What this tool keeps, and what it never sees

What you type into the ledger is held in this browser’s local storage. Clearing your browser data, or pressing “Start over”, removes it. An account is optional and changes none of that: your journey still lives in this browser.

If you make one, we store a random account number, whichever way in you chose (the public half of a passkey, or an email address and a scrambled form of your password that cannot be turned back into it), a ten-word recovery code we keep only the scrambled form of, and the ledgers you press save on. No mail is ever sent to that address.

Deleting your account from /account erases all of it; corrections you already sent stay in the public register with the link back to you removed.

While you type, the words in the box are sent to this site so that the same rules your browser just ran can be run again on our server. Only the phrases those rules cannot place go any further.

Each one goes on its own, with at most four words from the phrase just before it and four from the phrase just after it, together with the list of unit names from the price table. The rest of what you wrote stays here, and no price is sent.

On waypointledger.org these phrases go over an encrypted connection to OpenAI, whose model (gpt-5.6-luna, or gpt-5.5 and then gpt-5.4-mini if that one does not answer) may reply only with a unit name the table already holds. No price ever comes back: the published federal table does all of the pricing here.

The answer, which carries the phrases you typed, is held on our side for one day under a one-way hash of what you typed, so the same sentence is not read twice. After that day it is gone.

The code picks the model by which key a copy of this site holds: OpenAI when it has an OpenAI key, which ours does; otherwise Anthropic; otherwise Cloudflare Workers AI, Cloudflare’s own model on the network that served you this page. Our staging copy has no OpenAI key and uses Cloudflare Workers AI. If the model does not answer, the rules’ answer stands and the line is left blank for you to fill in. What OpenAI keeps on its side is set by its API data policy. You can see exactly what is sent and what comes back at POST /api/map (add ?debug=1), and the rules themselves are in the open source.

Saving is the one thing that puts your own words on our server: the units of care, their counts and the short phrase you typed for each line, so the link you get back opens the ledger again.

Two things come back with that link. A delete code, shown once, which is the only way to remove the save and needs no account. We keep only a one-way hash of it, so we cannot use it and cannot recover it for you. And a date: an anonymous save stops opening after 180 days, while a save on an account has no expiry.

Anyone holding the link can open that ledger, so treat the link as the ledger itself and keep names out of what you type.

Choosing your coverage and where you live changes which published figure each line shows you. Both answers are held in this browser under waypoint-ledger.ctx.v1, and the fit of a figure to a person is worked out on your own device: neither answer is attached to a correction, a gap report, a share link or a saved ledger.

The link the ledger copies for you carries only the units of care, their counts, the counter a line belongs in and how many months, never your words or a name, inside the link itself, after the #. A browser never sends that part to any server, so a shared journey of this kind is never stored by us and never arrives here.

A link from Save is the other kind: that one is a row in our database, and it is described field by field below.

If you mark a published figure right or wrong, we record the identifier of the figure, your verdict, optionally the amount you say you paid, the version of the price table, and an optional note that is never published and never exported. No name, no diagnosis and no IP address on the row, ever.

If you happen to be signed in, the row also records which account sent it, so the site can show you what you have flagged; deleting your account removes that link and leaves the correction counted. If you are not signed in (the default, and how nearly everyone uses this), there is no account and nothing about you on the row. The aggregate is public at /api/corrections.

To stop one person answering the same figure a hundred times, the server also counts sends against a one-way hash of the network address, salted with the date and a secret only the server holds. The address itself is never stored, the hash cannot be turned back into it, it stops being comparable the next day, and nothing derived from it appears in any published row or export. The full description is on the integrity page.

So that one person cannot answer the same figure a hundred times, your browser makes a random identifier for itself the first time you send anything, and keeps it under waypoint-ledger.submitter.v1. It is sent with a correction and the server stores only a truncated hash of it combined with that one price row: a hash that cannot be joined to your answer on any other row, and that we could not turn back into the identifier if we wanted to. It is used for nothing else and sent nowhere else.

