Privacy Policy

The short version

This site uses Google Analytics to count visits and to see which pages get read. It sets cookies in your browser and it tells Google that a visit happened. That is a change: until September 2026 this site ran no analytics at all, and this policy said so in plain terms, so we would rather point at the change than let you find it. There are still no advertising pixels, we still do not sell or share your personal information, and the fonts are still served from our own servers rather than from a font network.

The only information you actively give us is what you type into the contact form and send. Everything else described here is collected in the background by the site, by our host, by Google Analytics and by Ahrefs Web Analytics.

Who this policy covers

This policy covers wildlyprimal.com. It does not cover our Instagram profile, which is governed by Meta’s privacy policy, or any laboratory, supplier or scheduling service you may deal with separately.

It also does not cover the information you give us once you become a client. That is handled under the intake and privacy terms you receive when the engagement begins, which are more protective than this page because the information is more sensitive.

What we collect

When you submit the contact form, we receive what you chose to enter:

• Your name
• Your email address
• Which service you are interested in, if you selected one
• The message you wrote

What our hosting provider records

Like every website, ours runs on servers that keep operational logs. Our host, Vercel, records standard request data (IP address, browser and device type, the page requested, referring page and a timestamp) for delivery, security and abuse prevention.

We do not use these logs to build a profile of you, we do not combine them with contact-form submissions, and we do not have a way to identify you from them.

Analytics

We use Google Analytics 4 (measurement ID G-SFVMMVZCY7) to understand how this site is used: how many people arrive, which pages they read, roughly where they are and what brought them here. We use it to decide what to write next and what to fix. We do not use it to work out who you are.

To do that, your browser loads a script from googletagmanager.com and sends information to Google, which processes it for us in the United States. That information includes the pages you view, the site that referred you, your browser and device type, your IP address, from which Google derives an approximate location — a city or region, not an address — and a randomly generated identifier kept in the cookies described under Cookies below.

Google Analytics also records some interactions on its own, without us switching them on one by one: how far down a page you scroll, clicks on links that lead off this site, file downloads, searches and video plays. That is measurement of what happens on these pages. It is not session recording: we cannot see your screen and we cannot replay your visit.

We also use Ahrefs Web Analytics, a second and simpler visit counter, to see how people who find us through search move around the site. Your browser loads a script from analytics.ahrefs.com and sends Ahrefs the page you are on, the site that referred you, your screen size and your browser’s language setting; like any request on the web, that also passes your IP address to Ahrefs. It sets no cookies and stores nothing in your browser, so it has no identifier with which to recognise a returning visitor.

Separately, we use Vercel Speed Insights to measure how quickly pages actually load for the people visiting them, because a slow page is a real problem and lab tests run on our own machines do not show it. Each measurement records the page, the timing itself and coarse details — browser, device type, operating system, connection speed and country. Vercel states these data points are anonymous, are not tied to an individual visitor or IP address, and cannot be joined up into a session across pages. It sets no cookies, and its script is served from this site rather than from anyone else’s network.

Analytics tells us that a page was read. It does not tell us who read it, we cannot connect a visit to a contact-form message, and we do not try to.

What we do not collect

We want to be specific rather than vague, because “we may collect” language in privacy policies usually means “we do”. On this site we do not:

• Run advertising pixels from Meta, Google, TikTok or anyone else
• Link our Analytics data to Google Ads, or switch on Google Signals
• Load fonts or images from third-party networks
• Use session recording or heatmaps
• Buy or receive personal information about you from data brokers
• Collect health information through this website
• Sell or share your personal information, in any sense those words carry under state privacy law

Why we use what we collect

We use contact-form submissions to read your inquiry, reply to it, and (if we go on to work together) to set up that engagement. That is the whole purpose.

We use server logs to keep the site available and to deal with abuse. Where a legal basis is required, ours is our legitimate interest in operating a secure website, and, for your inquiry, taking steps at your request before entering into a contract.

Who else sees it

We do not sell, rent, trade or share your personal information for anyone’s marketing. A small number of service providers process it on our behalf, under contract, only to provide their service to us:

• Vercel: hosts the site, runs the contact form endpoint and measures page speed
• Resend: delivers the contact-form email to our inbox, and sends an automated confirmation to the address you entered
• Google (Analytics): receives and processes the site-usage information described above
• Ahrefs (Web Analytics): receives and processes the visit information described above
• Google (Gmail): the inbox that receives and stores our email
• GitHub: stores the site’s content and images, which the site is built from

We may also disclose information if the law requires it, or where it is necessary to establish or defend a legal claim, or to protect someone’s safety.

