Legal
This page covers glpamerica.org and nothing else. It is written to be read, not to be survived, so it names the actual cookies, the actual browser keys, and the actual parameters we attach to a link — including the ones most policies leave out.
A set of pages built ahead of time and served as files. There is no account, no login, no shopping cart, no checkout. Nothing on this site asks you to type anything, because there is no form here to type into.
Our host is Vercel, in the United States. One route on this domain is not a static file: /go/, the link handler described below.
Analytics. Google Analytics 4 runs on every page. It records which page was loaded, the referring page or search, an approximate location Google derives from a truncated IP address, and the broad shape of your device and browser. It also records one custom event of ours, intercept_impression, when the exit box below opens — which company's page it opened on, and which wording variant you were shown.
Server logs. Vercel writes the ordinary request log every web server writes: IP address, user agent, URL, timestamp, response code. We do not build reports on it, join it to anything, or export it. It exists because serving a page requires it.
Email. If you write to the desk, we have whatever you sent us — your address, your message, and anything you chose to put in it. We would rather you did not put health details in an email to a review site.
There is no advertising pixel on this site. No Meta pixel, no TikTok pixel, no remarketing tag, no data-broker script, no session recorder, no heatmap tool. If a page ever loads one, this paragraph is wrong and we want to hear about it.
The cookies here come from Google Analytics and start with _ga — typically _ga itself and a per-property _ga_<ID>, with _gid on some configurations. They hold a randomly generated identifier so a second page view is not counted as a second person. We set no cookie of our own, and no cookie on this site is used for advertising.
Consent Mode defaults are set in the page head before the analytics library initializes, and they are these:
ad_storage: denied, ad_user_data: denied, ad_personalization: denied, analytics_storage: granted. Then IP anonymization is switched on at configuration time.
Read plainly: the advertising half of Google Analytics is turned off for every visitor, on every page, always — not after you click something, and not only in certain states. The measurement half is on unless you turn it off. Google processes that data on our instructions as our analytics processor, under its own terms.
Two of these are permanent until you clear them, and three vanish when you close the tab. All five are written in your browser and never sent to us.
Local storage. glpam-privacy holds the value opted-out after you use the button below; it is the flag the page reads on every later load to deny analytics storage before Google starts. glpam-privacy-seen records that you have dismissed the notice bar at the bottom of the screen, so it does not reappear on every page.
Session storage. ga-arm holds one of four labels — control, price, nopre, plain — chosen at random the first time the exit box would open in that tab, and kept for the rest of the session so the wording does not change on you mid-visit. ga-int-count counts how many times the box has opened. ga-int-<company> marks the companies it has already opened on.
On a review of a company that does not pay us, clicking through to that company can open a panel offering one alternative that does. It is capped hard: three times per session, once per company per session, never on a company that pays us, and never at all if your browser blocks session storage.
The headline on that panel is one of four variants, and which one you get is the coin flip stored in ga-arm. We do that to find out which honest phrasing readers actually respond to. Two things travel with it: the variant label goes to Google Analytics on the intercept_impression event, and if you click the paid option, the same label rides along to our affiliate network as described next. The variant never changes a price, a rating, or which company is offered.
Partner links point at /go/ plus a short company slug on this domain. That handler looks up the company, adds tracking parameters, and sends your browser on with a 302 redirect. If the slug is unknown it returns a 404 and sends you nowhere.
The parameters are: the offer and account identifiers for our commission account, a fixed source value of glpamerica, the company slug, the placement the click came from (sub3 — the sticky bar, a board, the foot of a cost page, the exit box), and, when one exists, the exit-box variant (sub5). None of that describes you. It describes the link.
What follows is not ours. The click lands at our affiliate network, Katalys, which records it and forwards you to the company; both of them then apply their own cookies and their own privacy policies. We receive a count of clicks and, later, whether one became a customer — never your name, never your order, never anything clinical. If you would rather skip the hop entirely, type the company's address into your browser. Every review names the company's own domain.
This is a United States site under United States rules, which are opt-out rather than opt-in. So we do the opt-out version honestly: analytics starts on the first page view, we say so in a bar at the bottom of the screen instead of blocking the page, and the off switch works on the page you are standing on. We think a consent wall that most people click through without reading is worse for you than a sentence and a real button.
We honor both, in code, before Google loads. If your browser or extension sends Global Privacy Control, or the older Do Not Track signal, analytics storage is denied for that visit without you doing anything else. We treat a GPC signal as a valid opt-out request under state law, including California's.
Analytics is on for this browser. Opting out takes effect immediately, on this page.
That button does three things at once: writes the opt-out flag, tells Google Analytics to deny analytics storage immediately, and expires the _ga cookies already on this domain. It takes effect on the page you clicked it on, not the next one.
It applies to this browser only, because it is stored in this browser only. Clear your site data and it goes with everything else. For something broader, Google publishes a browser-wide opt-out add-on, and any browser that blocks third-party scripts blocks ours too — nothing on this site breaks without analytics.
Not in the everyday sense, and not in the wider sense California uses, where a sale can mean any disclosure for something of value and sharing means handing data over for cross-context behavioral advertising. We do neither. We run no advertising, so there is no audience to build and nobody to sell it to. There is no "Do Not Sell or Share" link on this site because there is nothing behind it.
If you live in California, Virginia, Colorado, Connecticut, Utah, or another state with a comparable law, you can ask us to confirm what we hold about you, give you a copy, correct it, or delete it, and you can appeal if we say no. We will not treat you worse for asking.
Email desk@glpamerica.org. There is no portal, because building one would mean collecting more about you than we do now. We answer within the time your state's law allows, and we will tell you if we need an extension.
Two honest caveats. First, to answer a request we have to be able to match it to something, and since we hold no account, usually the only records tied to you are the emails you sent us; if we cannot verify a request without asking you for more personal information than we already have, we will decline it and say why. Second, an authorized agent may act for you if you give them written permission and we can confirm it with you.
This site is for adults and is not directed at children. We do not knowingly collect anything from a child under 13, or under 16 where a state sets the line there. If you believe a child's information reached us, write to the desk and we will delete it.
We run no database, so most of this is other people's clocks. Analytics data sits in our Google Analytics property under that property's retention setting and is aggregated for reporting after that. Request logs age out on our host's schedule. Cookies expire on Google's schedule, or immediately when you opt out. Browser keys stay until you clear them, or until the tab closes for the session ones. Email we keep as long as it is useful for corrections, then delete.
The honest version: this is a static site over HTTPS with no user data to steal, which is a real security property rather than a claim about our diligence. There is no login to breach, no database to dump, no payment record anywhere near us. Access to the analytics property and the publishing account is limited to the people who run this site. We cannot promise any system is perfectly secure, and anyone who does is selling something.
Every outbound link leaves our control the moment you click it, partner or not. The companies we review, the pharmacies behind them, and the sources we cite all have their own policies, and we do not control what they collect or how long they keep it. Read theirs before you hand them an intake form, because that form is where the health information you will not give us actually goes.
American readers, on American prices. Our operations and our hosting are in the United States. If you read this from outside the country, it is served to you as-is, and your data is handled here.
The date at the top is the version you are reading. If we change how any of this works, we change this page and move that date, and if the change is material we say what it was rather than quietly bumping a number. There is no mailing list to notify, so the date is the notice.
Privacy questions, requests, and corrections: desk@glpamerica.org. Money is covered on who pays us; the rules for reading and quoting are in the terms of use; what this site is not is in the medical disclaimer.