What runs in your browser, and why.

Strictly necessary

A bot-protection check (Cloudflare Turnstile) runs when the eligibility form is submitted. It guards the form from automated abuse and cannot be turned off without breaking submission.

Preferences

After a ZIP code is entered, it is kept in the browser so local programs and nearby providers show up without typing it again on the next page. It stays on the device, is not tied to a name, account, or email, and is not shared or sold. Clearing cookies in browser settings removes it, and the tool still works without it.

Analytics — anonymous, and optional

Product analytics records which programs people look at and where the tool gets confusing. These events go to this site's own servers — not to an analytics company — and are counted without any cookie or stored identifier, so they can't follow you between visits or between sites. Nothing is sold or shared. Counting is on by default; the notice at the bottom of your first visit turns it off, as does the “Privacy choices” link in the footer, and browsers sending a Global Privacy Control signal are excluded automatically. A cookieless traffic counter (Cloudflare Web Analytics) records page views the same way. No raw income, asset, ZIP code, or email value is ever recorded.

Google Analytics also runs on the site. It sets a first-party cookie (_ga) so repeat visits from the same browser count once. It sends Google the pages viewed and two events: that an eligibility check was started, and that one finished, with the state and county, the page the visit started on, the check's random ID (the same one in the results page address), a rough value range, and how many programs looked likely. In the local resources directory it also sends when a business listing is shown or opened and when its call, website or directions button is used, with the listing, its category, and the state and county of the page. Nothing from an eligibility check is attached to those. It also sends when an account is created, a plan or business listing is paid for, a business listing form or newsletter signup is sent, results are emailed, a saved profile is added, a question on the Ask page gets an answer (the state only, never the question), and when an apply link, agency phone number, or official source link is used, with the program's ID. Every page view and event also says which language the page was in (English or Spanish). No income, age, ZIP code, or email goes to Google. It is set up for measurement only: Google Signals and every advertising feature are turned off, so nothing from this site feeds ad profiles or cross-site tracking. The same off switch covers it. Declining the notice, using the “Privacy choices” link, or sending a Global Privacy Control signal keeps Google Analytics from loading at all, so no cookie is set and nothing is sent.

Advertising

None. DiscoverSeniorBenefits runs no ad networks, no retargeting pixels, and does not sell or share personal information for cross-context behavioral advertising.

Controlling cookies

Use the “Privacy choices” link in the footer to change or withdraw analytics consent at any time. You can also block or clear cookies in your browser settings; the tool will still work.

Global Privacy Control is honored: if your browser sends a GPC signal, analytics is treated as declined automatically and the cookie banner is not shown.

Contact

Cookie or privacy questions: support@discoverseniorbenefits.com