Legal

Privacy Policy

We collect almost nothing about you, we sell none of it, and we host with companies that take privacy as seriously as we do.

TL;DR

• We do not run analytics that track you across the web.
• The newsletter email is the only personal data we collect.
• We never sell, rent, or share reader data. Ever.
• We comply with GDPR (EU), CCPA (California), and PIPEDA (Canada).

What we collect

Newsletter signup

If you choose to subscribe to our newsletter, we store your email address and the date/time of signup. We use this to send you the newsletter (typically 1-2 emails per month). You can unsubscribe at any time using the link in the footer of every email, and we will delete your email within 30 days of the request.

Contact form

If you submit our contact form, we receive your name, email, selected topic, and message. We use this only to reply to your message and delete the submission after 90 days.

Automatic server logs

When you visit our site, our hosting provider (Cloudflare) logs your IP address, the page you requested, and the time of the request. These logs are used for security and abuse prevention only, retained for 30 days, and not shared with third parties.

What we don't collect

• We do not run Google Analytics, Facebook Pixel, or any other cross-site tracking.
• We do not place advertising cookies or use behavioral ad targeting.
• We do not collect biometric, location, or device-fingerprint data.

Cookies

We do not use cookies other than:

• Cloudflare's necessary security cookies (set automatically by Cloudflare to detect bots and prevent abuse).
• A single first-party session cookie if you submit the newsletter or contact form (cleared when you close your browser).

Who we share data with

We share data with exactly three service providers:

1. Hosting & CDN: Cloudflare (privacy details here) — store and serve the website.
2. Email delivery: A transactional email provider (typically ConvertKit, Beehiiv, or Buttondown — confirmed in our footer) — send newsletters.
3. Domain registrar: Namecheap or Cloudflare Registrar — manage the domain name.

We do not share data with Amazon, manufacturers, advertisers, or anyone else. Not for purchase. Not for "audience insights." Not ever.

Your rights

If you're in the EU, California, or Canada, you have the right to:

• Request a copy of the data we hold about you.
• Request deletion of the data we hold about you.
• Object to processing of the data we hold about you.
• Withdraw consent (e.g. unsubscribe from the newsletter).

To exercise any of these rights, email privacy@hearthandhome.example. We respond within 30 days — usually much faster.

Children's privacy

This site is not directed at children under 13 (or under 16 in the EU), and we do not knowingly collect data from children.

Changes to this policy

If we make any material changes to this policy, we will:

1. Post the change on this page.
2. Update the "Last updated" date at the top.
3. Email newsletter subscribers if the change is material.

Contact

Questions about this policy can be sent to privacy@hearthandhome.example.