Privacy
We collect as little as we possibly can.
- No account, no profile
- You can use every part of this site without registering. Nothing you select is kept as a profile of you.
- We do not ask for health data
- There are no symptom questions and no medical history anywhere in matching, and we do not need any of it to run the service. Free-text fields and email carry whatever you choose to type, so please leave medical details out. We do not ask for them, we do not give medical advice, and where medical information reaches us unnecessarily we delete it whenever that is reasonably possible.
- What happens to your matching answers
- Your answers are categories, not text: what you can offer, what commitment suits you today and, if you choose to give it, your country. They are sent to our server, where published rules decide which actions are eligible. Nothing about you is kept as a profile afterwards.
- When AI is used at all
- Published rules match and order the actions you see. No model selects, ranks or approves them. A model runs only when you press a button asking for help understanding or preparing an action. What is sent then is the action, your optional country and hours, and any text you wrote — never a name and never a receipt code. A written version is always available without AI, and nothing is ever sent to a recipient on your behalf.
- What a completion record holds
- The action, a randomly generated receipt code not linked to an account, the time and an optional country. We also store limited technical metadata: a token that lets that receipt be maintained, whether the completion came from this site or a connected client, and which version of the published rules and action text applied. The completion record itself contains no name, no IP address and no contact details. Our hosting, database and security providers process standard request information, including IP addresses, in order to serve and protect the site.
- Your own self-defined action
- If you describe an action in your own words, that text stays in your browser. It is sent to the AI provider only in the moment you press the button asking for help making it concrete, and it is never retained or published by Tinnitus Action. It is never sent when you choose to use your action as written. Nothing you wrote is stored on our side and nothing is reviewed: the shared record shows only “Self-defined action”, a receipt code, an optional country and the time.
- What stays on your device
- Your form answers, any self-defined action text and your optional feedback are kept in your browser's storage. Clearing your browser data removes them.
- When you email us
- Writing to us means your address, the name your mail app sends and whatever you put in the message arrive in an ordinary mailbox. We use it only to answer you and to act on what you asked. Correspondence is kept for as long as it takes to handle the request and any reasonable follow-up, then deleted, unless there is a genuine legal reason to keep it longer.
- The optional monthly update
- If you ask for the monthly update, we store the email address you typed and the time you consented, nothing else. It is a separate choice from analytics, it is never required to take an action, and it is never linked to a receipt code or to anything you did on the site. The list cannot be read through the website. Every email contains an unsubscribe link, and unsubscribing deletes your address rather than marking it inactive.
- Analytics, and how to change your choice
- This site uses one first-party analytics script provided by our hosting provider, to see how many people visit, which pages they read, roughly where they come from and what kind of device they use. It does not run at all until you press Accept analytics. If you accept, it sets a first-party cookie called session-id that lasts 30 minutes, and it records the page address, the referring page, browser type and a country derived from your timezone. There is no advertising, no data sale, no marketing tracker and no third-party analytics. Receipt addresses are redacted before they leave your browser: an analytics event for /receipt/YOURCODE is sent as /receipt/[code], so a receipt code is never part of analytics data. If you decline, no analytics cookie is set and no analytics request is made. You can change your mind at any time using the buttons below; withdrawing deletes the session-id cookie and reloads the page so nothing further is collected. A separate Cloudflare cookie is set for security and bot protection and is strictly necessary.
Your current choice: not chosen yet
- Who processes what
- Hosting and content delivery serve the site and see standard request data. The database provider stores completion records. The AI gateway, and the model behind it, see only the text you send by pressing the button. Analytics events go to the hosting provider's analytics backend. Some of this processing takes place outside the EU/EEA under those providers' own data-processing terms; we do not yet state a specific transfer mechanism for each provider, because we will only claim one once we have confirmed it with them. Write to us if you want the current list of providers.
- Why we process it, and on what basis
- Completion records: our legitimate interest in keeping a durable, minimal public record of coordinated action. Contact email: our legitimate interest in answering correspondence. The monthly update: your consent, given by ticking the box, and withdrawable through the unsubscribe link. Hosting and security logs: our legitimate interest in running and protecting the site. AI assistance you request: we are finalising the correct legal basis for this and will state it here once confirmed rather than guess. Analytics: your consent, given by pressing Accept analytics and withdrawable at any time.
- Your rights
- You can ask for access to what is held, correction, deletion, restriction of processing, and you can object to processing based on legitimate interest. Consent you gave can be withdrawn at any time. Write to admin@tinnitusaction.com. You can also complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY).
- Who is behind this
- Tinnitus Action is an unregistered, founder-led, not-for-profit initiative run by Johan Fredriksson in Malmö, Sweden. It is not a company, a charity or a medical service, and it takes no money from anyone.
- Who is responsible for the data
- The data controller is Johan Fredriksson, Malmö, Sweden, reachable at admin@tinnitusaction.com. Anything optional — sending text to an AI provider, recording a completion, giving a country — happens only after you press the button that does it.
- How long records are kept
- Receipt and completion records are intended to remain indefinitely, as part of the cumulative public record of action taken. If you want yours removed, write to admin@tinnitusaction.com with your receipt code and we will delete it.
To ask what is held against a receipt code, or to have it deleted, write to admin@tinnitusaction.com.
Last updated 19 August 2026.