note: a comment on a passage, a suggested edit, or a note about a page as a whole.

Who sees your note. Only Nell Watson and the editorial team. Notes are never published as comments and are not visible to other readers.

What we collect. The text of your note, the passage you selected and the address of the page, and the time you sent it. Your name and email address only if you choose to give them, and whether you would like to be thanked by name.

What we do not collect. We do not store your IP address. To prevent spam we keep a one-way, salted hash of it that changes every day and is deleted within two days. Cloudflare Turnstile checks that a person is sending the note. It loads only when you open the note panel, and Cloudflare's privacy policy applies to it.

Where it is stored. In a database run for us by Cloudflare (Cloudflare Workers and D1). Cloudflare may process it outside the UK and EU, under its data processing terms, which provide the safeguards UK and EU law require for such transfers.

How we use it. To correct and improve the work. If you asked to be thanked, we keep your name on a list of contributors so that we can thank you in the work if we use your note.

Your rights in what you send. When you send a note you agree that we may use, edit, adapt and publish it in any edition or format without payment, and you waive your rights in it as far as the law allows (the full wording is next to the Send button).

Keeping and deleting. After sending, you get a private link where you can see your notes, read any reply, and delete any note at any time. You can also ask us to delete your notes through our contact form. Spam is deleted after 30 days. Notes we don't use are deleted two years after you send them. Notes we use are kept for as long as the work is published, with your name if you asked to be thanked; your email address is deleted after two years.

In your browser. The note panel keeps a random key and a short list of your notes in your browser's local storage, so it can show your private link and lightly highlight passages you have commented on. If you leave “Remember my name and email” ticked, it also keeps the name and email you last gave, so you don't have to type them again; untick it to forget them. The key reaches us only when you send a note or open your private notes page, and we store only a scrambled form of it. Clearing this site's data in your browser removes them.

Legal basis. We rely on your consent, which you give when you send a note. You can withdraw it at any time by deleting your notes.

Your rights. You can ask for a copy of your notes, have them corrected or deleted, or object to how we use them, using the contact details on this page. If you are unhappy with how we handle them, you can complain to the UK Information Commissioner's Office (ico.org.uk) or the data protection authority where you live.

Who is responsible. The data controller is named in section 1.

Age. Notes are for people aged 13 or over.

11. Contact Us

For any privacy-related questions or to exercise your rights, please contact us, clearly stating your data protection request.

12. Complaints

If you're not satisfied with how we handle your data, you have the right to lodge a complaint with a supervisory authority. As we are established in the United Kingdom, our supervisory authority is the Information Commissioner's Office (ICO), which you can contact at ico.org.uk. You may also lodge a complaint with the data protection authority in your own country of residence.