Privacy.

• Contact form data — to reply to your inquiry. Nothing else.
• Newsletter email — to send you new posts when they publish. No drip funnels, no upsells.
• Analytics — to know which writing actually gets read, so we can write more of what's useful.
• Server logs — to diagnose outages and bad requests. Then they're gone.

A short, named list of the providers that touch your data, and where they sit:

• Email delivery — Resend (US-based). Sends the newsletter and relays contact-form submissions.
• Hosting — a self-managed VPS (EU region). Runs the API, database, and object storage in a single perimeter we control.
• Database & storage — Postgres and MinIO on the same VPS. Lead and subscriber records live here.
• Analytics — Plausible (EU-based). Cookieless, aggregate-only.
• Spam protection — Cloudflare Turnstile (US / global). Validates form submissions without dropping a cookie.

• Contact submissions — kept while the conversation is live, then archived. Auto-purged after 24 months of inactivity, or immediately on request.
• Newsletter email — kept until you unsubscribe. Every email has a one-click unsubscribe link in the footer.
• Analytics — aggregated and retained for 24 months, then rolled up into yearly totals.
• Server logs — seven days, then auto-purged.

No one. We don't sell, rent, or share your information with third parties for marketing. The only “sharing” happens with the providers above, who process it on our behalf so the site works.

If we're ever legally compelled to share data — a subpoena or court order — we'll comply with the minimum required by law, and notify you unless the order specifically forbids it.

You can exercise any of these by emailing us — we read that inbox directly, and you'll hear back within seven days.

• See what we have. We'll send you everything linked to your address.
• Correct it. Tell us what's wrong and we'll fix it.
• Delete it. Everything tied to your address, gone within seven days.
• Take it elsewhere. We'll export your data as JSON or CSV on request.
• Unsubscribe. One click in any newsletter footer — no email required.

If you're in the EU or UK, the rights above are guaranteed under the GDPR / UK-GDPR. They apply here regardless.

We use Plausible — a privacy-first, EU-hosted analytics service. It tells us how many people read a given post, and where they came from. It does not tell us who they are.

Specifically, the following are not collected:

• No IP address is stored.
• No cookies are dropped.
• No cross-site or cross-device tracking.
• No browser, device, or canvas fingerprinting.

This site sets no analytics or marketing cookies. Nothing for you to consent to, nothing to clear later.

One short-lived technical token may be set by Cloudflare Turnstile when you submit a form — it's used to verify you're not a bot and expires within the same session.

We'll update this page whenever the practices change. The Last updated stamp at the top reflects the most recent edit. For meaningful changes — a new data type collected, a new processor added — we'll also note the change in the next newsletter so subscribers don't have to come hunting.

Email us at [email protected]. We handle this directly — no ticketing queue, no privacy department, no “your request has been escalated.”