How we measure

This page describes how we measure the use of Throughball, as our privacy policy (§2, §3) says. A reference such as §7 is to a section of that policy.

Visits to our public pages

On our home page, the demo, /site-owners and /contact we use Vercel Web Analytics to count visits. It sets no cookies. It identifies a visit by a hash our hosting provider makes from the request, discarded after 24 hours, and it records the page path, the referring site, the country and region (and, where our provider records it, the city), the device type, the browser and its operating system, and the time.

The events our own code sends

Our own code sends it events about how a visit moves through our public pages, such as a visit landing, an early-access request being sent, and steps in the demo (asking for a list, opening a school's page, reading the example exchange to its end, or asking for early access from it). An event can carry the source and campaign tags from the link you followed and, in the demo, the program and graduating class you picked. No event carries a name, an email address, a school or anything you typed.

What the demo sends our server, and what our logs record

The demo asks about your player (such as program, graduating class, position, club and academics) and about the kind of school you want (such as level, region and size). None of these answers is stored in our database, and answers the demo does not need to read our catalog stay in your browser. To build your list and open a school, the demo sends our server what it needs to read our catalog (such as the program, the graduating class and the kind of school you picked); the server does not save them, except in its logs, which can record those choices, or how many of each, beside counts of what our catalog returned — never a name and never anything you typed. The demo limits how often one connection can read our catalog, counting reads against a one-way hash of the network address; each read is recorded and deleted at the first demo read more than 25 hours later. An early-access request keeps the same kind of hash of its network address, to limit how many requests one connection can send; it is deleted with the request.

When you build your first list after you have an account, the answers you give are not kept; our server log can record facts about them (such as the school preferences our software read from them, counts of the places and schools your text named, its length, and counts of what matched) — never the text you typed. The list you build from them is kept.

What your browser keeps

Our pages keep entries in your browser's session storage, which lasts only for the life of the tab, such as the visit's source and campaign tags, which demo events have already been sent, your demo answers, the answers you give while building your first list, and whether a prompt has been shown.

One entry lasts longer. When you ask for early access from the demo, your browser's local storage keeps the position, club team and school preferences you gave, with a one-way code made from the email address you asked with, so that setting up your account with that address on the same device can start from them. It never leaves your browser. It is removed when you first save your player's details; after 30 days it is no longer used, and it is removed the next time you open our home page or the demo.

Cookies

A signed-in session uses cookies and similar browser storage only for sign-in, security and measuring how the product is used, never for advertising. Our own code sets no cookie on our public pages for a visitor who is not signed in; our hosting provider's security tooling may set its own, to protect the site, and an advertising platform's tag on a public page may set that platform's own (see Advertising to parents in our privacy policy). The visit counter and the demo use no cookie: they keep only entries in your browser's session storage, as above. Where the law requires your consent first, we will ask.

Signed-in pages and advertising

Today no analytics tool runs on any signed-in page. When we add one, this page says what it measures and /privacy/providers names it; it never records what you type or the content of your messages, documents or mail.

No advertising tool runs on any signed-in page, and none runs on our public pages today. Before one does, you will be able to opt out of ad targeting at the top of our privacy policy or, as an Account Holder, in Settings, and we will honour your browser's Global Privacy Control signal.

How we measure use of the product

We also count how much AI processing your family's requests and mail use (such as which feature ran, when, which AI model, and how much text went in and came out) — counts only, never the text itself — for two purposes: so that we can see and limit what the service costs to run, and so that we can measure, once a week, how much each family is using the product (such as how many schools are on its list, how many messages were drafted, sent and received, how often it used AI features, and how often and when it signed in). That measurement is read by us alone; it is never shown to a family and never shared. The counts are kept with your account (§7).