Privacy Policy

Effective Date: September 29, 2026
Last Updated: October 29, 2026

This policy explains what Critic Farm collects, why, who it goes to, and how long we keep it. It is written to describe what the site actually does today. Where we plan to add something later, we say so plainly rather than describing it as if it already exists.

The short version

• We publish car insurance guides. We are not an insurance company, agent, or broker, and we do not sell policies.
• We run no advertising pixels or tracking cookies. With your permission only, we use Google Analytics 4 to count visits, and keep our own session recordings and heatmaps of how our pages are used (see sections 2.3 and 6). Without it, the site sets no cookies of its own and records nothing.
• We do not sell or share your personal information, as those terms are used in US state privacy laws.
• If you complete our matching quiz, we store your answers so we can follow up about a quote. We do not currently pass quiz submissions to insurance partners. If that changes, we will say so on this page and on the form itself before you submit anything.
• If you join the community, what you post there is public under your username. Your email address is never shown.
• You can ask us for a copy of your data, or ask us to delete it, at any time. Community members can delete their own account from their settings.

1. Who we are

Critic Farm publishes educational content about car insurance: state-by-state guides, insurer reviews, and free calculators. Critic Farm is not an insurance company, insurance agent, or insurance broker. We do not sell insurance, underwrite policies, bind coverage, or act as your agent in any insurance transaction.

Critic Farm is the controller of the information described in this policy. Contact details are at the end.

2. What we collect

2.1 Information you give us

• Matching quiz. If you complete the quiz at /match, we collect the answers you provide: driving profile (such as age and driving history), vehicle details, current and desired coverage, your ZIP code or state, and the contact details you enter, which may include your name, email address, and, only if you choose to provide it, your phone number.
• Contact form. Your name, email address, the subject you pick, and your message.
• Newsletter. Your email address, and which part of the site you subscribed from. The form sends them to our own server, which passes them to Kit. We keep a record that you signed up (your email address, the words the form showed, the page and the time) as proof of your consent; see section 7. To stop people signing up someone else’s address, your browser first solves a small puzzle, and for up to a day we keep a scrambled (hashed) form of your IP address and email address, so the same ones cannot be used over and over.
• Community account. If you join the community at /community: a username, your email address, and a password (stored only as a one-way hash). Optionally, a display name, a profile photo, a short bio, where you are (in your own words), and what you are connected to (your “affiliation”, for example the company you work for). If you joined through an invite link, we record which link, so we know how you found us; you are shown as a founding member.
• What you post in the community. Stories, comments, ratings, votes, reports you make, and the tags you put on your posts. Stories, comments, your username, your profile details and your level are public; your votes, reports, email address and the points behind your level are not (Critic Farm staff can see them, to run the community).

2.2 Information collected automatically

• Server logs. Our web host records standard request information, including IP address, browser user-agent, the page requested, and the time. These logs are kept by the host for its own security and operational purposes.
• Form submissions. When you submit the quiz or the contact form we store the IP address and browser user-agent alongside the submission. We use this only to detect abuse and spam, and to evidence when and from where a consent was given.
• Community accounts. We store the IP address an account was opened from, and roughly when you were last signed in, to spot spam and people running several accounts. While you are signed in, your browser keeps a sign-in token in its local storage (not a cookie) so you stay signed in; signing out removes it.

2.3 What we do not collect

We want to be specific, because many sites in this category say the opposite:

• Analytics only with permission. Google Analytics 4 runs only after you press Allow in the banner. It records pages viewed, approximate location from your IP address, device and browser type, and how you arrived. Google Signals and ad personalisation are off, and we do not combine this with anything you submit in our forms. We run no Meta pixel and no other third-party measurement product.
• Session recordings and heatmaps only with permission. The same Allow lets our own recorder note how you use our pages: the pages you visit and for how long, your clicks and taps and what you clicked on, scrolling, mouse movement, JavaScript errors, and how the page looked and changed while you were on it, so we can replay a visit and see where a page confuses or fails people. With it we keep your device type, browser, operating system, screen size, language, time zone (our only clue to your approximate location — we do not store your IP address with a recording), and the site that sent you, without its query string. Everything typed into a form is masked in your browser before anything is sent, and so are email addresses and phone numbers shown on a page. Recordings are made by our own code, kept on our own server, never combined with what you submit in our forms, and shared with no one. Browsers signed in to our back office are not recorded.
• No advertising or affiliate tracking cookies. None are set by us or by anyone else on our pages.
• No cross-site tracking or profiling, and no interest-based advertising.
• No data purchased from brokers, and no information received about you from advertising networks.

2.4 Calculators and tools

Our calculators run entirely in your browser. The figures you type into them are not transmitted to us and are not stored anywhere.

3. Why we use it

What	Why
Quiz answers	To understand what coverage you are looking for and to respond to your request
Contact details	To reply to you about your enquiry
Newsletter email	To send the newsletter you asked for, and nothing else
IP and user-agent	To detect spam and abuse, and to evidence consent
Community account and posts	To run the community: show what you post under your username, keep you signed in, send the emails that confirm your address or reset your password, and moderate it
Server logs	Security and reliability of the website
Session recordings and heatmaps (only if you allow them)	To see where our pages confuse or fail people — what they click, how far they read, where they give up — and fix it

We do not use any of it to make automated decisions about you, and we do not build advertising profiles.

4. Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

We do not currently transmit quiz submissions to insurance carriers, agents, brokers, lead aggregators, or affiliate networks. Today a quiz submission is stored in our own system and reviewed by our team.

