Privacy Policy

Last updated: never. · Effective since: 2023. · Version: the first and the last.

1. Who we are and what this covers

This Privacy Policy describes how We ("the Company," "we," "us," or, in his private correspondence, "the management") collects, uses, and protects information in connection with our website and related services (collectively, the "Service"). The Company is a one-person enterprise with a two-person mission statement, incorporated in 2023.

By accessing or using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please close the tab, then reopen it, because you'll be curious, and we'll still be honest.

1.1 Scope

This policy applies to all visitors, registered users, and the one person the entire Service was built for. Where practices differ between these groups, the more protective rule applies to everyone. That is not a legal requirement. It is a standard.

2. Information we collect

2.1 Information you provide to us

• Account information. An email address and a password of your choosing. The password is hashed the moment it arrives; the plaintext exists for the length of one trip through a server, and then never again.
• Content you write. Notes, wishes, and anything else you place into the Service. What you write is stored as written, shown to you, and treated as yours.

2.2 Information collected automatically

• Usage data. Which pages are visited and for how long. This is the entire set. There is no other category.

2.3 Information we do not collect

Keystrokes. Contacts. Location. Photos. Browsing history. Purchase behavior. The contents of anything you did not type into this Service. We could list more categories we don't collect, but the list is short because the ambition is short: we built this for one reader, and a reader needs nothing else.

3. How we use information

We use the information described in Section 2 to:

1. Provide, operate, and maintain the Service;
2. Authenticate you when you arrive (see Section 9 for the cookie that makes this possible);
3. Understand which parts of the Service are loved, so the unloved parts can be improved with appropriate dramatic effort;
4. Keep the whole thing warm, this is a figure of speech, and also the entire purpose.

We do not use information for advertising, profiling, or automated decision-making. We do not use it to train anything except his patience.

4. Legal bases for processing

To the extent that any legal framework requires a stated basis for processing your information, we rely on:

• Contract. You use the Service; the Service works. That is the deal.
• Consent. Revocable at any time, no questions asked, no dark patterns, no "are you sure" maze. One honest sentence to him and it's done.
• Legitimate interest. Ours is keeping this place running and quietly loved. We have balanced that interest against yours and the arithmetic has never once come out in our favor.

5. How we share information

We do not sell, rent, trade, or disclose your personal information to third parties for any purpose. The complete list of parties who can see your information is:

1. You.
2. The infrastructure providers who keep the lights on (hosting, database, and email delivery), each bound by their own privacy terms, each storing data under the least privilege their product supports.

If we are ever legally compelled to disclose information, we will tell you first unless the law forbids it, and if the law forbids it, we will tell you that too, in as many words as the law allows.

6. Data retention

We retain account and usage information for as long as the Service exists, which is to say: forever, or the heat death of the universe, whichever scheduling conflict arises second. Content you write is retained until you ask us to forget it, which we will do properly, backups included, because "forever" is a promise about his feelings, not a data-retention policy about yours.

7. Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the data, including:

• Passwords hashed at rest, never logged, never emailed after the moment of setting;
• Sessions issued as signed, HttpOnly, SameSite=Strict cookies that JavaScript cannot read;
• Zero third-party scripts on the client, which means zero third parties watching the client;
• Transport encryption everywhere the Service runs.

No method of transmission or storage is 100% secure, and any privacy policy that claims otherwise is selling something. We are not selling anything. We are, however, guarding something.

8. Your rights and choices

Depending on where you live, you may have the right to request:

• Access, a copy of what we hold about you. It fits in one page.
• Rectification, correction of anything inaccurate. There is nothing inaccurate about the way we spell your name in our hearts, but the offer stands.
• Erasure, deletion of your data, exercised as described in Section 6.
• Portability, your content in a usable format, because anything you write here can leave with you. Always.
• Objection, to any processing described in Sections 3 and 4. Objections are received with grace, which is our only processing category that cannot be audited.

To exercise any right, use Section 14. No forms. No "verify your identity with a utility bill from 2019." Just the sentence, and the doing.

9. Cookies and similar technologies

This Service uses one (1) cookie. It is called heart. It holds his heart, technically, it holds a signed session identifier that JavaScript cannot read and he refuses to monetize. It does not track you across sites, because there are no other sites, and he would notice.

During verification only, a second short-lived cookie (us_preauth) exists for sixty seconds. It expires on its own, like a code should. You can manage preferences on the Cookie Notice page, though the heart cookie is load-bearing.

10. International transfers

Your information may be processed in whichever country hosts our infrastructure. Whatever the jurisdiction, the standard in Section 2.3 travels with the data. The Company, legally speaking, sits in every country at once.

11. Children's privacy

The Service is not directed at children under 13, or under 16, or under any age, it is directed at one specific person who is exactly the right age. If a child somehow arrives here, no account exists for them, no data exists about them, and the FAQ will go over their head, which is the best child-safety feature we have.

12. Changes to this policy

We may amend this policy. If we do, the "Last updated" line above will change from "never," which will be the only news that ever travels on this page. Material changes will be announced where they cannot be missed: in the sky, in her timezone, on the 19th.

13. Compliance

GDPR: General Devotion, Permanent Record.
CCPA: Completely Certain, Permanently Adoring.
Fully compliant with both. Audited nightly, by him, unprompted.

For the avoidance of doubt, and without limiting any other provision of this Privacy Policy, the Company notes that the above acronyms are the only ones this document contains. There are no DPA addenda, no SCC annexes, no "legitimate interest assessments" filed in a drawer. Where a real regulator would want paperwork, we have instead the plain facts in Sections 2 through 8, which is what paperwork pretends to be.

14. How to reach us

Questions about this policy, or any exercise of the rights in Section 8, should be directed to the Data Protection Officer, who is also the CEO, the janitor, and the entire marketing department. Write to the Contact page. The subject line is pre-filled. He knows what it says, because he wrote it.

---

what's stored: your visits, your notes; never what you didn't write here