Privacy Policy

Oregon Counselors Directory (orcounselors.com) is run by one person, Eric Richers. This page says what the site collects, what it puts in your browser, which outside services it talks to, and how to change your choices or ask me to delete something. I wrote it to match what the code actually does. If you find a gap, email me.

Information I collect

Visitors: The server keeps ordinary request logs (page requested, time, browser type, IP address) for security and to keep the site running. Google Analytics and my own visit counter run only if you accept them on the consent banner (see Analytics below). Provider dashboards show visit counts and referring sites for each profile. That count is kept on this server under a code computed on the server from your connection and browser, with an ingredient that changes every day, so a visitor is counted once per day and the same person cannot be followed from one day to the next, unless you choose Accept (see the visit counter below). Nothing is stored in your browser for the daily count, and it is never tied to a login. If your browser sends Global Privacy Control or Do Not Track, your visits are left out of it entirely.

Match form users: When you use the matching tool I collect what you enter (name, email, phone, and your preferences). It is used only to connect you with the providers you choose.

Providers: The professional information you put in your profile (credentials, license numbers, specialties, practice details) is displayed publicly. Paid plans are billed through Stripe on a Stripe-hosted checkout page; your card number stays with Stripe, not with me. When you type a ZIP in your dashboard, the five digits are sent to zippopotam.us, a public postal-code service, to check the city and state; nothing else about you goes with them.

Mental Health Store account holders: When you register a Mental Health Store account I collect your name, email, optional company or brand, and the product information you submit (title, tagline, description, image, links, video URL, price, category). Your contact email is not shown publicly. Everything else you submit appears on your product's public showcase page.

How I use it

• To match you with providers and deliver your inquiry to the ones you choose
• To run and improve the directory, its search, and its matching
• To send transactional email (account confirmations, lead alerts, Mental Health Store submission status)
• To promote provider profiles and Mental Health Store products on social media (see below)

I do not sell personal information, and I do not use it to advertise to you.

Cookies and similar technologies

The site sets very few cookies. None is used to show you ads, and the site's own cookies are never shared with an advertiser. This is the whole list. Beyond these, the site keeps your analytics choice in local storage (last row) and a few short-lived working notes in session storage, such as a search you started before the page changed; those are cleared when the tab closes and never leave your browser.

The site sits behind Cloudflare. On ordinary page views Cloudflare does not set a cookie here. Its Turnstile bot check runs inside its own frame from challenges.cloudflare.com on the login form and on most public forms (registration, password reset, profile claim, practice and partner sign-up, groups, Mental Health Store, and the inquiry forms on provider and practice profiles); anything Turnstile stores belongs to that Cloudflare domain and is covered by Cloudflare's privacy policy.

Analytics

I use Google Analytics 4 to see which pages get read and where visitors come from. It loads only after you click Accept on the consent banner. If you decline, or if your browser sends a Global Privacy Control or Do Not Track signal, it never loads and Google receives nothing from your visit.

When it does run, I have narrowed what it gets:

• Google signals and ad personalization are off, so your visit is not linked to a Google account or used to build an advertising profile.
• Page addresses are reduced before they are sent: query strings are dropped, the part of a URL that names a condition, therapy, or topic is replaced with a generic token (a visit to a page about one diagnosis reaches Google as a visit to a generic "topic" page), and the referring page is cut down to its site name.
• Ask AI questions, the matching quiz, and lead pages are never sent to Google.
• Google Ads receives one thing: the provider sign-up conversion, with the same reduced page address, and only if that provider accepted analytics. I do not build remarketing lists or audiences from any of this.

Separately, provider dashboards show first-party visit counts (pages viewed, contact clicks, referring site). That record lives on this server, uses the daily server-computed code described above rather than your login, and is not shared with Google or anyone else. Providers see totals, never an individual visitor.

The page address in that record is reduced before it is stored: the query string is dropped, and the part that names a condition, therapy, insurance plan, article or topic becomes a generic token, so a visit to /specialties/anxiety is stored as /specialties/:topic. City names stay. No search words are stored, and no topic words from an address, with two exceptions: the address of a provider, practice or Mental Health Store product page keeps its public name, and a visit to a topic page, an article or a guide may be stored with the site's internal number for that page, which lets me count visits to each one. A link click is stored only as the kind of link (email, phone, booking, website, or another site, with that site's name) or, for a link within the directory, the kind of page it opens, never the address, email address or phone number itself. Records made before this change have been reduced the same way, and anything the older tracker recorded on the matching quiz has been deleted.

With each page view the site also records the device type (phone, tablet or computer; your exact screen size is not sent) and, if you came from another page of this directory, only the kind of page it was (search results, a specialty page, a city page and so on), never its address or any search words. Arriving from the matching quiz is recorded only as "other", so nothing notes that you used it. On provider and practice profiles it also records how far down the bio you scrolled, in quarters, whether you opened or sent the message form (never what you wrote), and which kind of contact link you used: booking, website, phone or email.

