How this site handles your data.

What is measured

For each visit the site records the page viewed, how the visit was reached (the referring site and the campaign tag, if the link carried one), rough engagement (time on the page and how far it was scrolled), which articles are opened, which audio and video editions are played and for how long, and clicks on subscribe, follow, and outbound links. For a returning visitor it also records that the visit is a return and how many days have passed since the last one. A few other actions are recorded only as a name and a short label: sharing an article, downloading a file, starting or finishing an unlock of gated content (which item, never your address), saving a page to your reading list or removing it, starting, finishing, exporting or attaching a diagnostic review (which review, its version and its result category, never an answer), clicking a next step offer, starting or sending the "Work with ACW" form (sending it also records the reference number on your receipt, explained below), the length range of a site search (never what you typed), and how far down a research page you read. While a page test is running, the test and the version you were shown are recorded too. From the network connection it derives a coarse location (country, region, and city as reported by Cloudflare).

The browser also reports the device type, browser and operating system (the server keeps only those three labels, never the browser's full identification text), the width of the browser window, the display's pixel ratio, the number of touch points the screen supports, the browser language, the time zone, and the site language and day or night mode shown. Browsers that share more detail, mostly Chromium based ones, also report the device model, the operating system version, and the processor architecture and bitness (for example arm and 64-bit). The browser also sends the screen size, which the server discards.

How it works, and why it is cookieless

By default the measurement sets no cookie and keeps nothing that identifies you in your browser. The only cookies the site sets are the ones described under "Unlocking gated content" and, only while the members area is switched on, under "Member accounts", and, only after you press a star to rate an ACW Explained item, the rating cookie described under "Explained ratings and comments", apart from Google Analytics's own cookies if you allow it (see below). The site does keep your display choices in your browser, the language (when you switch it or open a link with ?lang=) and day or night mode, so the next page opens the same way; they hold no identifier.

Separately from the measurement, your browser keeps a few small things so the site's own features work. In session storage, which is gone when you close the tab: where this visit started (the campaign tag and referring site) and two counts, the pages opened and the files downloaded in this visit, none of which is kept while Do Not Track is on; and, on a diagnostic review page, the answers you have entered so far. In local storage, which stays until you clear site data: your reading list, if you save pages, which holds only the research page names and the times you saved them; your choice on the measurement notice, and the first-party identifier described below if you allowed it; and a marker, set only if you open a link that ends in ?notrack=1, that leaves this browser out of the counts. None of this is sent to the site except what you choose to send: the visit's source and the two counts go out only inside the "Work with ACW" form or an unlock code request, as described below; a diagnostic result goes only if you attach it to that form; and the reading list and diagnostic results go only if the members area is on and you turn on syncing (see "Member accounts").

To count unique visitors within a day, the server computes a one-way, salted hash of your IP address and browser type. The daily version of that hash rotates every night, so one day's activity cannot be matched with the next day's. What can carry over is the small record described under "How long it is kept", which is filed under a second hash of the same two things that does not rotate. The measurement never stores the raw IP address.

To stop abuse, the site also keeps short-lived counters under one-way hashes made with a secret key: of your IP address (for the mail-sending forms, of the network it belongs to), to limit how often the forms, code requests, downloads and measurement beacon can be used from one connection, and, when you ask for a code, of the email address, to limit how many codes go to one address. A counter holds only a number and expires with its limit window, at most about two days later. No raw IP address or email address is stored in it.

There is one optional exception you control. A short notice asks whether to allow a first-party identifier so that repeat visits can be counted exactly. This is off unless you choose "Allow", it is kept in your own browser storage and sent with each visit, where the server files the date of your last visit and the week you were first seen under it, it holds a random value tied to no personal detail, and you can clear it from your browser any time by clearing site data. Decline, ignore the notice, or turn on Do Not Track and the site stays fully cookieless.

Google Analytics, only if you allow it

If you choose "Allow" on that same notice, the site also loads Google Analytics through Google Tag Manager to measure overall site usage, such as which pages are read, which audio and video editions are played, and which subscribe and outbound links are followed. None of that Google code loads before you opt in: choose "No thanks", ignore the notice, or turn on Do Not Track and it never runs. Advertising storage and personalisation stay switched off, and no name, email address, or anything you type into a form is sent. Once allowed, Google Analytics stores its own cookies for this site. To withdraw, clear this site's data in your browser settings, which removes both the first-party identifier and the Google Analytics cookies; the notice then appears again and you can choose "No thanks".