The only third parties that handle your information are the service providers we rely on to run the site:

• Our web host, which operates the servers and the mail that delivers form submissions to us.
• Kit (kit.com), the email platform that stores newsletter subscriber addresses and sends the newsletter. You only reach Kit if you subscribe.
• Google (Google Analytics 4), which counts visits for us, only if you press Allow in the analytics banner.

Session recordings and heatmaps are made by our own code and kept on our own server; no third party receives them.

These providers act on our instructions and are not permitted to use your information for their own purposes.

What you post in the community is public. Anyone can read it, search engines can index it, and people can share links to it. Think about that before posting anything that identifies you. We never show your email address.

We may also disclose information where we are legally required to, to protect our rights or someone’s safety, or as part of a business transfer such as a merger or sale of assets. If a business transfer happens, we will note it on this page.

If partner matching begins

We intend, in future, to connect the matching quiz to licensed insurance partners who can produce a real quote. Before any submission is sent to a partner, we will update this policy, state it clearly on the quiz form itself at the point you enter your details, and obtain your agreement there. We will not apply a future change retroactively to information collected before it.

5. Phone numbers

The phone number field on the quiz is optional and the form will not accept a number unless you separately tick the box consenting to be contacted on it. If you provide one:

By providing your phone number, you consent to receive calls and text messages, including by automated dialling technology or prerecorded voice, from Critic Farm about your enquiry. Consent is not a condition of purchase. Message and data rates may apply. Reply STOP to opt out of texts.

You can withdraw that consent at any time by replying STOP to a message, telling a caller to stop, or emailing us.

6. Cookies

The website sets no cookies of its own unless you allow analytics. If you do, Google Analytics sets _ga cookies to recognise repeat visits, and our session recorder keeps a visit id for the open tab and a browser id in your browser’s storage (not cookies); use Analytics choice at the bottom of any page to change your mind, which also removes both ids. If you sign in to the community, your browser keeps a sign-in token, and any unsent draft, in its local storage on your device; the Cookie Policy lists both. Our Cookie Policy explains this in more detail, including the newsletter: the form sends your address to our own server, which passes it to Kit, so your browser never contacts Kit and Kit sets no cookies on it.

The analytics banner is the only thing that asks: “Allow” and “No thanks” look the same, nothing is pre-ticked, and a browser sending Global Privacy Control is never asked and never measured.

7. How long we keep it

“Forever” is not a retention period. These are the maximums we apply:

Data	Kept for
Quiz submissions	24 months from submission
Contact form messages	24 months from receipt
IP address and user-agent attached to a submission	12 months, then removed from the record
Newsletter subscribers	Until you unsubscribe, then removed from active lists
Hashed IP address and email address from a newsletter sign-up, kept to limit repeat sign-ups	1 day
Community account (email, password hash, profile)	Until you delete the account, then erased at once. Your username stays reserved so nobody else can take it
Profile photo	Until you remove or replace it, or delete your account; the file is deleted then. We store a resized copy only, without the location or camera details a phone photo can carry
IP address an account was opened from	12 months, then removed
Community posts and comments	Until you delete them or your account (you choose whether deleting the account erases them or leaves them up under “[deleted]”). Posts removed by moderators are kept for our records, but not shown
Moderation log	Kept indefinitely; it names actions and reasons, never your email
Suppression records (so we do not contact you again)	Kept indefinitely, as a minimal record only
Record of a consent you gave on the quiz or the newsletter form (your email address or phone number, the exact words you agreed to, the page and the time)	6 years from when you gave it, so we can show what you agreed to if asked. The IP address and browser stored with it are removed after 12 months
Record of a request to stop contacting you	Kept indefinitely, as a one-way hash of your email address or phone number, the date and how the request reached us
Session recordings (the replay of a visit)	30 days
Other session analytics (pages visited, clicks, scrolling, mouse movement, device and browser)	90 days

Where you unsubscribe or ask us to stop contacting you, we keep the minimum needed to honour that request, which is normally a one-way hash of your email address and the date. We do this so the request is not undone by a later import. We explain this here because retaining it is the only way to respect it. For the same reason, if you ask us to delete your information, we delete everything else but keep these two records, of what you agreed to and of your request to stop, for the periods above: the law lets us keep proof of consent and of an opt-out.

8. Your rights

Wherever you live, you may ask us to:

• Tell you what personal information we hold about you and give you a copy;
• Correct anything inaccurate;
• Delete your information;
• Stop using your information for a particular purpose, including stopping all contact.

Residents of California, Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have these rights by statute, together with the right not to be treated differently for exercising them. We do not sell or share personal information, so there is no sale or sharing to opt out of — but you can still exercise every other right. Our Your Privacy Choices page explains the process, including how to appeal if we refuse.

To make a request, email us at the address below. We will confirm receipt within 10 business days and respond within 45 days, extendable once where genuinely necessary, and we will tell you if we need longer. We will ask you to confirm enough information to be sure the request is really from you.

If you are outside the United States

Critic Farm is a US publisher writing about US car insurance, and the site is aimed at US readers. If you subscribe to the newsletter from the UK, the EU, or elsewhere, your information is processed in the United States, our lawful basis is your consent, and you may withdraw it at any time using the unsubscribe link in any email or by contacting us. You may also ask us to delete your information, and you have the right to complain to your local data protection authority.

9. Children

The Services are not directed to people under 18, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

10. How we protect it

Connections to the site are encrypted in transit. Access to submissions is limited to the people who need it, each with their own account. No system is perfectly secure, and we do not claim otherwise.

11. Changes

We will post any updated version here with a new “Last Updated” date. If a change materially affects how we use information we already hold — connecting the quiz to partners being the obvious example — we will not apply it to information collected beforehand without asking you first.

12. Contact us