Privacy policy

The short version

Signing up for the briefing shares nothing in the public domain. Your email address is never sold, never used for commercial gain, and never shared with third parties beyond the infrastructure that delivers the email you asked for. You can leave at any time and take your data with you.

What we collect, and why

One thing: the email address you give us when you subscribe, confirmed by double opt-in — you get exactly what you asked for and nothing else. We keep the subscription timestamp and confirmation status so we can prove consent. That's the whole record. No advertising trackers, no analytics cookies, no profiles. The site stores a single theme preference (light/dark) in your browser's localStorage; it never leaves your device.

What we never do

• Sell, rent, or trade your personal information — to anyone, for any reason.
• Publish or otherwise expose subscriber data in the public domain.
• Use your data for advertising, profiling, or any commercial purpose beyond delivering the briefing.
• Send email you didn't ask for. Every briefing carries a one-click unsubscribe, honored immediately.

Where your data lives

Subscriber records are stored in Cloudflare D1 (Cloudflare, Inc.) and emails are delivered by Resend (Plus Five Five, Inc.). Both act as data processors under our instructions and their own privacy and data-processing agreements; neither is permitted to use subscriber data for their own purposes.

Your rights

Email [email protected] to access, correct, export, or delete your data. Requests are honored within 30 days, usually much faster, and deletion is complete — record and confirmation history both.

The regulations these commitments follow

This policy is written to satisfy, and in most cases exceed, the requirements of:

• California — CalOPPA (Cal. Bus. & Prof. Code §§ 22575–22579): a conspicuous privacy policy describing what is collected and with whom it may be shared. This page is that policy.
• California — CCPA/CPRA (Cal. Civ. Code § 1798.100 et seq.): rights to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information as defined by the Act, and we honor all access and deletion requests regardless of whether the Act's business thresholds apply to us.
• US federal — CAN-SPAM Act (15 U.S.C. §§ 7701–7713): truthful headers and subject lines, a working unsubscribe honored promptly, and a valid contact address in every email.
• EU/UK — GDPR & UK GDPR (Regulation (EU) 2016/679): consent as the lawful basis (Art. 6(1)(a)) established by double opt-in, data minimization (Art. 5(1)(c)), and the rights of access, portability, and erasure (Arts. 15, 17, 20).
• EU/UK — ePrivacy / PECR: email sent only with prior consent, with a functioning opt-out in every message.

If a regional data-protection regime grants you additional rights, we extend the same treatment to everyone: ask, and it's done.

Changes

If this policy materially changes, the change is announced in the briefing itself before it takes effect, and this page's date is updated.