Privacy

I keep as little as I can.

Visitors

• Your browser keeps a random id (no name, no email). The server stores only a salted hash of it, with your watchlist, saved views and the time you last read notifications.
• Looking up a new writer stores a salted hash of your IP address for 2 days, to limit lookups to 20 a day.
• Analytics, if on, is Cloudflare Web Analytics: no cookies, no cross-site tracking.

Analytics

I count visits so I can fix what is broken and build what people look for. The counting is my own, on my own servers. There are no third-party trackers, no cookies for tracking, and no fingerprinting.

• For each page view I record the page type (for example /w/:handle, never the writer's handle), where you came from (the site, not the full address), any utm_ tags on the link, your device class (phone, tablet or desktop), your country and language, how long the server took, and whether you look like a person or a crawler.
• For clicks I record only the kind: a search, a watchlist add, a checkout click, a Pro unlock that worked or failed, a copy or download button, a link to another site, a script error. I keep the text of a search, up to 80 characters, and drop it if it looks like a key, an address or an email.
• To count people once a day I make a short hash of the date, your IP address and your browser's user agent, mixed with a secret salt. The hash changes at midnight UTC, so I can't follow you from one day to the next. The IP address and user agent themselves are never stored in these events.
• Your browser keeps the first site that sent you here and the date you first came, in local storage on your device, so I can tell which sources lead to Pro. It never leaves your browser except as those few words.
• If your browser sends Do Not Track or Global Privacy Control, the script sends nothing and I make no hash. The server still counts the page in aggregate, without a hash, referrer or country.
• Never recorded: names, emails, license keys, passkeys, watchlists, or anything you type except search text as above (which can be a writer's handle or name, since that is what the search box takes).

Event data is kept for three months. A weekly summary with no personal data is kept longer.

Pro

• Your card details go to Stripe and never reach me. I keep the payment's session id and the email Stripe provides. I also store a hash of your license key, and your digest destinations (webhook URLs, Telegram chat ids).
• Passkeys store a public key only.

Writers who claim a page

• I store the claim code and when it was verified. Numbers you share are stored per month; only the ones you mark public appear on your page. The rest only feed groups of 5 or more writers.

Your data

Download or delete what's stored for your browser in Settings. For anything else, write to contact@stackblade.app.