Privacy · A.CAB

If you are looking for a service

No account, no cookies. Searching the atlas never needs an account, and the public pages set no cookies.
Your search stays on your device. Your browser downloads the list of services and a list of places, and does the matching itself. What you type is not sent to us.
Your location stays on your device. “Use my location” asks your browser for your position and uses it right there to sort the list. It is never sent anywhere.
Without JavaScript, your browser sends your search to this site so it can answer. A.CAB uses it for that one page and doesn’t store or log it.
No visitor logs, no trackers. The web server in front of A.CAB keeps no access log for this site, and A.CAB doesn’t record your IP address, what you searched for or which browser you use. It counts how many times each page is opened each day: one number per page per day, with no time, address, browser or search, so the count can’t tell one visit or one person from another. To find faults, the app itself notes the time and the page of each request it answers, never a search, an address or anything else about who asked, in a small log that is overwritten as it fills.
Cloudflare carries the traffic. Visits to A.CAB pass through Cloudflare, a network company that shields the site from attacks. Like any network your visit crosses, it sees your IP address and the pages you ask for (a search made without JavaScript included), under Cloudflare’s own privacy policy. A.CAB doesn’t get a log of visits from it.
Nothing loads from other companies. Fonts, scripts and styles come from this site. The map is drawn in your browser from outline files on this site (Natural Earth and US Census Bureau data), so looking at it contacts no one else.
Links to services open their own sites. When you follow a link to a service or a lab, that site’s own privacy rules apply. We ask browsers not to tell them you came from here.
Addresses open in Apple Maps or Google Maps. A service’s address, and the approximate area of one that keeps its address private, are plain links: to Apple Maps on an iPhone or iPad, to Google Maps everywhere else. Your browser checks which kind of device it is on, right there on the page, and that is not sent anywhere; with JavaScript turned off, the links go to Google Maps on every device. Nothing is loaded from Apple or Google unless you follow a link; if you do, that company sees that you looked up that place, and its privacy rules apply. The copy button next to an address copies it on your device without contacting anyone.

What the services tell us

Each listed service has told A.CAB that both listing standards are true for it, and tells us again every time it confirms its listing (every 4 months or once a year):

We never keep a person’s name, contact details or ID details with their sample or its result.
Anything we publish or share about samples, including drug alerts, can’t be traced back to a person.

We also ask every service to follow this good practice:

Ask for as little as possible: no legal name, date of birth, home address or ID unless the law requires it.
If you take contact details to post a kit or send a result, keep them apart from sample data and delete them once they’re used.
Don’t photograph or film people who bring samples.
Make sure everyone who handles samples, partner labs included, knows these standards.

Listings say when a service asks for ID. A.CAB volunteers check every listing, but can’t inspect how a service runs day to day. More about the listing standards.

Open data

The open data contains only what each service chose to show on its public listing, and leaves out any service that asked to stay out of it. Contact names, private notes, answers a service keeps off its public listing and addresses a service keeps private are never included.

A service can keep where its team travels, where it takes mail from and who may post a sample off its listing, and still be found by searches in those places. Those answers are shown on no page and no map. Because the finder matches in your browser, they are included, not displayed, in the finder’s search data, where anyone who reads that file can see them.

If you work at a listed service

Center staff and A.CAB volunteers sign in to keep listings current. For them we keep:

an email address, and a name only if they type one on their account page (none is copied from a sign-on account or the questionnaire);
how they sign in (a single sign-on account link, or a password stored only as a secure hash) and their two-step verification settings;
a sign-in cookie, only after they sign in;
a record of changes made to listings and events, and who made them, without IP addresses;
the contact details a service gives A.CAB in its questionnaire, which only A.CAB volunteers can see.

We use email only for sign-in links, invitations, reminders to confirm a listing and review results. To ask for a copy or deletion of your data, email m@a.cab.

What A.CAB keeps, and for how long

Nothing about visitors, and nothing about the people who bring samples to a service: A.CAB keeps none of it. What it does keep, about services and their staff and how often pages are opened, is cleared out every day:

Questionnaires are deleted 7 days after they are approved (the listing then holds the answers), 30 days after A.CAB declines one, 90 days after a draft was last changed, and 8 days after one was sent without confirming the email address.
What a service told a volunteer so its listing could be checked is deleted when the listing is approved.
A site that keeps its address private has no street, city, ZIP code or map pin stored. One that shows only its neighbourhood keeps only the rough map point the public sees, never the building’s position.
Events are deleted 90 days after their last day, and team invitations 30 days after they were used, withdrawn or ran out.
A closed listing, with its private answers, sites, team and invitations, is deleted 365 days after it closed.
A staff account with no team and no questionnaire in progress that nobody has signed in to for 365 days is deleted. Anyone can delete their own account at any time.
The record of changes keeps each entry for 365 days.
Page counts (how many times each public page was opened each day, with nothing about who) are deleted 400 days after their day.
Backups of the database are made every night and kept for 7 days. Something deleted stays in the backups taken before, until they age out.

Legal requests