Privacy Policy

The short version. This site runs no advertising and no analytics tracking. It does not sell, rent or share your email address with anyone. The calculators keep your details in your own browser and send nothing to the server. The only personal information I hold is what you deliberately typed into a form, plus ordinary web server logs.

Last updated: 8 August 2026 · Applies to drgily.com only.

Who is responsible

This site is operated by Gily Ionescu, MS MD, in a personal capacity. It is not operated by, affiliated with, or endorsed by any hospital, medical school, health system or employer. Contact: the contact page.

What is collected, and why

1. Email sign-ups

If you enter your details into a “keep me posted” or newsletter form, I store your email address, the first name you gave if any, which list you asked to join, your IP address, and the date.

The IP address is stored only to identify abuse of the form. The list name is stored so that a person who asked about one specific thing does not receive email about something else.

I will never sell, rent or share your email address. It is used only to write to you occasionally about this site and the tools I build. Every email carries an unsubscribe link, and you can ask me to delete your details at any time.

2. The contact form

What you type into the contact form — your name if given, your email, the subject, and your message — is emailed to me. A copy is also written to a file on the server, outside the public web directory, so that a mail delivery failure cannot silently lose your message. Your IP address, browser user-agent and the time are recorded alongside it.

Messages are kept for as long as they are useful for correspondence and then deleted. If you want a message deleted sooner, ask.

Please do not send personal medical information through this form. It is ordinary email, not a secure clinical channel, and it is not covered by HIPAA — see the note below.

3. Server logs

The web server records each request: the IP address, the page requested, the time, the browser user-agent, and the referring page. This is standard for any website and is necessary to keep the site running, diagnose faults and identify attacks.

These logs rotate automatically and older files are discarded, so the retention period is limited by design — roughly a few months at current traffic.

These logs are also the only analytics this site has. There is no Google Analytics, no Facebook pixel, no advertising network and no third-party tracking script anywhere on this site. I chose server logs deliberately: they need no consent banner, they send nobody's data to a third party, and — unlike JavaScript analytics — they can see the AI and search crawlers I actually want to measure.

4. The calculators

The nutrient tracker, the ranking tool and the other calculators ask for details such as age, sex, weight and height. These are processed entirely inside your own browser. They are never transmitted to the server, never stored on it, and never seen by me.

Two tools save your profile in your browser's local storage so you do not have to retype it. That data stays on your device and you can clear it at any time by clearing site data in your browser. Food searches do reach the server as anonymous queries — the search term itself, with nothing identifying you attached beyond the ordinary server log entry described above.

Cookies

This site sets no cookies for ordinary visitors. There is no cookie banner because there is nothing to consent to.

A session cookie is set on the private administration page, which only I can log into. Local storage, used by the calculators, is not a cookie and never leaves your device.

Third parties

Very few, and I would rather list them than claim there are none.

• Google Fonts — the page typefaces load from fonts.googleapis.com and fonts.gstatic.com. Your browser's request to Google reveals your IP address to Google. This is a real disclosure and I make it because it is true; I am looking at self-hosting the fonts to remove it.
• Apple's app icon server — the NutriRank icon is currently loaded from Apple's content network (mzstatic.com) on pages that display it, which likewise reveals your IP to Apple. This will be self-hosted shortly.
• Cloudflare Turnstile — an anti-spam check on the contact form. It is privacy-focused by design, sets no advertising cookies and does not track you across sites. It runs only if it has been switched on.
• Hetzner — the German hosting provider whose servers run this site.
• Outbound links — links to the App Store, Google Play, journals and other sites take you to those services, which have their own policies. I have no control over them.

No data is sold, rented, or given to advertisers or data brokers, because none of those relationships exist.

A note about HIPAA

This is worth stating plainly, because it is widely misunderstood. HIPAA does not apply to this website. HIPAA governs healthcare providers, insurers and their business associates in the course of treatment and billing. A public education website is none of those things, and you are not my patient by virtue of reading it.

Practically, that means anything you send me here is ordinary correspondence and does not carry the legal protections that apply to your medical record. It is another reason not to send clinical details through the contact form.

Your rights

Wherever you live, you can ask me to tell you what I hold about you, correct it, or delete it. Write to me through the contact page and I will act on it. There is no fee and no form to complete.

If you are in the European Union or the United Kingdom, the GDPR gives you these rights formally: access, rectification, erasure, restriction, portability and objection. The lawful basis for the mailing list is your consent, which you may withdraw at any time; the lawful basis for server logs and spam prevention is legitimate interest in operating a secure website.

If you are in California, the CCPA gives you rights of access and deletion, and a right to opt out of the sale of personal information. There is nothing to opt out of, because no personal information is sold.

Children

This site is written for adults and is not directed at children under 13. I do not knowingly collect information from children. If you believe a child has sent me their details, contact me and I will delete them.

Security, honestly stated

Reasonable measures are in place: the site is served over HTTPS, database credentials are stored outside the public web directory, form submissions use prepared statements, and the contact form is protected against automated abuse. The administration page requires a password stored only as a cryptographic hash.

No website can promise perfect security, and I will not pretend otherwise. This is one more reason the calculators keep your personal details in your browser rather than in a database: information that was never collected cannot be exposed.

Changes

If this policy changes materially I will update the date at the top and, where the change affects people on the mailing list, say so in an email rather than quietly editing the page.