Your plan stays in this browser.

What the site handles automatically

Checklist progress, profile fields, calculator inputs, notes, theme, and other saved settings use browser storage on your device. The application reads them to build your local plan. It does not upload them to a Military Checklist account or database.

Anyone who can use your unlocked browser profile may be able to see that locally stored information. Use the site's reset/export controls and your browser's site-data controls when you share or return a device.

Hosting and operational logs

Requests pass through Cloudflare Workers. The current repository enables Workers observability without an explicit sampling rate; Cloudflare documents that this defaults to 100% request sampling. Workers Logs are retained for up to 3 days on the Free plan or 7 days on the Paid plan. These are hosting/diagnostic logs, not a Military Checklist profile, but request metadata can still be personal data.Cloudflare Workers Logs details.

The owner must choose and document a minimized sampling rate, access controls, and incident-retention policy before claiming that operational logging is privacy reviewed.

Feedback you choose to send

An element flag prepares an email in your browser. Nothing is submitted when you type, open the flag, or copy the report. If you choose to send the email, its locator, source path, public page URL without query parameters, report type, optional source URL, and your note leave the site through your email provider.

Do not include account or claim numbers, medical records, financial details, protected personal information, or information identifying another person.

Third parties and advertising

The deployed site currently loads no Google advertising code and sets no advertising or analytics cookie. “Free resource” cards are hand-curated links, not network ads. Following an external link takes you to a different operator with its own privacy practices.

Contextual advertising is only a proposed, disabled feature. It will not be enabled until the site publishes an updated privacy/disclosure notice, resolves consent requirements, passes network-isolation tests, and records an owner-approved route policy. See the funding disclosure.

Security boundary

Static page responses use headers that block framing, foreign scripts, foreign network connections, and form posts. Worker-generated API responses carry a separate strict header set in source because public/_headers is not their policy; the deployed responses still require direct verification. No browser-only design can protect information from malware, a compromised device or extension, an unlocked shared profile, or content you copy into another service.

Your controls

• Use the export controls when you want a copy you can inspect.
• Use the reset controls to remove saved application data from this browser.
• Use browser site-data settings if you need to verify or clear origin storage.
• Do not save a sensitive profile on a shared or managed device.