If you report care you needed and did not get, we record the counts and ranking you entered, an optional note, and any optional context you chose to give (an age band, insurance type, region, and how urban or rural).

The counts and the ranking are public at /api/gap and in the open CSV, with the day the report arrived and never the time. The context is published only as counts, and any value fewer than 11 reports gave is not shown: it is counted in one line, “fewer than 11, not shown”, and never named. The note is never published.

When you add the ledger’s “Times you were told it was nothing” count, your browser also sends a random identifier it keeps under waypoint-ledger.gap-key.v1, joined to the number. The server keeps a one-way hash of that pair for one day, in a store separate from the reports, so the same number pressed twice is counted once. It is not written to the report, and it is used for nothing else.

Your ranking of five burdens, three multiple-choice answers, an optional clinician count, any optional self-description you chose (who is answering, age band, sex, coverage, region, state, stage, and the age bands when the illness began and when it was diagnosed), the channel slug on the link you used, and the time it was received. An optional one-sentence note is encrypted at rest and never published.

What is public, and where. The open CSV at /api/export/survey.csv has one row per answer: your ranking, your three answers, the clinician count, the channel, the instrument version and the day it arrived. It never has the time and never has anything you said about yourself.

What you said about yourself is published only as counts, at /api/survey and on the register, and any answer fewer than 11 people gave is not shown there: it is counted in one line, “fewer than 11, not shown”, and never named. The same rule is applied on our server, before anything is sent to a browser.

An answer about a child carries no name and no date of birth, and is read as its own group on the register. If you were signed in when you sent it, the row also records which account sent it, and deleting your account cuts that link. Otherwise nothing on the row points back to you, so there is no way to find one answer again, and this site has no way to delete one.

The answers you wrote, who is answering if you chose to say (you, or a parent or caregiver), the consent you chose (learn only, quote anonymously, quote by name), a name only if you chose to be quoted by name, and an email address only if you asked to hear about a new version.

Interview answers are encrypted at rest. Only our team reads them, through a private admin screen; no public page, endpoint or export carries them. Quotes appear only in the way you chose. To have an interview removed, write to us through Contact.

Your browser makes no third-party request of any kind. The single outside request this product makes is the one above, to the AI reader, and our server makes it: never your browser, and never with a price in it.

The three typefaces are served from this domain (they used to come from Google Fonts, and that was the last outside request left). There is no third-party analytics script, no advertising, no tracking cookie. Our own server does keep one number per day for each of a few actions (a story read, a ledger opened, priced, saved or exported, a sheet printed, a correction, a survey answer, an interview), with no cookie, no address, no identifier and nothing you typed; those counts are public on the live register, and our own tests and known bots are left out of them. The only cookie this site can ever set is the session cookie you get if you sign in, and it holds one random value.

When you do send something, every field that lands in our database is listed here, and this list is generated from the database itself, so it cannot fall behind.

A privacy page written as prose drifts from the database the first time an engineer adds a column. So this part is not written. It is generated from the schema itself (103 columns across 14 tables, read from 0001_init.sql, 0002_integrity.sql, 0003_users.sql, 0004_journey_privacy.sql, 0006_agg.sql, 0007_annotations.sql), together with the validators as they actually run, the field list inside the tamper-evidence chain, and the header of each published CSV. A column added without a plain-English description here fails our build, so a field cannot ship without appearing on this page.

Generated 2026-10-01 · schema fingerprint 4ed7c6071383

Kept

Says whether the value is always there or only when it applies.

Public

Means the value is served to anyone row by row (for the three registers with a CSV, that is exactly what the CSV carries); a value published only as a count, like what you say about yourself on the survey, says no here and is explained under its table.

In the CSV

Means it is in the open download at /api/export.

Precision Federal, Ames, Iowa. Questions: Contact.