Fathom

Privacy

What Fathom collects, what it never transmits, and how to delete everything.

Summary

Fathom is built around research-grade data integrity, which is inseparable from research-grade privacy. The platform does not run third-party analytics, does not fingerprint visitors, does not show advertising, and never transmits the content of what you are testing or thinking about. The aggregate research dataset is structurally decoupled from your account.

What we collect

  • Email address and password. An account requires both, collected from first use. Your email is hard-verified before you can run any trial. The password is stored only as a salted hash, never in the clear. Email is the one piece of personal information Fathom holds.
  • Trial records. For each trial: your choice (A or B), the outcome (A or B), the four canonical timestamps (presentation, choice, generation, reveal), the server-signed HMAC, the entropy bytes, and a paradigm identifier.
  • Session records. Trial counts, completion status, and per-session statistics derived from your trials.

What we never collect

  • Trial content. Fathom never asks what you are testing about, what question is in your mind, or what intention you set for a trial. That content never leaves your browser. Only your binary choice + the outcome + timing leave the device.
  • Browser fingerprints used for identity. No canvas fingerprinting, no font enumeration, no audio fingerprinting, no behavioral biometrics keyed to identity. We do collect normal request metadata (user-agent, request timestamp) that web servers see by default; these are used for integrity validation, not identity.
  • Advertising identifiers. No third-party ad networks. No retargeting pixels.
  • Third-party analytics. No Google Analytics, Mixpanel, Amplitude, or similar. Server logs and error reports (Sentry) are first-party and PII-redacted at the SDK level.

Contribution payloads

If you opt into anonymous contribution (a free opt-in), your trial data is published to the aggregate research dataset with a separate contribution_user_id UUID. There is no foreign-key, hash, or other deterministic link between your account ID and your contribution ID. Each payload carries the paradigm, your choice and the outcome, two server-assigned sequence numbers (for ordering within and across sessions), and a single coarse temporal field: the local hour-of-day (0–23)— no date, no timezone, no precise time. There is no high-resolution timestamp researchers could use to triangulate a session back to an account.

Contribution is opt-in and never the default. You can stop contributing at any time, and a refund or chargeback clears your account's contribution status. However, payloads already published to the aggregate dataset cannot be deleted — precisely because nothing links them back to your account. That unlinkability is the privacy guarantee, and it is one-way: the data is anonymous the moment it is written.

Cookies & local storage

  • fathom_auth_session — your authenticated session. HttpOnly, Secure (production), SameSite=Lax, Path=/, Max-Age=30 days. Cleared on logout.
  • fathom_theme — your light/dark preference. Not HttpOnly (the client writes it). Used only for SSR to render the right theme without a flash.
  • localStorage. A mirror of the theme preference for client-side reads. No tracking identifiers.

Third parties

  • Vercelhosts the application and sees standard request metadata (IP, user-agent, timing). Vercel's privacy terms apply for the network layer.
  • Neon hosts the Postgres database. Trial data and account records are stored encrypted at rest.
  • Upstash hosts the rate-limiting layer. Only ephemeral counters are stored there, keyed by IP for abuse mitigation.
  • Sentry receives application error reports. PII (UUIDs, emails, tokens) is redacted at the SDK level before transmission via a hardened beforeSend filter.
  • Stripe handles the optional $5 donation. Stripe receives your card data; Fathom only receives a payment-success acknowledgement and never sees the card details.

Retention & deletion

Account deletion cascades to all account-linked data — your trials, sessions, statistics, and email. Already-published anonymous contribution payloads remain in the aggregate dataset: they carry no link back to your account, so they cannot be located and removed individually (that unlinkability is the point). Server-side error reports (Sentry) follow Sentry's default retention.

Logging out via the navigation menu clears your account cookie and ends your session; it does not delete your data. Use the account deletion flow (V1+) for permanent removal.

Contact

Privacy questions, deletion requests, and data exports go through the contact form. We aim to respond within 7 days.