Policy · Last updated August 15, 2026
Privacy policy
We collect page analytics, and your email address if you type it into a signup box. That is the whole list. We do not ask for, receive, or store any health information: no symptoms, no diagnoses, no prescriptions, no lab results. We do not sell or rent anything we hold. We run no advertising, so nothing here feeds an ad profile.
The one piece worth reading in full is the affiliate section, which explains exactly what the tracking string on an outbound link contains. It is a random session number, and it is not your name.
Who runs this site
HRT Picks is independently operated. It is not owned by, funded by, or controlled by any hormone-care platform we rank, and no provider has any input into scores or rankings. Editorial responsibility sits with the named editor on our about page. For anything in this policy, including a deletion request, write to thecompoundgroupco@gmail.com.
What we collect automatically
Three analytics services run on this site. Between them they record which pages you opened, which page or search engine sent you, roughly where you are (country and region, derived from your IP address, never a precise location), your browser and device type, and which links you clicked, including outbound links to providers.
- Vercel Analytics. Aggregated page-view counts from our hosting provider. It sets no cookie and builds no cross-site profile.
- Google Analytics 4. Loaded on every page, on our own property. It sets a
_gacookie holding a randomly generated client id for your browser. We load it with IP anonymisation on and with advertising storage, advertising user data and ad personalisation all set to denied, so Google is not permitted to use this traffic for ad targeting or remarketing. - Eyepup product analytics. A script from eyepup.com that records page views, clicks and scroll behaviour so we can find broken or confusing parts of the site. It also records a labelled event on every outbound affiliate click, described below. This project is shared with our sister comparison sites, and each event carries a site label so the datasets stay separable.
Our hosting provider also keeps ordinary server request logs, which include IP addresses and user-agent strings, as part of running and protecting the site.
What we collect because you typed it
- Your email address, only if you submit one. We store the address, a label for which box on which page you used, and the timestamp. Nothing else. We never ask for your name, your age, your symptoms, or your prescription.
- Quiz answers stay in your browser. The match quiz runs entirely on your device. Your answers are never sent to us or to anyone else, and they are gone when you close the tab.
What we never collect
- Medical records, diagnoses, symptoms, prescriptions or lab results
- Anything you tell a provider after you leave this site
- Payment card or bank details. Nothing on this site is for sale
- Social security numbers or government identification
- Biometric data, or precise device location
What the affiliate tracking string actually contains
6 of the 16 platforms we rank pay us a commission when a reader signs up, which is how the site is funded. Those outbound links carry two pieces of attribution data, and this is all of it:
- A surface label. A short word describing which placement the click came from, for example a hero button, a comparison table or a review page. It says nothing about you.
- Your Google Analytics client id, prefixed. The random number from the
_gacookie described above, with a short site prefix in front of it. The affiliate network hands that same string back to us if a signup is approved, and we use it to record the commission against the visit that produced it. It contains no name, no email address, and nothing about your health. If the cookie is absent, the link goes out untagged and the click is simply unattributable.
Our affiliate network is Katalys, which routes clicks through the domain track.revoffers.com and sets its own tracking cookie to establish that the referral came from us. Once you land on a provider's website you are on their property and their privacy policy governs everything that happens next, including whatever they collect during an intake. We never receive it. Full affiliate disclosure, including who pays us.
Cookies, storage, and the notice you saw
The notice card in the corner of the screen is informational. US privacy law requires disclosure and an opt-out rather than consent before loading, so dismissing it records only that you have seen it. Here is everything this site stores in your browser:
| Name | Set by | Purpose |
|---|---|---|
_ga and related | Google Analytics | Random client id so repeat visits from one browser count as one visitor. Also what the affiliate attribution string carries. |
| Eyepup identifiers | eyepup.com | Groups your page views into one session for usability analysis. |
hrt-cookie-notice | This site | Remembers that you dismissed the privacy notice, so it shows once. |
hrt-from-ai, hrt-exit-shown, hrt-ai-banner-dismissed, hrt-intl-banner-dismissed | This site | Session-only flags that stop a banner or a popup from reappearing during one visit. Cleared when you close the tab. |
We set no advertising cookies, because we run no advertising.
How to turn the tracking off
- Block or delete cookies for this site in your browser settings, which also clears the tracking string described above.
- Install Google's official Analytics opt-out browser add-on, or block googletagmanager.com and eyepup.com with any content blocker. The site works normally without either.
- Email us and ask. We will delete what we hold and confirm when it is done.
The email list
Email addresses are handled by Resend, our email provider, which stores the address and sends on our behalf. We do not sell, rent, or share the list with any provider we rank, and we do not use it for advertising. To come off it, use the unsubscribe link on any email we send, or write to thecompoundgroupco@gmail.com and say so. One line is enough and no reason is required.
Who processes data for us
| Processor | What it handles |
|---|---|
| Vercel | Hosting, server request logs, aggregated page-view analytics |
| Google Analytics | Traffic sources, page performance, approved commission values recorded against a random client id |
| Eyepup | Usability and click analytics, including outbound affiliate click events |
| Resend | Storing and sending to email addresses you submit |
| Katalys | Affiliate click tracking and commission reporting on outbound links to partner platforms |
How long we keep things
- Analytics events: no longer than 14 months, after which only aggregated totals remain.
- Email addresses: until you ask to be removed.
- Server request logs: a short operational window set by our hosting provider, typically weeks rather than months.
Your rights in California
Under the CCPA as amended by the CPRA, California residents may ask what personal information we hold, ask for it to be corrected or deleted, and opt out of its sale or sharing. We do not sell personal information and we never have. Passing a random session id to an affiliate network for commission attribution may fall within the broad statutory definition of "sharing" for cross-context behavioural advertising, so we say so plainly rather than argue the point. Two things stop it: blocking cookies for this site, which removes the id the string would carry, or emailing us to say you want out. We will not treat you differently for exercising any of this.
Your rights elsewhere in the US
Comparable laws in Virginia, Colorado, Connecticut, Utah, Texas and a growing list of other states give residents rights of access, deletion, correction and opt-out. We apply the same process to every request regardless of which state you write from, because operating two standards would be more work than operating one.
Your rights in the EEA and the UK
Every provider we rank operates in the United States and this site is written for a US audience, so we do not target or monitor visitors in Europe. If you are in the EEA or the UK and reach us anyway, you keep the rights the GDPR gives you: access, rectification, erasure, restriction, objection, portability, and a complaint to your national supervisory authority. Our basis for analytics is legitimate interest in understanding how the site is used, and our basis for email is your consent, which you can withdraw at any time.
Children
This site is for adults and is not directed at anyone under 18. We do not knowingly collect anything from a child. If you believe a child has submitted an email address to us, write to us and we will delete it.
Security
The site is served over HTTPS and email submissions are proxied through our own server so that no credential is ever exposed in your browser. We hold very little, which is itself the strongest protection we can offer you.
Changes to this policy
When the site adds or removes a tracker, this page is updated in the same change. The date at the top is the last time that happened, and it is the honest version of a "last reviewed" stamp because nothing else on the page is allowed to describe something the code does not do.
Contact
Privacy questions, access requests and deletion requests go to thecompoundgroupco@gmail.com. Related reading: terms of use, editorial policy and the affiliate disclosure.
This is general information, not medical advice. Nothing on HRT Picks, including this policy, creates a clinical relationship, and hormone therapy decisions belong to you and a licensed clinician.
Midi Health
Sesame Care