What is not done

No advertising scripts run on this site. One third-party measurement script does run for every visitor: Cloudflare, which hosts the site, adds its Web Analytics script to each page, and it sends page-view and page-load timing data to Cloudflare. That script sets no cookie and uses no browser storage, but the notice above and the Do Not Track setting do not switch it off. Apart from it, no third-party analytics run unless you allow Google Analytics as described above. No data is sold or passed to advertisers. There is no cross-site tracking, no advertising profile, and no attempt to identify you personally. Automated bots are kept out of the visitor numbers; the site counts bot visits separately by type of crawler (for example a search engine or an AI crawler) without storing an IP address. The browser Do Not Track signal is honoured by the site's own code: if it is on, the site's measurement records nothing and Google Analytics never loads.

Fonts are served by this site itself, so no font service is contacted. Article images, audio and video are loaded from Substack's hosting (Substack and its content delivery providers). When a page with media loads, that hosting sees your IP address and the standard request data a browser sends, such as the browser type; it receives nothing else from this site. Apart from that media hosting, the Cloudflare script described above and the security check described under "Unlocking gated content", no other third-party host is contacted before you choose "Allow".

How long it is kept

Individual events expire automatically within about two days. That includes the labels a page view carries, such as the week you were first seen, and the inquiry reference described below. Small daily totals, which contain no identifiers, are kept for about 400 days to show trends over time.

To tell a new visitor from a returning one, the server keeps two things for 400 days under the one-way hash described above, but only while the site's permanent measurement key is set: the date of your last visit and the week you were first seen. From these it counts, in aggregate, how many visitors from each first-seen week come back; the counts hold no identifiers. If you allowed a first-party identifier, the same two things are kept under it instead, whether or not that key is set. Each new day you visit starts the 400 days again.

Your choices and contact

Turn on Do Not Track in your browser and the site's own measurement records nothing about your visit. The "Work with ACW" form and the unlock form for gated content are the only places the site collects details you type, apart from the membership forms while the members area is on.

The "Work with ACW" form stores what you enter: your name, your organisation if you give one, your email address, the interest, timeline and budget you choose, and your message, together with the time you sent it and the time you gave consent. If you choose to attach a research page or a diagnostic review result, the record also stores that page reference, or the review's name and version, your answers to it and a summary worked out from them. It also stores where you came from, as four short labels: source, medium, campaign and referring site. They come from the campaign tag on the link or the site that sent you, and never include a full web address or a page path. If the site's script cannot supply them (it is off, or Do Not Track is on), the server reads the Referer header the browser sends and keeps only a referring site or campaign tags found in it.

The record also notes whether the notification email to the site owner went out, and the quality score described below. The site keeps that record for up to a year; it does not store your IP address. Any follow-up status or note the site owner adds to it is deleted with it. A one-way fingerprint of what you sent is stored with the record and used for one day, so that sending the same form twice does not create two records.

Inquiries sent on or before 2 October 2026 may also hold the IP address they came from, until their year ends.

When you send the form, the measurement also records the reference number shown on your receipt, kept for about two days like any other measurement event. That reference matches the stored inquiry, so for those two days the visit's record (its daily hash, or your first-party identifier if you allowed one) can be linked to the inquiry, which holds your name and email address.

Each inquiry and each unlock record is also given a quality score from 0 to 100, a band from A to D, and the reasons behind it as short codes. The score is worked out from what the record holds (the interest chosen, the length range of a message, whether the email domain is a business, free mail or disposable one, whether a consent box was ticked, whether the address is verified or has bounced, and how many gated items the address has unlocked). It is stored with its record for as long as the record is kept, only the site owner can see it, and it changes nothing you receive. The site also keeps a daily count of new records in each band, with no names or addresses, for about 400 days.

The score also uses two counts your browser sends with the form or the code request: the pages opened and the files downloaded in this visit. They are used once for the score and are not stored; for an unlock they wait in the pending code request, for 10 minutes at most. Nothing is counted if Do Not Track is on.

Unlocking gated content

To unlock gated content you give your email address, and the site emails a one-time code to it. Once you enter the code, the site keeps your address with what you unlocked, your language, the time, and whether you ticked the optional newsletter box, for 400 days from the last time you unlock the same thing. It does not store your IP address. The newsletter box is stored as a yes or no; the site itself sends no newsletter and no confirmation email for it.

