Privacy policy

Who this covers

SharpAndLean publishes this site and is responsible for the information described here. It is published independently, with no parent company. This policy applies to sharpandlean.com and to the forms and sign-in pages on it. It took effect on 2 October 2026 and describes the site as it actually works today, not a future version of it. Questions, corrections and privacy requests all go through the contact page.

The site is published from the United States and written for a United States audience. Where a state privacy law gives you a right described below, that right applies regardless of which state you read from.

The short version

Reading SharpAndLean requires no account, no sign-in and no personal information. Three optional forms collect information: the newsletter takes an email address, a community review takes a display name, a rating and your written comments, and the contact form takes your name, email address, subject and message. Nothing on this site is sold, rented or handed to advertisers, and no advertising or cross-site tracking code runs on these pages.

Information you choose to give

Newsletter. Submitting the newsletter form stores your email address, a record that you ticked the consent box, the word “website” as the source, and the date and time of consent. No name, location or reading history is attached to that record. The address is also added to the Resend newsletter segment unless it has already been unsubscribed there.

Community reviews. Submitting your experience of a product stores the display name you type, a rating from 1 to 5, your review text, and which review it belongs to. Every submission arrives unapproved and stays hidden until an editor moderates it. Choose a display name you are comfortable seeing in public, and do not put medical history, contact details or anything else private into the text — the field is for a product experience, not a health record.

Messages. If you write to us through the contact form, your name, email address, subject and message are sent to our editorial inbox. Do not include private medical information.

The community review and contact forms include a hidden field that real people never fill in. If it arrives filled, the submission is treated as automated and discarded.

Information the site deliberately does not keep

Your IP address is not stored. To stop a single source flooding the forms, the server combines the form name with the requesting address and keeps only an irreversible SHA-256 hash of that combination, together with a counter. The hash cannot be turned back into an address. Records older than one day are deleted automatically, and each form accepts at most five submissions a minute from one source.

The site does not ask for, and has no field for, health conditions, medicines, date of birth, precise location, government identifiers or payment details. Payments never happen here — a purchase takes place on the retailer’s own site under the retailer’s own terms.

Sign-in exists for the editorial team. Authentication is handled by Clerk, which processes the credentials, the session and the identifiers needed to keep you signed in, under Clerk’s own privacy terms. Editorial permission is granted by adding a Clerk user ID to an allowlist that ordinary accounts cannot edit. Creating an account does not grant editorial access and does not add you to the newsletter.

Technical and diagnostic information

As with any website, the hosting layer receives the ordinary information a browser sends in order to return a page: the address requested, browser and device type, referring page and a timestamp. Vercel provides the hosting.

Vercel Analytics runs only on the deployed site and reports aggregate traffic — how many people viewed a page, roughly where from, on what kind of device. It sets no cookies and does not build a profile of an individual reader.

Google Analytics 4 also runs on the deployed site, though where consent is required it loads only once you have given it. Unlike the above it does set cookies on this domain — _ga and one beginning _ga_ — holding a randomly generated identifier so that several visits from the same browser are counted as one reader rather than many. Google receives that identifier together with the page viewed, the browser and device type, and an approximate location worked out from an IP address that GA4 does not retain. Google Signals and advertising personalisation are switched off in the site’s configuration, so the measurement is not used to build advertising audiences or to follow you onto other sites.

Sentry records errors and a sample of performance traces so faults can be found and fixed. It is configured with personally identifying data collection switched off on both the browser and the server, and samples about one request in ten. A stack trace can still contain incidental technical context such as the page that failed.

No session recording. Nothing on this site records your session. There is no session replay, no heatmap, no mouse-movement or scroll tracking and no keystroke capture, and Sentry’s replay feature is switched off. Form fields are read only when you press submit.

Fonts. The typefaces are served from this site’s own domain. They are copied from Google Fonts when the site is built, not fetched from Google while you read, so opening a page sends nothing to Google Fonts.

Google “preferred source” button. The footer carries Google’s own button for adding SharpAndLean as a preferred source in Google Search. It loads a script from Google after the rest of the page has finished, so Google receives your IP address and browser details, and if you are signed in to Google it can tell that the button was shown to you. This happens under Google’s privacy policy. Blocking the script hides the button and changes nothing else.

Instagram videos. A few reviews include a brand’s video from Instagram. Until you press “Load the video”, the page shows a plain card and makes no request to Instagram. Pressing it loads Instagram’s player, and Instagram (Meta) may then set its own cookies and receive your IP address under Meta’s policy.

