Privacy commitment

What we do not do

• No advertising pixels. There is no Meta Pixel, no TikTok pixel, no LinkedIn Insight Tag and no Google Ads remarketing tag on this site.
• No behavioural or health-based targeting. We do not build audience segments, we do not infer a condition or a habit from the pages you read, and we do not send any identifier to an advertising platform.
• No selling or sharing of browsing data. With anyone, for any price.
• No cross-site tracking, no fingerprinting and no advertising cookies.
• No account. There is nothing to sign up for, so there is no profile for a reading history to attach to.
• No newsletter and no forms. We do not ask for your email address anywhere on this site, so we do not have it.

What the site actually is

Lozenges.com is a set of static pages. Every page is generated once when the site is built, from the federal datasets named on the methodology page, and then served identically to everyone. There is no database of readers behind it, because there is no reader-specific content to look anything up for.

That is a technical fact with a privacy consequence. A page that is byte-for-byte the same for every visitor cannot be personalised, cannot be varied by inference, and gives a server nothing to record beyond the fact that the file was requested.

There is no contact form, no quote request, no symptom questionnaire and no product enquiry. The only way to get in touch is to send an email to hello@lozenges.com from your own mail client, which means you decide what we know.

The search box

The search on this site runs entirely in your browser. When you type the first character, your browser downloads one static file containing the index of ingredients, brands, labellers, uses and products, and every subsequent keystroke is matched against that file locally.

What you type is never sent to us. There is no search endpoint to send it to. We cannot see your query, we do not log it, and there is no autocomplete service in the middle. The only thing a server observes is that the index file was requested, and that request looks identical whether you went on to search for menthol or for nicotine.

Server logs

The hosting provider that serves these files keeps standard request logs, in the way that every web server does. Those records include the requested URL, a timestamp, the IP address making the request and the browser's user agent string. They exist so the service can be operated and abuse can be handled.

They are not used for advertising, they are not joined to anything else, they are not shared with a third party for marketing, and no profile is built from them. We do not attempt to identify individual readers from them, and there is nothing on the site to identify them against.

Analytics

This site uses Google Analytics 4 to count visits and see which pages people actually read. It sets a first-party cookie and reports a page path, an approximate location derived from your IP address, and your browser and device type.

Two settings are switched off deliberately rather than left at their defaults. Google signals is what would let Google join a visit here to its cross-site advertising identity for you, and ad personalization signals is what would let the data feed ad targeting. Both are disabled, so the measurement stays first-party and is not shared for cross-context behavioural advertising. That is why the commitments above about advertising cookies, cross-site tracking and selling or sharing data remain accurate.

If you would rather not be counted at all, any content blocker or the Global Privacy Control signal will stop it, and nothing on this site depends on analytics working.

Why we are strict about this

Consider what a page request on this site can imply. Someone reading about nicotine lozenges is probably trying to stop smoking. Someone reading about clotrimazole troches is probably being treated for oral thrush. Someone comparing benzocaine strengths may have a child with a mouth ulcer. None of that is stated by the reader, and all of it is inferable from the URL.

Under some state laws, including Washington's My Health My Data Act, inferences of that kind can count as consumer health data in their own right, with the obligations that follow. The federal position on health data sharing by publishers has hardened in the same direction.

We think the right answer is not to build careful consent flows around collecting it. It is not to collect it. A reference publication does not need to know who is reading, and a site that never holds the data cannot leak it, be compelled to hand it over, or be tempted to sell it later when the money is tight.

Your rights

Because we hold almost nothing, most data rights requests here resolve very quickly: there is generally nothing to export, nothing to correct and nothing to delete. If you have emailed us, we hold that email, and we will delete it on request.

If you want to know what we hold about you, ask at hello@lozenges.com and we will tell you honestly, including when the answer is nothing. We honour Global Privacy Control signals, although on a site that runs no advertising and sells no data there is nothing for the signal to switch off.

We do not sell or share personal information as those terms are used in state privacy law. There is no opt-out to offer, because there is nothing to opt out of.

Children

This site is not directed at children under 13 and we do not knowingly collect anything from them. Since the site collects nothing from anyone, this commitment costs nothing to keep.

Changes

If this policy changes in a way that weakens any commitment above, the change will be dated here rather than made quietly. Reader measurement was added on 4 September 2026 and is described under analytics above. Advertising has not been added and, if it ever is, that will be stated on this page rather than discovered afterwards.

Questions about any of it go to hello@lozenges.com. How the site makes money is set out under disclosures.