The unlock record also holds where you came from (the same four labels as the form, from your first visit), the times of the main steps (code requested, code verified, content email sent, content first opened), how many times you have verified the address, the quality score described above, and any follow-up status or note the site owner adds. A one-way hash of your address is kept beside it for the same 400 days so the record can be found by address, and the access it granted is recorded for 90 days with the content unlocked, that hash and the record's identifier. While you enter the code, the pending request holds your address, language, newsletter choice, those source labels and the two session counts for 10 minutes at most.

Unlocking sets two kinds of cookie. A challenge cookie, named __Host-acw_gate_ch, lasts 10 minutes and ties the code to your browser while you enter it. A grant cookie, named __Host-acw_g_ followed by a short code for the item or library you unlocked, keeps that content open in that browser for 90 days; you get one for each thing you unlock. Both are used only for that, are sent only to this site and cannot be read by scripts on the page. Apart from these, the member cookies described under "Member accounts" and the rating cookie described under "Explained ratings and comments", the site sets no cookie of its own.

On a busy day the unlock form can ask for a security check from Cloudflare before it emails a code. The site asks only once more than half of that day's allowance of unlock code emails has been used, or when it cannot read that count (the site owner can change the share), and only after the owner has switched the check on. When it asks, your browser loads a script and a frame from challenges.cloudflare.com, run by Cloudflare, which sees your IP address and the standard request data a browser sends. What Cloudflare's frame collects or keeps in your browser is decided by Cloudflare, not by this site. The site gives the check no email address and no code. When you pass, the check hands your browser a token, which goes to this site with your request. The site's server sends that token to Cloudflare to confirm it, together with the site's own secret key, and sends neither your address nor your IP address; the site does not store the token. The check runs whether or not you chose "Allow" and whatever your Do Not Track setting is, and only on the unlock form's request for a code.

Member accounts

This section applies only while the members area is switched on. While it is off, the member pages and sign-in do not work, none of the records described here is created, and none of these cookies is set.

Membership is optional. If you join, the site stores a member record with these details: a random member identifier; your email address, in the two forms described below; your name; your organisation, if you give one; your role, industry segment and country; the topics you chose; how you heard of ACW, if you say; whether you ticked the newsletter box; your weekly digest preference, if you set one; the state of your membership (pending, in a trial, active, complimentary, past due, lapsed, canceled or revoked), your plan (monthly or annual), any offer you used and whether you have had a trial; when your trial ends and when your current period ends; the time you joined, the time you confirmed your address, the time you last used your account, the time you accepted the terms and the version of the terms; and, if you subscribe, your Stripe customer and subscription identifiers. The name, address, state and identifiers run your account: they find you, send you codes and notices, and show you what your membership includes. The site owner sees your name, organisation, role, segment, country, topics and the state of your membership in a private dashboard, and your role, segment, country and topics next to a question or call request you send. The record is kept until you delete your account.

Your email address is never stored as plain text. It is kept in two forms: a keyed one-way hash, used to find your account when you sign in, and an encrypted copy, used to send you email, to show you your address on your account page and in your data export, and to let the site owner reveal it in the private dashboard. The site opens the copy only for those uses. Before it is hashed, the address is put in one standard form: capital letters become small, and a "+" tag before the "@" is removed, so name+news@example.com and name@example.com are the same member; email still goes to the address you typed. Once you have had a trial, the site also keeps a one-way hash of the address in that form, with the dots removed from a Gmail address, for 400 days, also after the account is deleted, so that each person has one trial.

You sign in with your email address and a password; the site keeps only a salted one-way hash of it until you change it or delete your account. A one-time code is emailed only to confirm your address, when you join, change your password or forget it. Cookies named __Host-acw_mem_ch, __Host-acw_mem_join and __Host-acw_mem_acct (joining, the waiting list, changing your email address or password, deleting the account) and __Host-acw_mem_reset (choosing a new password) tie the code to your browser for 10 minutes. While a code is pending, the site keeps a keyed one-way hash of the code and of your address (when you join, also a salted hash of the password you chose) for 10 minutes at most, and the abuse counters described above apply. When you sign in, or confirm your address as you join, the site sets a session cookie named __Host-acw_mem. It holds a random session identifier and a signature, and no personal detail. It keeps you signed in, lasts 30 days from your last use and never more than 90 days from when you signed in. Signing out removes it. When you enter a correct emailed code, the site also sets a cookie named __Host-acw_mem_dev on that browser, which lasts 180 days. It holds a random value and a signature, and no personal detail. Its only use is to recognise a browser that has signed in before, so that a stranger asking for codes for your address cannot use up your allowance. Every member cookie is sent only to this site and cannot be read by scripts on the page. For each signed-in device the site keeps a session record: the session identifier, your member identifier, when it started and when it ends, a coarse label for the type of device and browser, and whether it has been signed out. It holds no IP address. You can see your sessions on your account page and end any of them. A session record expires when its time is up.

