Legal

Privacy policy

Last updated 30 July 2026. Consent version 2026-07-30.

By Evan Marsh · Updated

This site collects one piece of personal data, and only if you hand it over: your email address, when you subscribe to status alerts. Analytics are cookieless and do not identify you. Your email address is never passed to the analytics provider, never sold, and never shared for marketing.

Who is responsible

Retatrutide Status operates this website. Contact:alerts@retatrutidestatus.com.Independent tracker. Not affiliated with Eli Lilly, the FDA, or any regulatory agency.

What is collected

If you subscribe to alerts

  • Your email address, normalised to lowercase.
  • Subscription state — pending, confirmed, unsubscribed or bounced — with the timestamps of those changes.
  • The page you subscribed from, the originating site if you arrived from a link, and any campaign parameters in the URL.
  • The consent version in force when you subscribed, so it is possible to establish what you agreed to.
  • Hashed confirmation and unsubscribe tokens. The tokens themselves are never stored — only an HMAC of them — so a copy of the database cannot be used to confirm or unsubscribe anyone.

If you do not subscribe

Nothing that identifies you. Page views are counted by Vercel Web Analytics, which is cookieless, does not build a profile across sites, and does not receive your email address. Interaction events are recorded — that a subscribe form was submitted, that a source link was clicked — but never with the values you typed.

Abuse prevention

To stop the subscribe form being flooded, a salted hash of the connecting IP address is stored briefly with a timestamp. The salt includes the current date, so the value cannot be correlated with traffic from any other day, and rows are deleted after two hours. Raw IP addresses are not kept.

Server logs

The hosting provider, Vercel, processes requests and keeps operational logs of its own under its own policy. Email addresses and tokens are deliberately excluded from anything this site logs.

Why, and on what basis

Your email address is used for exactly one purpose: to send you a confirmation message, and then alerts when the regulatory status of retatrutide materially changes. The legal basis is your consent, given by submitting the form and then confirming by clicking the link in the confirmation email. Nothing is sent before you confirm.

You will not receive promotional email, a daily digest, or messages about anything other than verified status changes. There are no third-party promotions.

Who processes it

  • Supabase — hosts the database holding subscriber records.
  • Resend — delivers the confirmation and alert emails.
  • Vercel — hosts the site and the serverless functions, and provides cookieless analytics.

Each acts as a processor on instruction. Your address is not sold, rented, or shared for anyone else's marketing.

How long it is kept

  • Confirmed subscribers: until you unsubscribe or ask for deletion.
  • Unconfirmed subscriptions: deleted after 30 days. If you never clicked the link, the record goes away.
  • Unsubscribed records: the address is retained in an unsubscribed state so that it is not accidentally re-added by a later import. Ask for deletion and it will be erased entirely.
  • Rate-limit hashes: two hours.

Your choices

Unsubscribe using the link in any alert email. One click, no login and no confirmation step. Mail clients that support one-click unsubscribe will also work.

Deletion, access or correction: emailalerts@retatrutidestatus.com from the address concerned and it will be handled. Depending on where you live you may have rights under the GDPR, the UK GDPR, or state laws such as the CCPA — including access, correction, deletion, and objecting to processing. Those requests are honoured regardless of where you are.

Cookies

This site sets no tracking cookies and shows no cookie banner, because there is nothing to consent to. Vercel Web Analytics is cookieless by design.

Two small values may be stored in your own browser's local storage: whether you have already subscribed, and whether you dismissed the reminder prompt. They exist so you are not asked twice. They never leave your device and can be cleared through your browser at any time.

Security, and its limits

Traffic is served over HTTPS with strict transport security. Confirmation and unsubscribe tokens are generated with a cryptographically secure random source and stored only as HMAC hashes. API credentials exist only in server-side environment variables and never reach the browser. Database access is restricted to the serverless functions; row-level security is enabled with no public policies. Email addresses are excluded from application logs.

No system is perfectly secure, and no guarantee is offered. What can be promised is that the data held is deliberately minimal: an email address, a subscription state and a few timestamps.

Children

This site is not directed at children under 13 and does not knowingly collect their data. If you believe a child has subscribed, email the address above and the record will be deleted.

International transfers

The providers listed above operate infrastructure in several countries, including the United States. Subscribing means your email address may be processed outside your own country.

Changes to this policy

Material changes will be reflected in the consent version at the top of this page. If a change affects how alert subscribers' data is used, subscribers will be told by email before it takes effect.