Privacy

What we hold, and what we do with it.

Health information deserves to be handled carefully. This page describes exactly what The Seizure Space stores and how it is protected.

What we store

Your account: a username, an email address for password resets, and a one-way hash of your password. Never the password itself - we could not tell you what it is, and neither could anyone who stole the database.
Your epilepsy information: only what you type into the form yourself. Every field is optional.
Tag requests: the delivery address and tag options you send us when you request a tag.

How it is protected

Your epilepsy information and tag request details are encrypted before they are written to the database, with a key held separately from the data. A stolen database file or a leaked backup does not reveal your health information.
Your username and email address are encrypted too. On a site about epilepsy, the bare fact that an address has an account here says something about a person's health, so it is protected the same way.
Passwords are hashed with Argon2id, the current recommended algorithm, deliberately tuned to be slow and memory-hungry so that guessing at them in bulk is impractical even for someone holding the database.
All traffic is served over HTTPS.
Repeated wrong passwords slow the account down progressively, and a wrong username is rejected in exactly the same way and the same time as a wrong password - so this site cannot be used to work out who has an account here.
Changing or resetting your password signs out every other device.
Your record is retrieved only by your signed-in account identity. No page on this site accepts a record number from the address bar, so there is nothing to guess at or tamper with.
Session cookies are HTTP-only, same-site, and marked secure in production. Forms are protected against cross-site request forgery.
Pages showing your information are marked never to be stored in a shared cache.

Who can see your information

Your epilepsy record is visible to you and to nobody else. It is not shared, not sold, not used for advertising, and not shown to other users. There is no public link to it.

The emergency tag, and what it trades away

If you choose to set up an emergency tag, that is the one exception, and it is worth being plain about it. A paramedic has no account here and no time to make one, so anyone holding your tag link can read your emergency information without a password. That is not a weakness in the design; it is the design. A lock that a stranger cannot open is useless in the situation the tag exists for.

What that link is protected by instead:

The address contains 128 bits of randomness. It cannot be found by guessing, and it is not listed, linked or published anywhere.
The page sends no referrer, so opening it cannot leak the address to another site.
It is excluded from search engines by three separate mechanisms.
It is never cached, by your browser or anyone else's.
Wrong addresses are rate limited. Correct ones never are, so a real scan is never turned away.
You can switch the tag off at any moment, or issue a new address that retires the old one.
You can see when your card was opened. For an ordinary scan, we log that it happened, not who by.

Setting up a tag is entirely optional, and the rest of the site works without one.

One exception, and it is worth being direct about it. The person who runs this site can look up any registered account and reveal its emergency link — the one case where someone other than you can see it. This exists so a physical tag can actually be written: the exact link has to reach a human being at some point if you want us to make one for you rather than printing your own QR code.

What limits it:

It is never bulk-visible. There is no page listing everyone's tokens at once — each one is revealed individually, on a deliberate click.
It is never silent. Every reveal is written to your own account's access log, by name, the same list an ordinary tag scan appears in. You will always know if and when it happened.
It cannot see your epilepsy information itself — only the link. Medical fields stay unreadable to anyone but you, encrypted the same way regardless.

If you would rather nobody but you ever has this ability, do not use "Request a tag" and instead set up your own tag and print your own QR code from your account.

Your control

Edit or overwrite anything you have stored, at any time.
Download a copy of everything you have stored, as a plain file.
Delete your entire record permanently, in one click, without asking anyone.
Delete your whole account, taking everything stored with it, from the account page.

One consequence worth knowing. Because your information is encrypted and your password is only ever stored as a hash, there is no back door. If you lose your password and your email address no longer works, nobody - including us - can recover what you stored. Keep the email address on your account current.

What this site is not

The Seizure Space is an awareness project and a private notebook. It is not a medical service, it does not give medical advice, and it is not monitored. It cannot summon help. In an emergency, call your local emergency number.

A note on honesty: no system is perfect. Store what would genuinely help someone treating you, and think twice before adding anything beyond that.