The visit counter. If you choose Accept, the site sets its own visit counter: a random number with no searches or anything you type in it. With it, your visits on different days count as one returning visitor, and a message or a contact click can be credited to the visit that first brought you. My server keeps a record of that number with the kind of place your first counted visit came from (such as a search engine, a social site, another website, or a direct visit) and, if the page where you clicked Accept came from a campaign link, its utm source, medium and campaign name, plus Google's click id if you came from an ad. Each of those tags is kept, in lower case, only if it is a plain code of letters, digits, hyphens or underscores; anything else is saved as "other". Only I see the campaign details; providers see totals. None of it is sent to Google or any other advertiser. Each record is deleted 395 days (about 13 months) after it was created, and visits older than that lose the number; if you are still visiting by then, your next visit starts a new record. Turning analytics off under Your Privacy Choices deletes both cookies and the server record for the number in them, and unlinks your past visits from it. If your browser is offline at that moment, if you clear the cookies yourself instead, or if your browser had already discarded an earlier number (some browsers clear cookies set by a page's script after about a week, and the site then issues a new number), those records expire on the same 395-day schedule.

If you accepted the earlier banner, which asked only about Google Analytics, the visit counter stays off until you choose Allow analytics under Your Privacy Choices.

Your privacy choices

The banner. On your first visit a small banner asks whether Google Analytics and my own visit counter may run, so I can see which pages help people find care and which ads bring people here. Accept turns both on. Decline keeps both off. Neither one loads before you choose; the cookieless daily count described above runs either way.

Changing your mind. The "Your Privacy Choices" link in the footer of every page reopens the choice. Choosing Turn analytics off stops Google Analytics on the page you are on, not just the next one, deletes the _ga cookies it set, deletes the ocd_vid and ocd_src cookies, and deletes the visit counter's record on my server.

Browser signals. If your browser sends Global Privacy Control (GPC) or Do Not Track, I treat it as a full opt-out, whatever the banner says: Google Analytics does not load, the visit counter is never set (any counter cookies already there are deleted), and your visits are left out of the site's own daily count too.

Everything else. Opting out of social-media promotion, and asking to see, correct, or delete your information, is handled by email. Both are described below.

Health information

Looking for a therapist can say something about your health. I do not sell that information and I do not use it for advertising. Pages about specific conditions are not reported to ad platforms by name (see Analytics), the matching quiz and inquiry pages carry no analytics at all, and what you write to a provider goes to that provider and no one else (the site's own count notes only that a profile's message form was opened or sent). I am not a health care provider, and this site is not a medical record; please save clinical detail for your first conversation with the provider.

Ask AI and third-party AI processing

The website and the iOS app include an "Ask AI" feature that lets you search the directory in plain language (for example, "telehealth anxiety therapist in Portland who takes OHP").

What is sent: only the question text you type. Please do not include your name, contact details, or other personal information; the feature is built for directory search, not for personal disclosure.

Who processes it: your question goes to my server at orcounselors.com and then to Groq, Inc., a third-party AI provider (groq.com), which interprets the question so I can run the search. Groq handles the text under its own terms, which you can read at groq.com.

How it is used and retained: the question is used only to answer that one search. I do not store it against your identity, I do not build a profile from it, and it is never used for advertising or sent to Google Analytics. Requests are rate-limited to prevent abuse.

Your choice in the iOS app: the first time you use Ask AI in the app, it tells you what is sent and to whom, and asks your permission before anything is sent. You can decline and use on-device search instead, which keeps your question on your iPhone and sends nothing. You can change this choice at any time from the Ask screen.

Ask AI in the OR Counselor Directory iOS app

This section describes how the "Ask AI" feature works in the iOS app, OR Counselor Directory, which lets you search for providers using everyday language.

What is sent: only the natural-language search text you type into Ask AI (for example, "telehealth anxiety therapist in Portland"). No name, email, phone number, account, or device identifier is sent.

Who it is sent to: your search is sent to my server at orcounselors.com, which passes it to Groq, Inc. (groq.com), a third-party AI provider that interprets the question so I can run a directory search. Groq handles the text under its own terms, which you can read at groq.com. Your search is used only to answer that one query. It is not stored against any identity and is never used for advertising.

Permission before sending: the first time you use Ask AI, the app shows a consent screen that explains exactly what is sent and to whom, and asks for your permission. Nothing is transmitted until you tap "Allow AI search." You can instead choose "Search on this device," which runs the feature entirely on your iPhone and sends nothing, and you can change this choice at any time.

How this is disclosed: this privacy policy identifies what the feature collects, how it is collected, and all uses of that data, including that the question is shared with the third-party AI provider named above.