While the members area is on, your browser keeps three small things for it. In local storage, a record named acw_sync that says this browser belongs to a signed-in member and, if you turned syncing on, the list of pages last synced and the pages you removed in the last 30 days. In session storage, a one-letter marker named acw_sync_me that says whether you are signed in, gone when you close the tab. In local storage again, the date of your last visit to the member home, named acw_mem_seen, used to show what is new since then. None of them holds an identifier or your address.

When you ask Shawn a question, the site stores your question, the topic, the context you add, the saved page or diagnostic result you chose to attach (only if you attach one; for a result, its answers and a summary), whether you allowed an anonymised publication, the time, its status, and the answer once it is ready, together with your member identifier. Only you, in the member area, and the site owner, in a private dashboard, can read them. They are kept for 400 days from the day you ask. A monthly record of the tokens you have spent, and of any extra tokens the owner gave you, holds no text and is kept for 400 days. The email that tells you an answer is ready carries a link, never the question or the answer. A question and its answer appear in the answers library only if you ticked the consent box when you asked and the site owner has published them after removing your name, organisation and any detail that identifies you; the published text is kept on the same record, so it is deleted with it when you delete your account or when the 400 days end, and you can withdraw your consent, which unpublishes it.

When you ask for a briefing call, the site stores the topic, what you want to cover, three preferred times, your time zone, the format you chose, any page or diagnostic result you attach, the status and the time, together with your member identifier. Only you and the site owner can read them. They are kept for 400 days from the day you ask.

Syncing is off unless you turn it on from your account page. If you turn it on, the site keeps your reading list and your diagnostic results, as saved in your browser, under your member identifier so they follow you to your other devices. They are kept until you turn syncing off and choose to delete the synced copy, or you delete your account. Without syncing, they stay in your own browser and are not sent to the site.

The weekly digest is sent only if you ticked it. It lists new research and the topics of newly published answers, goes out at most once a week, and carries a link that turns it off. The site keeps a record of when it last sent you one and which research it named, for 400 days from the last send; you can turn the digest off on your account page.

If membership is by invitation, an invitation is a single-use code, and it can carry complimentary access or an offer. The site keeps only a one-way hash of it, with its dates and the identifier of the member who used it, for 14 days. It does not hold the address the invitation was sent to. If membership is closed, you can leave your name, email address and the same optional details on a waiting list. The site first emails a code to the address to show it is yours, and then keeps the entry, with the address encrypted, for 365 days. The site does not mail the waiting list by itself. The newsletter box on the join form is stored as a yes or no, as it is when you unlock content.

The site counts joins and questions as plain numbers, and counts members by state, for example how many are in a trial. A count holds no name, email address or question text. Member pages are kept out of search engines and out of the site's search. The member home, sign-in, join, account and plans pages do not load the measurement described above; the other member pages do, under the same rules, including Do Not Track and your choice on the notice.

Paid plans exist only while paid membership is switched on. Paid membership is paid through Stripe, which processes the payment for ACW. When you start a plan, your browser goes to a Stripe page and you give Stripe what it asks for, such as your name, email address, card details and billing address, and the site gives Stripe your email address, your member identifier, your plan and any offer so that it can set up the subscription. Stripe collects your card when the plan starts and charges it when any free trial ends. Your card details never reach this site. Stripe holds your payment details, payment history and invoices, and its own privacy policy applies to what it does with them. The site stores only your Stripe customer and subscription identifiers, your plan, the offer you used, and the dates your trial and current period end. It receives notices from Stripe about whether a payment went through and whether your subscription is active, past due or canceled, and keeps the identifiers of those notices for 30 days so that none is counted twice. The billing portal, which you open from your account page to cancel, change your card or see your invoices, is a Stripe page too. To open it, the site gives Stripe your Stripe customer identifier and nothing else about you.