Cookies

A cookie is set when an editor signs in, because a secure session cannot work without one. In the EEA, the United Kingdom and Switzerland nothing is set until you accept: a banner appears on a first visit, analytics stays switched off unless you agree, and the choice is remembered on that device. Refusing is one click, the same as accepting. Elsewhere the two Google Analytics cookies described above are set on arrival. Either way your browser’s cookie controls will block them, as will Google’s own opt-out add-on, and every page works exactly the same afterwards.

There are no advertising cookies and no retargeting pixels on these pages, and the analytics that does run has its advertising features turned off. If you follow a marked affiliate link, the network you land on — Amazon Associates, ClickBank, Awin or Gurumedia — may set its own cookie on its own domain to attribute a purchase. That happens after you leave, under that company’s policy, and this site cannot read it.

How the information is used

To send the newsletter you asked for.
To moderate and publish community reviews.
To authenticate editors and protect the editorial system.
To detect and slow automated abuse of the public forms.
To diagnose faults and understand which pages are read.
To answer your messages and honour privacy requests.
To meet legal obligations and enforce the site terms.

Information given for one of these purposes is not quietly reused for another.

SharpAndLean does not sell personal information and does not share it for cross-context behavioural advertising, as those terms are used in California law. It has never done so. There is no advertising network and no data broker in this site’s code. Google Analytics is present for measurement with its advertising and cross-device features disabled, so nothing here builds an advertising audience or shares information for behavioural advertising. Affiliate commission is paid on a purchase you chose to make; it is not payment for your data.

Who else handles it

Information reaches a service provider only where that provider is needed to run the site: Clerk for sign-in, Supabase for the database and image storage, Resend for newsletter subscription preferences and delivery of contact-form messages, Vercel for hosting and aggregate analytics, Google for the analytics and the preferred-source button described above, and Sentry for error reporting. Instagram receives a request only if you choose to load one of its videos. Resend receives your email address when you subscribe, and your name, email address, subject and message when you submit the contact form. Contact messages are delivered to our editorial inbox and do not sign you up for marketing. Information may also be disclosed where the law compels it, or where it is necessary to investigate abuse or protect someone’s safety — and if a legal demand arrives, it is checked rather than waved through.

How long it is kept

Abuse-prevention hashes: deleted automatically after one day.
Newsletter address: unsubscribing stops newsletter delivery. Consent and opt-out records may remain so your preference can be honored; you can request deletion through the contact page.
Community review: kept while published. A rejected submission is removed once moderation is complete. An approved one can be taken down on request.
Editor accounts: kept while the person is on the editorial team.
Messages: kept while the matter is open and for a reasonable period afterwards.
Error and analytics data: kept on the provider’s retention schedule, which is measured in months rather than years.

Your rights

Depending on where you live, state privacy law gives you the right to know what is held about you, to get a copy, to have it corrected, to have it deleted, and to be treated no worse for asking. You can exercise any of them through the contact page or by writing to sharpnlean@gmail.com, whichever state you are in — we do not gatekeep these by residency.

Tell us what you are asking for and which email address or display name to look under, since that is generally the only handle we have on a record. Requests are answered within 45 days, or you will be told why more time is needed. There is no charge for a reasonable request. If a request is refused, the reply will say so and it will be reconsidered by someone who was not involved the first time. An authorised agent may act for you with written permission.

Every newsletter carries an unsubscribe link, and unsubscribing is honoured promptly rather than at the end of some notice period.

Children

SharpAndLean is written for adults and is not directed to children. The subject matter — weight-loss products, stimulants and supplements — is not meant for them, and nothing on the site is designed to appeal to them. The newsletter, community reviews and accounts are for people aged 18 and over, and the newsletter and review forms ask you to confirm that before they send anything.

We do not knowingly collect personal information from anyone under 13, and the site never asks for a date of birth, so it holds no record of a reader’s age. If we learn that a child under 13 has given us personal information, it is deleted without waiting to be asked. A parent or guardian who believes this has happened can write through the contact page or to sharpnlean@gmail.com with the email address or display name used, and we will delete it and confirm when it is done. The same applies to a reader under 18 who would like something they submitted removed.

Supplement decisions for a child belong with a paediatrician, not a website.

Security

The database enforces row-level access rules, so an unapproved community review is invisible to the public regardless of how it is requested. Administrative credentials stay on the server and are never sent to a browser. Form submissions are origin-checked, size-capped and rate-limited. Traffic is served over HTTPS. None of this makes any website perfectly secure, and no honest policy claims otherwise.

Changes

If this policy changes in a way that affects you, the effective date at the top changes with it and the change is described rather than slipped in. Continuing to use the site after that date means the current version applies.