We can't find the internet
Attempting to reconnect
Something went wrong!
Hang in there while we get back on track
Privacy Policy
Last updated: September 28, 2026
Who we are
Winnow Labs ("we", "us", "our") operates three websites:
- Winnow Journal (journal.winnowlabs.com), our science blog
- Winnow Atlas (atlas.winnowlabs.com), our index of microplastic research
- Winnow Probiotics (probiotics.winnowlabs.com), our index of probiotic strain research
This policy covers those three sites. Our store at winnowlabs.com is a separate site with its own policy.
What we collect
Your account
One account works on all three sites. If you create one we store your email address, your display name, the site and page you signed up on, your email preferences and your light or dark theme. If you set a password we store a one-way hash of it, never the password itself.
If you sign in with Google we receive your name, your email address and your Google account ID, and we store all three. We do not ask Google for your contacts, calendar or anything else.
What you post and save
We store the comments and community posts you write, your votes, the papers and strains you save and the folders you put them in, and any feedback you send us about a paper. Comments and community posts are public, and they appear under your display name and on your profile page.
The exposure calculator
When you finish the exposure calculator on the Journal we store your answers and your result. We do not store your exact age or body weight. If you are not signed in, the saved result carries nothing that identifies you, until you sign in on the same browser, when it is linked to your account. Once a result is linked to your account we add your score, your score band, your largest exposure factor and whether you live in a city to your profile with our email provider. Your browser keeps your progress in its own storage so you can pick up where you left off.
A record of each visit
Our servers keep a record of each page requested. It is not anonymous. Each record holds:
- the address of the page, including anything after the "?", which is where a search you typed appears
- the time, and how long the page took to load
- your IP address, in full
- your approximate location (city, region and country), looked up from the IP address in a database that sits on our own server
- your browser's user agent string, and the kind of device we infer from it
- the page that linked you to us, and any campaign tags in the link
- a visit ID from a cookie, which ties together the pages of one visit
- your account ID, if you are signed in
Failed sign-in attempts and requests we turn away for arriving too fast are recorded the same way.
When you follow a link from one of these sites to our store we record the page you were on, which link you followed, your visit ID and your browser's user agent string. We do not record your IP address with it. The link itself tells the store which of our sites you came from, which link you used and the channel that first brought you to us (a social network, say), and not which page you were reading.
What you search for
Search on Atlas and Probiotics matches by meaning. To do that we send the text of your search to Voyage AI, which turns it into numbers we compare against the papers. We send the text and nothing else: no IP address, no account, no visit ID. We keep recent searches in memory for up to six hours so a repeated search does not have to be sent again.
Google Analytics
Every page of the Journal and Atlas loads Google Analytics,
a measurement service run by Google. It sets its own cookies, with names that
begin _ga, and sends Google the pages you view along with your IP
address and details of your browser and device. It loads when the page does.
Probiotics does not load it.
You can block it with Google's opt-out add-on or with any content blocker. The sites work the same without it.
How we use your data
- To run the sites and keep you signed in
- To send you sign-in links and the emails you have asked for
- To see which pages are read and how readers reach them
- To spot and block abuse, such as scraping and password guessing
We do not sell your personal data to anyone.
We have three mailing lists, one per site. You choose which to join when you give us your email address, and you can change that at any time in your settings or from the unsubscribe link in any email. If you sign up with Google, the list for the site you signed up on starts switched on, and you can switch it off on the next screen.
Who else receives data
- Fly.io hosts the sites and the database, so everything described here is stored on its servers, and its server logs can include IP and email addresses.
- Klaviyo sends our email, sign-in links included. It receives your email address, your first name, the page you signed up on, the lists you chose and, if you were signed in when you used it, your exposure calculator result.
- Google handles sign-in if you choose "Sign in with Google". It receives what Google Analytics collects on the Journal and Atlas. Atlas pages load two typefaces from Google Fonts, so your browser contacts Google, which sees your IP address, whenever you open one.
- Voyage AI receives the text of searches on Atlas and Probiotics, as described above.
- YouTube receives a request from your browser, and may set its own cookies, when you open a Journal post that has a video in it.
- Tigris stores the Journal's images, so your browser fetches them from its servers, which see your IP address.
- Anthropic supplies the AI model that writes our summaries of papers. It receives the text of papers and posts. It receives nothing about you.
Each of these has its own privacy policy.
How long we keep it
- Visit records are deleted after 90 days. What remains is daily totals by page, referring site, campaign, country and region, with no IP address, location below region, browser details, visit ID or account ID.
- Records of clicks through to our store are kept with no expiry.
- Your account, and what you post and save, are kept until you ask us to delete them.
- Calculator results saved without an account are kept with no expiry.
We keep database backups for disaster recovery. A backup made before something was deleted still contains it.
Your rights
You can:
- Ask for a copy of the personal data we hold about you
- Ask us to correct it
- Ask us to delete your account
- Unsubscribe from our email at any time
There is no delete button in your settings yet, so deleting an account is done by us, by hand, within 30 days of your asking. It removes your account, your comments, votes, saved items and calculator results, and takes you off our mailing lists. Visit records that were linked to your account stay until they expire, with the link to you removed.
To do any of these, email us at hello@winnowlabs.com .
Children
Our services are not directed at children under 13. We do not knowingly collect personal data from children.
Changes to this policy
We may update this policy from time to time. Material changes will be posted on this page with an updated date. Continued use of our sites after changes constitutes acceptance of the updated policy.
Contact
Questions about this policy? Email us at hello@winnowlabs.com .