This policy covers the public drag6.com website: its pages, contact form, assessments and chat. Client work and the client portals are covered by the agreement we sign with each client.
What you give us
- Contact form: your name, company, title, business email, phone if you add it, industry, what you're interested in, how you heard about us, and what you tell us about your situation.
- Assessments: your first name, company and email, plus your answers and scores.
- Chat: the messages you send in the chat window.
- Newsletter: if you check the box, we use your email to send our updates. Every email has an unsubscribe link.
What we record when you visit
We run our own visit log. It sets a cookie named d6_vid on drag6.com that lasts up to 400 days, so we can count visits and sessions. With it we record the pages you view, the site that sent you, any campaign tags in the link, your device type and browser, and a one-way hash of your IP address. We don't keep your raw IP address in this log. If you later fill in a form or chat with us, we may connect those earlier visits to your contact record so we know how you found us.
The chat window saves a conversation ID in your browser so you can pick up where you left off. None of this runs on the client console, admin, client platform, survey or sign-in pages.
Analytics we use
We use two analytics services to see which pages help people and where the site gets in the way. Neither is used to show you ads. A worksheet download on the resources pages is one of those events. We don't ask for an email first.
The tool-sort calculator runs in your browser. We don't store what you type.
What you type stays in your browser. We don't see it or keep it, and it's gone when you leave or reload the page. To keep your results, print them or save them as a PDF.
Google Analytics 4
- What it records: page views, scrolling, clicks on links to other sites, file downloads and form interactions, plus a few events we set up, such as a form being sent, a booking link being clicked, and an assessment being started and finished.
- Cookies:
_gaand_ga_<ID>, which tell visits and visitors apart. Google's default lifetime for both is 2 years. - IP addresses: Google says Google Analytics 4 doesn't log or store IP addresses. It uses them to estimate rough location (country, region and city) and then discards them.
- Advertising: we haven't turned on Google signals or linked Google Analytics to Google's advertising products.
- How long it's kept: we keep user-level and event-level data in Google Analytics for 14 months. Summary reports aren't affected by this setting.
- Opting out: Google offers a browser add-on that stops Google Analytics on every site: tools.google.com/dlpage/gaoptout. Google explains how it uses this data at policies.google.com/technologies/partner-sites.
PostHog
- What it is: a product analytics service. Our account uses PostHog's US cloud, so the data is stored in the United States.
- What it records: page views and clicks, heatmaps of where people click and scroll, page speed, and session replays. A session replay is a reconstruction of a visit that shows mouse movement, clicks, scrolling and what was on the screen.
- Where it runs: on our marketing pages only. It doesn't run on the client console, admin, client platform, survey or sign-in pages.
- What replays hide: anything you type into a form field is masked, so replays don't show it. The chat window is left out of replays. Text that's already part of the page, such as headlines, does show in replays.
- Cookie:
ph_<project key>_posthog, which identifies a returning browser. PostHog keeps it for about a year by default. - IP addresses: PostHog uses your IP address to estimate rough location and then discards it.
- How long it's kept: on our current PostHog plan, event data is kept for 1 year and session replays for up to 30 days. Those are PostHog's limits for the free plan, and this page will change if our plan changes.
PostHog also records when someone downloads a resource and when someone clicks a link to our Substack. These events don't include your name or email.
Substack
Our newsletter runs on Substack. If you sign up, you do it on Substack's site and Substack's privacy policy applies. We don't send Substack anything about your visit.
Do Not Track and Global Privacy Control
If your browser sends a Do Not Track or Global Privacy Control signal, we don't load Google Analytics or PostHog. Our own visit log doesn't record your visit either.
How we use what we collect
- To reply to you and follow up about working together
- To send our newsletter, if you asked for it
- To see which pages, posts and channels bring people to the site, and to make the site better
- To keep spam and abuse out of our forms and chat
Who else handles it
We don't sell your information. We use service providers to run the site, and each one handles your information only to do its job for us:
- Vercel hosts the site.
- Supabase stores form, assessment, chat and visit data.
- Resend sends our emails.
- Anthropic drafts replies in the chat window. A person on our team can read chat conversations and step in.
- Google provides Google Analytics and the site's fonts. Our pages load fonts from Google's servers, so your browser connects to Google when a page loads.
- PostHog provides product analytics, heatmaps and session replay.
How long we keep it
- The
d6_vidvisit cookie lasts up to 400 days. - Contact, assessment, chat and visit-log information: for as long as we're in touch about working together, or until you ask us to delete it.
- Google Analytics and PostHog: see the periods above.
Your choices
- Email jason@drag6.com to ask what we hold about you, to correct it, or to have it deleted. We'll confirm when it's done.
- Use the unsubscribe link in any email to stop the newsletter.
- Turn on Do Not Track or Global Privacy Control, block cookies in your browser, or use Google's opt-out add-on.
Questions
Email jason@drag6.com with any question about this policy.
Last updated: October 10, 2026