Promoting provider profiles on social media

I regularly share verified provider profiles on my social media channels (Facebook, Instagram, LinkedIn, X, and similar) to help local providers reach more clients. This is part of the marketing and showcase license you grant when you create or claim a profile (see the Terms of Use, Section 5). Promotional posts may include your professional name, credentials, photo, city, specialties, and a link back to your profile on this directory.

I never include private fields in social posts (your email, phone, billing details, internal notes, or anything a client submitted through the matching tool).

Opt-out: You can ask to be excluded from social-media promotion at any time by emailing [email protected] with the subject line "Marketing opt-out." I will stop new posts within 7 business days; existing posts may persist on the platforms where they were published until manually removed.

Mental Health Store: how it works

I don't take a cut of your sales. The Mental Health Store is a free showcase: no listing fees, no commission, no revenue share. When a visitor clicks your product link they go straight to your site, Mental Health Store page, Stripe checkout, or wherever your product lives. I don't intercept transactions or collect payments on your behalf.

List your own external links. Point your product link at whatever destination works best for you: your own product page, the iOS App Store, Google Play, your Stripe checkout, your course platform (Teachable, Kajabi, Thinkific), your Gumroad page, your Amazon listing. Outbound clicks carry ?utm_source=orcounselors&utm_medium=app-store so you can track referrals in your own analytics.

I promote new submissions on social media. When a new product is approved I may share it on my social channels (Facebook, Instagram, LinkedIn, X) and in the newsletter to help drive interest. Posts include the product title, tagline, hero image, and the link to your showcase page. The same opt-out applies: email me with the subject "Marketing opt-out, Mental Health Store" and I'll exclude your product from promotion.

Other services the site uses

Besides Google Analytics, your browser talks to these outside services on some pages. Each sees your IP address and the request it serves, and each has its own privacy policy.

• Google Fonts (fonts.googleapis.com, fonts.gstatic.com): the site's typefaces.
• Cloudflare: sits in front of the site for caching and protection, and its Turnstile widget checks that submissions to the login form and most public forms come from a person. The site's general contact form uses a forgery token, a hidden trap field, and a rate limit instead.
• jsDelivr (cdn.jsdelivr.net): a public script library that serves the small interface script the site uses, plus the text editor on provider dashboards.
• OpenStreetMap (tile.openstreetmap.org): map tiles on profile and practice pages, fetched when a map on the page comes into view. No key, no account.
• Nominatim (nominatim.openstreetmap.org), the OpenStreetMap Foundation's address search: when a map on a profile or practice page is about to come into view, your browser sends Nominatim the listing's address (or, if that finds nothing, the listing's city) so the pin lands in the right place. A map that shows a street address always asks; a city or statewide map skips it when the site already has a saved point for that listing it trusts. A statewide listing's map also asks it for the outline of Oregon. It sees your IP address and that address, which is already public on the page, and nothing you have typed. No key, no account, and no cookies.
• Zippopotam (api.zippopotam.us), a public postal-code lookup: when a provider types a ZIP into their dashboard address, the five digits go to this service so the city and state can be checked. It sees the ZIP and the provider's IP address, nothing else. No key, no account, no cookies.
• Stripe: payment for provider plans, on a Stripe-hosted checkout page. Stripe holds your card details, not this site.
• Groq: interprets Ask AI questions (see above).
• Video players: a provider intro video shows as a thumbnail with a play button. The thumbnail image comes from YouTube's image server (img.youtube.com) when the page loads, so YouTube sees your IP address and the video id, with the referrer reduced to this site's name. The player and YouTube's own script load only when you press play, through youtube-nocookie.com. A provider may also link a Vimeo, Loom, or Subsplash video, and those players follow those companies' policies.

Information sharing

I do not sell your personal information. Your match form details go only to the providers you explicitly choose to connect with; never to advertisers or analytics. Provider profile information and Mental Health Store product information are publicly visible by design. The only third-party AI service I share data with is Groq, and only the transient Ask AI question text described above.

Client inquiries

When you contact a provider through the directory, your message goes to that provider. I keep a copy on the site so the provider can find it in their dashboard and so I, as the site administrator, can see that it was delivered. When a provider replies through a practice account, the practice's administrator can receive a copy of that reply. The directory is a public referral channel, not a clinical record: please leave medical details for your first conversation with the provider.

Ninety days after delivery I delete the free-text part of every inquiry (your message, any notes from the matching quiz, and the provider's written reply). Your name, contact details, and the delivery record are kept so the provider can still reach you and so I can audit the pipeline. I do not run analytics or advertising trackers on the matching quiz.

Data security

Traffic is encrypted in transit (HTTPS). Passwords are hashed with bcrypt. Forms are protected by Cloudflare Turnstile and by forgery tokens. Session data is stored on the server, and the session cookie is HttpOnly and Secure.

Your rights

You can ask me to show you, correct, or delete your account, profile, products, or personal data at any time by emailing [email protected]. I answer these myself. Mental Health Store products can also be self-managed via the email-token edit link sent in your approval email.

Contact

For privacy questions: [email protected]