> We're not harvesting your data. In fact, we nuke it right after we serve the request. We're super privacy conscious. That's not the whole truth. While you ma

> We're not harvesting your data. In fact, we nuke it right after we serve the request. We're super privacy conscious. That's not the whole truth. While you may be deleting the submitted form values, your site uses a third-party tracking service which collects a range of visitor data[0] which is stored by that third party. Third-party tracking is useful and mainstream, but you should have a privacy policy and disclose the tracking in that policy. On a more positive note, your site has a solid A+ for HTTPS configuration on SSL Labs[1], so that's great to see. The only change I would make is to switch server_tokens to 'off'[2] so you aren't leaking the Nginx version number (but this is admittedly just a minor bit of security through obscurity). [0]https://clicky.com/terms https://clicky.com/terms [1]https://www.ssllabs.com/ssltest/analyze.html?d=whoaremyrepresentatives.org https://www.ssllabs.com/ssltest/analyze.html?d=whoaremyrepre... [2]http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens http://nginx.org/en/docs/http/ngx_http_core_module.html#serv...