Privacy Policy
Last updated 16 September 2026.
What we collect
An email address, because it is how you sign in — there is no password to store. If you subscribe, our payment processor holds your card or PayPal details and we never see them; we keep only the subscription's status and its identifiers.
If you write to us through the contact form we keep the message, the address you gave and the time it arrived, so that a reply is possible and so a message lost in transit is still a message we have.
We record ordinary technical data — the IP address a request came from, and the fact that a request was made — for rate limiting and abuse prevention. It is what stops somebody using the sign-in form to send mail to a stranger's inbox.
Analytics
We count page views with our own copy of Umami, running on our own servers. It sets no cookies and stores no identifier on your device. Nothing about your visit is sent to anybody else, and there is no advertising network involved — which is why this site asks you to accept nothing.
If you are not signed in, a visitor is a hash of the address the request came from and the browser it came from, re-salted at the start of each month. Two visits in the same month from the same network and the same browser count as the same visitor; a new month, a different network or a different browser does not.
While you are signed in we attach your email address to those measurements, so we can see how the product is actually used by the people using it. That does link your visits to each other, to your account, and across the devices you sign in on. The address is held in the same analytics database on our own servers, it still goes nowhere else, and signing out stops it — from then on you are the month-salted hash like anybody else.
Session recording
On a sample of visits we also record the visit itself, so that we can see where a page confuses people rather than only how many reached it. What is recorded is a replay of the page as your browser drew it — including the parts you scrolled past, in the order you met them, with the clicks and movements that took you there.
What you type is masked before it leaves your browser: every form field is replaced with placeholder characters, so a recording never contains a search you typed, a weight you entered or an address you filled in. Text the page itself displays is recorded as displayed, so a recording made while you are signed in can show what your own account pages were showing you.
It runs on the same software, on the same servers, and goes to the same place as everything else here — nowhere else, and to no third-party recording service. It is a sample rather than everybody, so most visits are never recorded at all.
A browser that sends a Do Not Track signal is never recorded. We still count the page view, because a count is not a recording and we would rather know how many people were here than nobody at all — but nothing about the visit is replayed.
Switching it off
If you would rather not be measured at all, this switch stops it for this browser — the counting and the recording together, from the moment you set it. The setting is remembered on this device only, so it does not follow you to another browser.
We do count that the switch was used: one record, sent as you press it, so we know how much of our audience our figures are missing. Nothing is sent after that. If you are signed in when you press it, that record is attached to your account like everything else measured while you are signed in.
What we do not do
We do not sell or rent your data, we do not follow you onto other sites or buy anything about you from anyone, and we embed no advertising trackers. What we measure is what you do here.
Tracking in our emails
We write our emails without images, and we do not measure who opens them. Our current mail relay nevertheless adds two things of its own to every message it sends: a one-pixel image that records an open, and a rewrite of each link so that clicking it passes through the relay first. We do not read or act on either, and we are moving to a provider that adds neither. Until then it is theirs, it is there, and we would rather tell you than let you find it in the source.
Sign-in codes and messages about your subscription are part of the service and cannot be switched off while you have an account. Score alerts and product announcements can be, from your settings or from the unsubscribe link in any of them — an unsubscribe is recorded against the address and outlives the account.
Third parties
We use a payment processor, an email relay and a chat widget. Each receives only what it needs to do its job, and each has its own privacy policy. Market data comes from data providers under their terms; what we publish is our own analysis of it.
Your choices
You can ask us what we hold about you, ask for it to be corrected, or ask us to delete your account. Write to us from the Contact page. Some records — a payment, an unsubscribe — are kept after an account ends because we are required to, or because forgetting them would be worse for you.