Privacy: what this site records

Last updated: October 8, 2026

This page says what the site records about you, where it goes and how to get it deleted. It is written in plain words and it describes what the code does.

The short version

Reading the site sets no cookies. There are no advertising scripts and no third-party analytics scripts.
The site counts page views itself: which page, which site you came from, your country and whether you are on a phone or a computer. Your IP address is not saved with the count.
You only give personal details if you choose to: by joining the newsletter, sending the coaching form or creating a gym account.
To have something deleted, or to ask a question, write to coach@oxidativestate.com.

Page views

When a page loads, your browser sends one small message to this site. The site saves one row for it with:

the path of the page, for example /blog/;
the name of the site you came from, for example google.com (only the site name, not the full address), and a label for it such as "google", "x", "search" or "direct";
your country, which Cloudflare works out from your IP address;
"mobile" or "desktop";
the date and time.

The row has no cookie, no IP address and no visitor ID, so I cannot tell that two page views came from the same person. I use the counts to see which pages get read and where readers come from.

Product-button clicks

When you click a product link that goes to one of the shops this site links to (realpeptides.co, skin.food and more.hair), the site saves the link, the name on the button, the page you were on, your country and the time. Again there is no cookie, no IP address and no visitor ID in that row. The link itself is not changed.

Some of those links are affiliate links. Once you are on the shop's site, that shop's own privacy policy applies, and the shop may set its own cookies.

The newsletter runs on Kit (kit.com). When you type your email address into a newsletter box, your browser sends it straight to Kit. It is not saved in this site's database. Kit also sees the usual things a web request shows, such as your IP address, and may ask you to confirm that you are a person.

Kit sends you a confirmation email first. Every newsletter has an unsubscribe link. If you want your address removed from the list completely, email me.

Coaching application

The coaching form asks for your name, email address, age, sex and country, your goals and why you want to work with me. You can also add a phone number, your X handle, height and weight, symptoms, diagnosed conditions, medications and supplements, blood work, diet, sleep, exercise and stress. Some of that is health information. Only fill in what you are comfortable sharing.

When you press Submit, the site emails your answers to me. They are sent through Cloudflare's email service and arrive in my inbox, which is a Gmail account, so Google stores that email. The answers are not saved in this site's database. I use them to reply to you and, if we work together, to coach you.

If you want your application deleted from my inbox, email me and I will delete it.

Gym app

You can use the gym app without an account. In that case your routines and workout history are saved only in your own browser, on your device. They are not sent to the server. Clearing your browser data for this site removes them.

If you create an account, the server stores:

your username;
a salted hash of your password. The password itself is never stored, and I cannot read it;
your saved app data: routines, workout history and anything else you enter in the app, such as body weight or notes;
a sign-in record for each browser where you are signed in (a scrambled copy of the login code and its expiry date), so that you stay signed in.

There is no email address on a gym account. That also means there is no password reset: if you forget the password, I cannot recover the account for you.

Signing in sets one login cookie. It is a random code that keeps you signed in on that device for up to a year, or until you sign out. Scripts on the page cannot read it, and it is not used for anything else.

To stop people from guessing passwords, the server keeps a short-lived record of sign-up and sign-in attempts: the IP address and the username that was typed. These records are deleted within 24 hours.

The pictures and animations of the exercises are loaded from the jsDelivr content network (cdn.jsdelivr.net). When the app shows them, jsDelivr sees your IP address and browser type, like any web server does. It does not receive your username or your workouts.

Deleting your gym account

Open the app, go to the Account screen, find "Delete account", type your password and press "Delete my account". This removes your account, your saved data and all your sign-ins from the server straight away. It cannot be undone. You can use "Export backup" first if you want to keep a copy of your workouts.

Frequency page

The Frequency page is behind a password. When you enter the right password, the site sets one access cookie so you are not asked again on that browser. The cookie only says that the password was entered. It does not contain your name or any other detail about you, and no account is created.

That page has a "Measure" button that listens through your microphone if you allow it. The sound is analysed inside your browser. It is not recorded and it is not sent anywhere.

Study previews on the Ray Peat pages

On the Ray Peat pages, clicking a study opens a short preview. Your browser fetches that preview directly from PubMed, at the U.S. National Library of Medicine (ncbi.nlm.nih.gov). PubMed then sees your IP address and which study you opened. Nothing is fetched until you click.

Cookies and browser storage

These are all of them:

the gym login cookie, only if you sign in to the gym app;
the Frequency access cookie, only if you enter the password on that page;
the gym app's own data in your browser's storage (your routines and history, kept on your device so the app works without an account).

There are no advertising cookies and no tracking cookies, which is why there is no cookie banner.

Other companies involved

Cloudflare hosts the site, the database and the email sending. See the next section.
Kit (kit.com) receives your email address if you join the newsletter.
Google (Gmail) stores coaching applications, because they arrive in my Gmail inbox.
jsDelivr (cdn.jsdelivr.net) serves the exercise pictures in the gym app.
PubMed (U.S. National Library of Medicine) serves the study previews on the Ray Peat pages, when you click one.

The fonts, styles and scripts are served from this site itself. No fonts or scripts are loaded from Google or any other outside company.

The site links out to X, PubMed, raypeat.com, the shops and other sites. Nothing is sent to them unless you click a link. After that, their own policies apply.

Hosting and server logs

The site runs on Cloudflare. Like every web host, Cloudflare handles each request your browser makes, so it sees your IP address, your browser type and the address of the page.

Cloudflare keeps a short technical log of requests that reach the site's code, such as the page-view message, form submissions and gym app requests. A log entry holds the address requested, request details such as IP address and browser type, and the result. It does not hold what you typed into a form. These logs are kept for a few days, 7 at most, and then Cloudflare deletes them. I use them only to find errors and to spot abuse.

To block spam and password guessing, forms and sign-in are limited to a certain number of tries per IP address. That counting happens at Cloudflare and lasts about a minute.

How long things are kept

Page-view and click counts: kept with no fixed end date. They hold nothing that identifies you.
Gym account and saved workouts: until you delete the account.
Sign-in protection records (IP address and typed username): deleted within 24 hours.
Cloudflare request logs: up to 7 days.
Coaching applications: in my inbox until I delete them, or until you ask me to.
Newsletter address: with Kit until you unsubscribe or ask me to remove it.

Delete your data or ask a question

Write to coach@oxidativestate.com. Tell me what you want deleted or what you want to know, and I will answer.

Coaching application or newsletter: write from the email address you used, so I can find it.
Gym account: deleting it yourself in the app is the fastest way. If you cannot do that, send me the username. Because accounts have no email address, I may ask you something to check that the account is yours.

If the site changes what it records, this page changes with it and the date at the top is updated.

More about the site: About OxidativeState.