From your account page you can download everything the site holds about you as one file, and delete your account. Deleting needs a code sent to your address. It removes your member record, your sessions, your questions and any answer published from them, your token records, your call requests, your synced list, your digest record, any waiting list entry for your address, pending codes, and the mail log rows and retry copies of your address. If you have a live subscription, the site ends it first, and the deletion does not go ahead if it cannot. Two things stay: the one-way hash that stops further email, and, if you have had a trial, the trial marker for 400 days. Stripe keeps its own payment records under its own policy. Mail log rows written to an earlier address are not found from your account; they expire after 90 days.

The Blind Spot Map

This section applies only while the Blind Spot Map is switched on, and it needs the members area to be on too. While it is off, the tool's pages and routes answer as if they do not exist, and none of what is described here is stored.

The Blind Spot Map is a tool for members. For each assessment you create, the site stores its name and your company's name, the settings you choose, the relationships you enter (the counterparty, its role and segment, the scope and level of evidence, and dates), the requirements you add, the versions of the assessment, and the reports and exports made from it. If you upload a workbook, the site also keeps a record of the upload with its size, a hash of the file and its name. To find your assessments, it keeps a record that links a one-way reference derived from your member identifier to a random identifier for the tool.

This content is kept in a separate Cloudflare database (D1) and in private Cloudflare storage (R2), apart from the member records described above. Before it is stored, the name and company of each assessment, every relationship and requirement, the name of an uploaded file, and each report, export and uploaded file is encrypted with a key that belongs to you alone, and that key is itself encrypted under a secret the site holds. Identifiers, states, dates, sizes and counts are stored as they are.

An uploaded workbook is checked for safety before anything is read from it. As part of that check, the file is sent over an encrypted connection to a malware scanning service: Cloudmersive, or Scanii if the site switches to it. The file goes without your name or any other detail about you or your assessment, and the service tells the site only whether the file is safe. Both services state that they do not keep the file once the check is done; Scanii keeps a record of the check (the file size, a checksum and the result) for up to 400 days. The original is kept, encrypted, in a private bucket for 30 days after the upload and is then deleted, whether it was accepted or not. What the site read from an accepted workbook stays in your assessment until you change or delete it.

When you delete an assessment, its content, its reports and the originals of its uploads are removed. When you delete your account, the site first destroys your key, which makes everything of yours in the tool unreadable at once, and then removes the assessments and files. If you ask for deletion through the contact form, the same happens.

The site keeps a log of actions in the tool, such as creating, submitting, sharing, exporting or deleting an assessment. A line holds an identifier, a role, the action, the time and the result, and never a name, a company or any content. Lines cannot be changed once written, and they stay when an assessment is deleted. They stay for as long as your account exists and for 12 months after it is deleted, and are then removed.

Nothing in the tool is shared unless you share it. A share names who may open an assessment, what they may do and when it ends, and you can revoke it at any time.

If you choose a handle for the Blind Spot Map, we store it with your workspace so that other members can share an assessment with you or mention you by typing it; it is shown to people on a share with you, is never an email address, and is deleted when you remove it or erase your tool data.

If you buy the Blind Spot Map, the site keeps a small record in the members store: your plan, its status, when the paid period ends and the Stripe identifiers of your customer and subscription. It holds nothing about any assessment and is deleted with your account.

The file you download from your account page includes your Blind Spot Map content, in readable form, and so does a copy requested through the contact form. The keys that protect your content are not part of either.

This section covers entering data in the form and uploading a workbook. The AI assistance option of the tool is not available. Nothing you enter in the tool is sent to an AI model or to any outside service other than the Cloudflare storage described above and, for an uploaded workbook, the malware scanning service named above, and the site will describe that option here before it is switched on.

Quarterly Executive Briefings

This section applies only while the Quarterly Executive Briefings are switched on. While they are off, their pages and files answer as if they do not exist, and none of what is described here happens.

When you open or download a Quarterly Executive Briefing that is for members only, we keep a record of which briefing it was, the date and your member ID, so we can protect the briefings from misuse.

We also count opens and downloads of every briefing, with no name, address or other detail about the reader. We use these counts to see which briefings are read and how they were received, to decide what future briefings should focus on, and to improve them.

The research assistant

This section applies only while the research assistant is switched on. While it is off, the Ask the research panel is not shown, the assistant answers nothing, and none of what is described here happens.

The research assistant sends the question you type to Cloudflare Workers AI, which turns it into numbers to find matching passages of ACW's published research in a Cloudflare index, and then, together with up to six of those passages, to a Cloudflare Workers AI model that writes a short answer with sources. When the day's free allowance is used up, or the model does not answer, the site shows the matching passages as they were written and sends nothing to a model. The passages are only text ACW has published for everyone to read: gated, members-only, draft and private text is not in the index. ACW does not store your question or the answer. Cloudflare states that it does not use this content to train the models on Workers AI.

