Marketing-site privacy

This notice describes the public marketing website at vibecheck.luxury. It does not describe the separate authenticated application or a provider’s clinical record system.

Browsing and motion preferences

A normal request for a page, font, image, or video can disclose an IP address, requested URL, request time, browser or device information, and referring page to the services that deliver those files. Those services may keep their own access and diagnostic records.

The homepage can use session storage to remember whether a visitor paused the neon or satin motion. Those two choices last for the browser session. The candidate does not set an advertising cookie or a persistent analytics identifier in browser storage.

The visible contact route

The current contact page is mailto-only. Selecting its email link opens the visitor’s own email service; the address, subject, message, and attachments are handled by that service and received in the Mental Wealth Solutions inbox.

Analytics and optional measurement

Every public page loads one script from analytics.mentalwealthsolutions.org. It is Umami, a cookieless analytics tool that Mental Wealth Solutions hosts itself, used to count page visits and measure page speed. The script sets no cookies and writes nothing to browser storage.

The script sends the page address (including any query string), page title, referring website (if any), screen size, browser language, and page-speed timings. Like any web request, it also carries the visitor’s IP address and browser user-agent to the analytics server; that request passes through Cloudflare, which connects the server to the internet. It does not receive form contents, names, or email addresses. Do not place sensitive information in a page address.

From each request, Umami derives and stores an approximate country, region, and city; device type, browser, and operating system; and a visitor code computed from the IP address and user-agent with a key that changes at least monthly, so repeat visits can be counted without a cookie. Umami’s database does not store the IP address itself. These page-visit records have no automatic deletion date.

Before a request reaches Umami, a relay on the same server writes a line to a separate raw-IP security log: the time, IP address, page address, referring website, and full browser user-agent. The log exists for security review and traffic debugging, such as separating people from bots and spotting abusive or probing requests. Each day’s file is deleted automatically after 30 days. Up to 20 entries tied to a specific security incident may be preserved for up to 90 days. Raw IP addresses from this log are not copied into the page-visit records; the owner can look up an address’s approximate location and network provider on the same server.

Only the owner of Mental Wealth Solutions, and the tools he operates on that server, can view the page-visit records and the raw-IP log. There is one Umami account and no public report link. Blocking analytics.mentalwealthsolutions.org with a content blocker does not change how the pages work.

This candidate also packages further optional measurement code, but the current public pages do not load it. If enabled later, that code can send an event name, page path, referring URL or source label, limited campaign or action labels, browser user-agent, and page-performance measurements to the same-origin /api/track route. It can also send active time, scroll milestones, an outbound destination’s hostname, and whether a form was started or submitted to the separate Mental Wealth Solutions analytics host. Form contents are not part of those measurement events.

The tracking route uses a request IP address transiently to create a one-way rate-limit key. Marketing event rows can contain the event, page or action label, source, referrer, user-agent, and timestamp; they do not contain the raw IP address, name, email address, or form message.

Available marketing backend routes

The candidate also contains a same-origin /api/contact route, although the current contact page does not submit to it. If activated, that route accepts a name, email address, optional role or practice, and message, uses a one-way IP-derived rate-limit key, and forwards the submission through a configured email service to the Mental Wealth Solutions inbox.

Other backend routes can process an account email address, Stripe customer, session, or subscription identifiers, confirmation tokens, and payment or provisioning event status when a checkout, capacity, or activation route is used. Their presence in the candidate does not mean that a purchase, capacity offer, account, or activation workflow is currently available through these public pages.

Service providers, links, and retention

The public pages load Google Fonts and link to the separate application and other websites. Contact delivery, database operations, measurement, and payment-related routes can involve the configured email service, database service, analytics host, Stripe, and the separate application. Each external destination or service handles requests under its own terms and practices.

Apart from the 30-day raw-IP security log described above, this candidate does not establish one retention period for hosting logs, other measurement rows, email, payment records, or service-provider records, so this notice does not promise a deletion date. Current retention details must be confirmed before a route is offered for production use.

Keep care and emergencies out of this site

Do not send protected health information, client details, credentials, or emergency information through a public page, ordinary email, or marketing API. Contact the responsible provider for record-specific matters and ask for an appropriate private channel.

This marketing site does not provide care, crisis response, or emergency monitoring. In the United States, call 911 when someone is in immediate danger. Call or text 988 for the Suicide & Crisis Lifeline.

Questions or corrections

For a business or marketing-site privacy question, email [email protected]. Do not include protected health information, client details, credentials, or emergency information.