Privacy

Last updated 2026-10-07. Written to describe what the site actually does today, not what it is planned to do. Where a capability does not exist yet, this page says so.

The short version. There is no account system and no tracking of you across sites. If you start a watch we store your email address, the ZIP if you typed one, and the medication page you asked to watch, so that we can email you when its FDA listing changes. Stopping the watch deletes your address from it. A business asking about advertising sends its contact details to our mailbox. Everything else on this site is anonymous.

A list of medications is health data, and we treat it as such. Under Washington’s My Health My Data Act and Nevada’s SB 370, information about a person’s efforts to research or obtain health services can be “consumer health data”. Telling us which medication you want watched is exactly that. We ask for it only when you volunteer it, we use it only for the thing you asked for, and we do not sell it, share it, or use it for advertising — ever, and not as a matter of current policy that could quietly change.

What happens when you start a watch. We store, in a database run for us by our database provider (Supabase) and readable only by our own server code: your email address, the ZIP if you gave one, the medication page you asked to watch, when you asked, when you confirmed, which version of the consent sentence you saw, and a one-way salted hash of your connection’s IP address that is used only to limit abuse. We then email you a confirmation link through our email provider (Resend). Nothing is watched until you click it, and an unconfirmed request is deleted after seven days. Once confirmed you get one email on any day the FDA listing for that page changes, and nothing else. We also receive a notice in our own inbox when a new watch is started; it names the medication but not your address.

Stopping a watch. Every email carries a one-click link to stop it. Stopping deletes your email address and ZIP from that watch; what remains is an anonymous record that a watch on that page once existed. If you watch several medications, each has its own link.

Analytics: what we run and where we refuse to run it. We use Vercel Web Analytics on informational pages. It sets no cookie, stores no persistent identifier, and cannot follow you to other sites. We chose it over Google Analytics deliberately: on this site the page address itself reveals which medication someone is reading about, and we are not willing to hand that to an advertising company. Vercel already serves every page here, so it learns nothing that hosting a website does not already involve.

No analytics on the two pages built around identifying yourself. The watch page and the fill-report page carry no analytics script of any kind, and an automated check fails our build if one ever appears on them, so it cannot lapse during some later change. The limit of that is worth stating plainly: a short watch form also sits on the drug pages, the tracker and the shortage-status pages, and those pages do carry the cookieless analytics described above. What it records there is the page address — the same thing our host already logs in order to serve it. It never receives what you type. Your email, your ZIP and the medication you name go to us and to nobody else, on every page without exception.

Fill reports. If you report having filled a prescription, we store the pharmacy chain, the first three digits of the ZIP, the strength and the date. Never the full ZIP, never your name, and never anything that ties the report back to you on a public page.

Advertising inquiries. The form on the advertising page is for businesses. The company name, contact name, email, website and message it collects go to the operator’s mailbox through the same email provider, are used only to reply, and are deleted on request. It asks nothing about health or medication, and advertisers never receive anything about readers.

Children. This site is not directed at children and we do not knowingly collect their information. A parent watching a child’s medication is watching a drug strength, which tells us nothing about the child.

Seeing or deleting what we hold. Email privacy@refillscout.com and we will tell you what we have and delete every watch held for your address, along with any notice about it in our inbox; we will confirm when it is done. You do not need an account, a reference number, or a reason. If what we store ever changes, this page will be updated before that happens, not after.

What we will never do. Sell or rent your address. Share which medication you watch with an advertiser, a data broker, a pharmacy or a manufacturer. Put an advertising pixel on this site. Email you anything you did not ask for.