For the assistant the site keeps daily counts of answers, refusals, falls back to search and failures, the length range of the questions (for example 26 to 100 characters) and the time range of the answers (for example 1 to 3 seconds), and the day's totals against its budget. They are plain numbers with no name, address, identifier or text. With Do Not Track or Global Privacy Control on, the question is still answered, but nothing about it is added to those counts. To stop abuse and spend, short-lived counters under one-way hashes of your network, as described above, also limit the assistant to three questions a minute, ten an hour and 30 a day from one network; they still apply with Do Not Track on.

If you press Understood on the assistant's notice, your browser remembers that in local storage under the name acw_assistant_notice. It holds the value 1 and no identifier and no question; clear it to see the notice again.

In the members area the same assistant limits each member to a set number of questions a day, which the site owner sets. The site counts them under a one-way hash of the member identifier, which expires with the day, and keeps no question and no answer. Members with no allowance see no assistant.

Explained ratings and comments

On the ACW Explained pages you can rate an episode or an interactive explainer from one to five stars, and members with full access can also read and write comments. Ratings and comments are described here; the rating cookie is the only cookie the ratings use.

A rating is stored with the item, the number of stars and a random anonymous identifier, and nothing else: no name, no email address and no IP address. When you press a star, the site sets a cookie named __Host-acw_rt. It holds that random identifier and a signature, and no personal detail. It lasts one year, is sent only to this site and cannot be read by scripts on the page. It is set only when you press a star, and it lets you change your rating later and keeps you to one rating for each item. If you are signed in as a member, your rating is filed under your account instead, by a keyed one-way digest of your member identifier, so it follows you to another browser, and no cookie is needed. A rating is kept for 400 days from its last change. To stop repeat ratings, the site counts ratings for each item and network for a day under a keyed one-way digest of the network, and stores no IP address. The page shows an average only once an item has five ratings.

This part applies only while the members area is switched on. A comment is stored with the display name you choose, the text you write (plain text, up to 1,000 characters, no links), the time, a waiting or visible status and the identifier of your member account. Other members see the display name, the text and the date, never your account name or email address. The site owner sees the identifier in a private dashboard so a comment can be traced to an account. You can edit and delete your own comments at any time. A member can report a comment, which stores the short reason given and a one-way digest of the reporter's identifier. The site owner can approve, hide and restore comments, and a member's first comment waits for approval unless the owner has changed that. A comment is kept for 730 days from when it was posted, or until you delete it or delete your account; deleting your account removes your comments and your rating filed under the account.

Email, and who handles it

The site sends email through Resend, an email delivery service. Resend receives the address and the text of every email in order to deliver it: the one-time codes, the content emails, the notices and digest sent to members, and the copy of each inquiry sent to the site owner. Resend also tells the site whether each email was delivered, bounced or drew a complaint.

The copy sent to the site owner holds the inquiry in full: the name, organisation, email address, interest, timeline, budget and message, and any page reference or review result you attached. It sits in the owner's mailbox, outside the stored record, so the one-year expiry does not apply to it.

For content emails only, never for one-time codes, the site also keeps a retry copy for 3 days, in case the first send soft-bounces and needs one more try. It holds the content title and the page link as they are, and your email address and the signed download link as encrypted text, together with a keyed hash of the address. It is deleted when the email is reported delivered, complained about or bounced, and in any case after 3 days. The download link inside it works for 7 days and up to 5 uses, and the site keeps a record of each link (the file, its expiry and how often it was used) for 7 days.

Emails the site sends are logged for 90 days with a one-way hash and a masked form of the address, never the message itself. If an address bounces or complains, only a one-way hash of it is kept, so that nothing is sent to it again. If it unsubscribes, the hash stops content emails and digests, and codes you ask for still arrive.

The records described on this page are held in Cloudflare's key-value storage (Workers KV), run by the same provider that hosts the site.

Copies and deletion

You can ask through the contact form for a copy of everything held about your email address, or for it to be deleted. The site owner then deletes it by hand: inquiries, unlock records and grants, download links, pending codes, mail log rows and retry copies, and any member record; only the one-way hash that stops further email is kept. Deleting the stored records does not remove the copy of an inquiry emailed to the site owner, which sits in the owner's mailbox.

Questions about any of this can go through the contact form.