Cookies

Google Analytics sets two cookies here: _ga and _ga_SFVMMVZCY7. Both are first-party cookies, set on wildlyprimal.com rather than on another company’s domain, and both hold a randomly generated number that lets Analytics tell a returning browser from a new one. Neither holds your name, your email address or anything you typed. Google’s published expiry for both is two years.

You can refuse them. Blocking or clearing cookies in your browser settings works, and so does Google’s own opt-out add-on at tools.google.com/dlpage/gaoptout. Nothing here breaks if you do; no part of this site needs them to work.

One further cookie exists, and only administrators of the practice ever receive it: a sign-in cookie for the private content-management area at /admin. It is strictly necessary for signing in, holds only a signed session token, expires after eight hours, and is marked HttpOnly, Secure and SameSite=Strict. Visitors never receive it.

We do not currently show a cookie banner. That reflects a judgement about who visits this site and which rules reach them, and we keep it under review. It is not a claim that no rule could ever apply.

How long we keep it

Contact-form emails stay in our inbox so we have a record of the conversation. We review them periodically and delete inquiries that did not become an engagement, and in any case we will delete yours sooner on request.

Google Analytics keeps what it collects for the retention period set on the property, after which Google deletes it. The two cookies expire on the schedule under Cookies above, or sooner if you clear them.

Server logs are retained by our host on their standard schedule, which is a matter of days to a few weeks, and then rotated out. Administrator account records exist for as long as that person administers the site.

How we protect it

The whole site is served over HTTPS. The contact form is validated on the server and screened by a hidden-field check, and the credentials for our email provider never reach your browser. It is not rate-limited; we say so on our security page too.

Administrator passwords are stored only as salted scrypt hashes, never in readable form. Sessions are signed, short-lived and compared in constant time.

No system is perfectly secure, and we will not claim otherwise. What we can say is that this site holds very little worth stealing, by design.

Health information

Health coaching, as we practice it, is generally not a HIPAA-covered service; we do not bill health insurance and we are not a covered entity or a business associate. That means the health information you send us is not protected by HIPAA, which is exactly why we ask you not to send it through this website.

Please keep your contact-form message to what you would like to discuss. Symptoms, diagnoses, medications and lab results belong in the secure intake process, not in an email.

If you have already sent us health details through the form and would like them removed, email us and we will delete the message.

Your rights

Depending on where you live (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and a growing number of other states), you have rights over the personal information a business holds about you. We extend the following to every visitor, regardless of state, because drawing lines by geography seemed worse than simply honoring them:

• Know what personal information we hold about you and why
• Get a copy of it in a portable form
• Correct anything inaccurate
• Delete it
• Opt out of sale, sharing or targeted advertising, none of which we do — and switch off the analytics described above at any time, by either method under Cookies
• Not be discriminated against for exercising any of these rights

To exercise any of them, email us from the address you contacted us with, or tell us enough to find your message. We will respond within 45 days, and will tell you if we need longer. If we decline a request, we will say why, and you may appeal by replying to that response.

Do Not Track and Global Privacy Control

We do not track you across other companies’ websites and we do not sell or share your information, so the thing these signals exist to stop is not something we do.

The limit of that is worth stating plainly rather than burying: the Google Analytics described above does not read a Do Not Track or Global Privacy Control signal, and it will not switch itself off when your browser sends one. If you want it off, the two methods under Cookies do work, and they work regardless of what your browser is signalling.

Children

This site is not directed to children, and our services are for adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has sent us information through the contact form, email us and we will delete it.

Visitors outside the United States

Our practice is in Florida and our service providers are in the United States. If you contact us from outside the country, your information will be processed in the United States, where privacy laws differ from those where you live.

The analytics described above runs for every visitor wherever they are, which means it sends that information to Google in the United States, and to Ahrefs.

We are not currently offering services outside the United States. If you are in the European Economic Area or the United Kingdom and would like your inquiry deleted, email us and we will do it.

Changes to this policy

If we change this policy we will update the date at the top of the page. If a change materially affects how we handle information already collected, we will make a reasonable effort to notify the people affected directly.

Contact

Privacy questions and requests go to the email address below. A person reads them.