Privacy Policy

Who we are

Index of Herbs is a public monograph library and journal about medicinal plants. The operator is Keersa LLC, in the State of Florida, United States. The website address is indexofherbs.com.

Questions about this policy, or a request about personal data we hold, can go through our contact page. We do not give medical advice by email.

What this policy covers

It covers information we collect when you browse public pages, send a message, create or use an account, or administer the site. It does not cover independent sites we link to in citations (NCCIH, PubMed, EMA, and similar). Those sites have their own policies.

Information we collect

Information you give us

• Contact form: first name, last name, email address, and the message you write. We use that to read and reply. We do not sell it.
• Accounts: if you register, we store the name, email, and hashed password you provide, plus the role of the account (for example member or administrator). You can edit much of that from your profile while you are logged in.
• Administrators may also publish herb monographs, blog posts, and related media. That editorial content is meant to be public.

Information collected automatically

• Server and application logs may include IP address, browser user-agent, date and time, and the pages requested. We use this to run, debug, and protect the site—not to build a marketing profile.
• If a request looks like abuse (spam, flooding the contact form), we may retain technical details longer to block it.

Cookies and similar storage

We use cookies that are needed to run a conventional web application:

• A session cookie so the site can keep you logged in for a visit and remember that you are the same browser from page to page.
• A CSRF token cookie to help prevent cross-site request forgery on forms.
• If you use “remember me” on login, a longer-lived cookie keeps the session until it expires or you log out.

These cookies are not advertising pixels. We do not currently set third-party marketing cookies. If you visit the login page, the session machinery may set a cookie even before you authenticate; it is for the application, not a dossier.

You can block cookies in your browser. If you do, login, the contact form, and other POST requests may fail.

Comments and media we do not collect

The previous WordPress privacy text described comments, Gravatar hashes, and visitor-uploaded images with EXIF GPS. This site does not currently offer public comments, Gravatar avatars, or a public image-upload form. We mention that so the old language is not silently reused. If we add comments later, we will update this policy before collecting that data.

Images that appear on herb and blog pages are published by us (or our administrators) as editorial media, not as a visitor upload gallery.

Embedded content and third parties

Pages may load fonts from a font host and, on the contact page, Google reCAPTCHA so we can tell people from bots. reCAPTCHA is Google’s service. Google may collect device and usage data according to its own privacy policy. Using the contact form means that check runs.

Citation links, videos, or other embeds from other websites behave as if you visited those sites. They may set cookies or collect data. Linking a source is not an endorsement of that site’s privacy practices.

If you request a password reset, the email we send is a reset message. Mail systems in between us and you (your provider, ours) will see the addresses involved. We do not put your password in email.

Who we share data with

We do not sell personal information. We share it only as needed to operate the site:

• Hosting, email delivery, and similar processors who run infrastructure under our instruction.
• Google, for reCAPTCHA on the contact form.
• The law, if we are required to disclose information, or to protect the site, our users, or other people from harm or fraud.

Administrators can see account details and contact messages in the course of running the index. They are not a public staff directory.

How long we keep it

Contact messages are kept long enough to read, reply, and keep a record of the correspondence. We may delete or redact them when they are no longer needed. We do not keep them as a marketing list.

Account profiles last until the account is deleted, by you (where the product allows) or by an administrator. Server logs are rotated in the ordinary course of operations.

We may retain information we are obliged to keep for administrative, legal, security, or tax reasons even if you ask us to erase the rest.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or export personal data we hold, or to object to certain processing. This site is operated from the United States. If you have an account, you can already see and edit much of your profile.

To request an export or deletion of personal data we hold about you, use the contact form and say so clearly. We may need to verify that the request comes from you. Deletion does not reach information we must keep, or content you asked us to publish as a public correction that has already been merged into a monograph.

Children

The site is written for a general adult audience. It is not directed at children under 13, and we do not knowingly collect personal information from them. Herb pages discuss pediatric cautions as education, not as a product for kids.

Security

We use ordinary industry measures (HTTPS in production, hashed passwords, CSRF protection, role checks on admin tools). No website can promise perfect security. Do not send medical records, government ID numbers, or payment card data through the contact form. We are not a clinic and we are not a store.

Changes

We may update this policy. The “last updated” date at the top will change. Material changes will be posted on this page. Continued use after a change means you have had a chance to read the new text.

Related: Terms and Conditions.