Status, 4 September 2026. A defect found and corrected. The script is still running; what changed is that the site now says so.
Every page of this site loads a file called /.netlify/scripts/rum. It is 4,368 bytes and it belongs to Netlify, the company that hosts the site. It counts page views and measures how quickly pages load. It has been there for as long as the site has been on this host.
For that whole period the footer of every page carried two words: no tracking.
What was true and what was not
The privacy policy has always described the arrangement in narrower terms: no separate mailing platform, analytics tool, or customer-data service is involved. That sentence is accurate. The script is not a separate service; it is part of the host, and no third party was chosen, paid or given data by the Institute.
The footer said something else. No tracking is a plain claim about what happens in a visitor’s browser, and something was happening in a visitor’s browser. A reader who took the footer at its word was misled by it, and the narrower sentence three clicks away does not repair that — most people never reach it.
The distinction the privacy policy drew is real. It is not a distinction the footer made.
What the script does and does not do
It reports page views and page-load timings to the host. It sets no cookie the Institute reads, builds no profile, follows no visitor between sites, and is not connected to the waitlist or to any address left on it. The Institute cannot identify a visitor through it. This is the least invasive end of the category — and it is still in the category.
What was changed
The footer no longer says no tracking. It says what the privacy page is for: what is collected, and by whom. The privacy page now names the script in the same paragraph as the host, rather than leaving it to be found. The line under the waitlist form on the Showcase, which repeated no tracking, was corrected in the same pass.
What has not been decided
Whether to switch the script off. The site does not need it: the host’s own server logs answer the only question the Institute has asked of it, which is whether anyone is reading. Turning it off would let the original sentence stand as written rather than narrowed, and that is the better outcome — but it is a change to the hosting account and it is not made here. Until it is made, the pages describe what runs on them.
How it was found
An audit, on the day this notice is dated, measuring the site against its own claims. It was not found by a visitor, and it was not found by anyone who had written the footer. That is the argument for having the audit.