Your privacy, in plain English.

Data we collect

We collect only what is necessary to operate the site:

• Email address - if you subscribe to our weekly newsletter or submit a contact form.
• Aggregated traffic data - page views, country (not city), device type, and referring site, collected via Plausible Analytics (no cookies, no individual tracking).
• Reader reviews - name (optional, can be anonymous), text content, and the tool being reviewed.
• Server logs - IP addresses are retained for 7 days for security purposes (rate-limiting, abuse detection) and then automatically deleted.

Why we collect it

• To deliver the newsletter you subscribed to.
• To respond to messages you send us.
• To understand which articles are useful so we can write more of them.
• To protect the site from abuse and DDoS attempts.

Cookies

We use a minimal set of essential cookies. See our cookies policy for the full cookie table.

Analytics

We use Plausible Analytics, a privacy-respecting analytics tool that does not use cookies, does not collect personal data, and is GDPR-compliant out of the box. Plausible aggregates anonymous traffic data - we cannot identify individual visitors from this data.

We do not use Google Analytics. We do not use Facebook Pixel. We do not use any other third-party tracking script.

Third-party services

The following processors handle data on our behalf:

• Plausible Analytics - anonymous traffic statistics.
• Buttondown - newsletter delivery (your email address only).
• Cloudflare - CDN and DDoS protection (IP addresses, in transit only).
• Affiliate networks - when you click an outbound affiliate link, the destination tool's affiliate platform receives a tracking cookie from them, not from us. Their privacy practices apply once you leave our site.

Data retention

• Newsletter subscriptions: until you unsubscribe.
• Contact form messages: 12 months after the last reply.
• Reader reviews: indefinitely (you can request deletion).
• Server logs: 7 days.
• Aggregated analytics data: indefinitely (already anonymized, no individual identification possible).

Your rights

Under GDPR (if you are in the EU/EEA) and CCPA (if you are in California), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data (the "right to be forgotten").
• Export your data in a portable format.
• Object to processing.
• Withdraw consent at any time.

To exercise any of these rights, email [email protected]. We will respond within 30 days as required by law.

International transfers

Our servers are located in the United States. If you access our site from outside the US, your data is transferred to the US for processing. We rely on Standard Contractual Clauses (SCCs) where required for transfers from the EEA, UK, and Switzerland.

Children's privacy

This site is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has provided us data, email [email protected] and we will delete it promptly.

Changes to this policy

If we update this policy, we will change the "Last updated" date at the top and, for material changes, notify newsletter subscribers by email. Continued use of the site after a change indicates acceptance.

Contact the DPO