Privacy Policy

Last updated: November 2, 2026

The short version

WhatCanHelp is run by MarshWorks LLC in Duluth, Minnesota, and hosted in the United States. It isn’t a healthcare provider and isn’t covered by HIPAA. That’s one more reason to keep names and other identifying details out of anything you type here.

Match and AI

What gets sent. When you use Match, the description you type and any options you pick (age group, budget, platform, and similar) go to Anthropic’s Claude API in an encrypted request. That happens twice: once to work out what kinds of products to look for, then again to choose from the catalog products our own server finds and explain how each fits your situation. The catalog search in between runs on WhatCanHelp’s server, and nothing from it is stored. Your IP address, device details, and any identifier are left out of both requests.

What Anthropic does with it. Under their commercial terms, Anthropic does not train its models on API data. By default they delete it within 30 days. If their automated safety systems flag a request as violating their usage policy, they may keep it for up to two years, and the safety scores for up to seven.

What WhatCanHelp keeps. Nothing from what you typed. It’s held in memory just long enough to get your results, and never written to the database, logs, or any other storage. The only record is that a search happened, whether it worked, how many results came back, and a rough length (for example, “short”), with no wording.

Reports. A report (a PDF, or the same results as a JSON data file) is built from the results already on your screen and sent straight back to you. The server doesn’t keep a copy. It records only that a report was downloaded, which kind, and how many products it included.

Leave out identifying details. Describe the situation, not the person. “7-year-old, nonspeaking, uses a school iPad” gets the same results as a description with a name and birthdate, without exposing anyone.

For clinicians, therapists, and educators. What you type here isn’t covered by any agreement with your organization. There’s no Business Associate Agreement and no FERPA protection, so don’t enter patient, client, or student records. Describe needs in general terms.

Other AI use. Product descriptions, categories, and image descriptions are written ahead of time from public manufacturer information. Nothing you enter is part of that.

What the server records

Web server logs. Every request is logged with the network it came from (your IP address with the last part blanked out, so it points to a block of an internet provider’s addresses rather than to you), the page requested, the page that linked you here, standard request details such as the languages your browser accepts, and the response time. Two things are removed before logging: your browser’s user-agent, which names the browser and device type, and anything after a “?” in a web address, which is where search terms and filters go. Logs are deleted after 14 days.

Application logs. Errors, plus security events such as a blocked form submission. A security event carries a visitor code (see Abuse prevention below), never an IP address. They never include search text. They’re deleted after 14 days.

Abuse prevention. Some actions have rate limits, including Match, reports, and problem reports. They count visits by a visitor code, never by IP address: the server scrambles your address with a secret key that changes every day and is never saved, and keeps only the code. Counts are held in memory for up to a day (for Match, which allows a limited number of searches per day) and an hour or less for everything else, then drop automatically. Repeated abuse puts a visitor code on a 30-minute block list, which is also deleted automatically. The key changes at midnight UTC and the old one is gone, so after that the codes can’t be linked to earlier days or traced back to you, even by WhatCanHelp, and every count starts over.

Anonymous usage events. A short list of actions is recorded to see what’s useful: Match searches, products viewed, comparisons, report downloads, and clicks out to a state lending program. Those clicks record only the state, with no visitor identifier. When Match finds only a few products for an area of need, such as vision or hearing, that area is recorded on its own, also with no visitor identifier and nothing you typed, so gaps in the catalog show up. Clicks out to vendors and retailers aren’t recorded. For the other events, a visitor code is made by scrambling your IP address and user-agent with a secret key that changes every day and is never saved. That lets one visit be counted as one person on the same day. Once the key changes, the codes can’t be linked to earlier days or traced back to you, even by WhatCanHelp. Event records are deleted after 90 days. After that, only daily totals remain, like views per product or clicks per state.

What you choose to send. If you report a problem with a product listing, the reason you pick and any note you add are saved with that product so it can be fixed. No identifier is attached, but a note is stored exactly as written, so please leave out personal details. Notes are deleted after 90 days; the reason you picked stays with the listing. Email if you want one removed sooner. The “Was this helpful?” buttons save only a yes or no.

What stays in your browser

Some choices are saved in your own browser (its “local storage”), not on the server:

These are kept only on your device. They reach the server only when you use them, and aren’t stored when they do. For example, opening a saved search runs it like any other search, and a PDF report includes your shortlisted products and state so it can list your state’s program. To erase these settings, clear this site’s data in your browser settings.

Services WhatCanHelp uses

Links to vendors, retailers, and state programs take you to their sites, where their own privacy policies apply. No link carries an affiliate tag or tracking parameter from this site. Your browser tells the destination only that you came from whatcanhelp.com, not which page.

Security and backups

The whole site runs over HTTPS, and the only outside script is the Cloudflare analytics script above. The database is backed up nightly. Backups are kept for no more than 30 days and then deleted, so anything removed from the database can remain in a backup for up to 30 days.

Your choices and requests

There are no accounts and nothing is linked to your name, so there’s usually nothing on file to look up. If you want something removed, such as a problem report you sent, or you have a question about your data, email hello@whatcanhelp.com. You’ll hear back as soon as possible, and within 45 days at the latest. Emails you send are kept only as long as needed to reply.

There’s no cross-site tracking here, so Do Not Track and Global Privacy Control signals have nothing to switch off.

Health information

What you type into Match can describe a disability or health condition, which some state laws (such as Washington’s My Health My Data Act) protect as health data. It’s used only to find matching products for you, shared only with Anthropic to produce your results, never sold, and not stored by WhatCanHelp, so there’s no record here to look up or delete. Anthropic keeps it for a limited time under its own policy (see Match and AI above). Questions about this, or about any other data, go to hello@whatcanhelp.com.

For organizations

Reviewing WhatCanHelp for your staff? There are no accounts, and the services listed above are the complete list. No Business Associate Agreement or data processing agreement is offered, because the site isn’t meant to handle identifiable records. If a security problem ever exposes visitor data, it will be disclosed on this page. Send security or privacy questions to hello@whatcanhelp.com.

Children

WhatCanHelp is meant for adults looking for assistive technology for themselves or someone they support. It isn’t directed at children under 13, and it doesn’t knowingly collect personal information from them. Teens are welcome, and the same advice applies: leave out names and other identifying details. If you think a child under 13 has sent something here, email hello@whatcanhelp.com and it will be deleted.

Changes to this policy

If data practices change, this page is updated before the change takes effect, and the date at the top changes too. A new outside service or a new kind of data will always appear here first.

Contact

Questions about privacy? Email hello@whatcanhelp.com.