I'd honestly rather not have your data.

If you subscribe, I have your email address. I use it to send you issues of the newsletter. That is the entire list of things I do with it.

I don't sell it. I don't rent it, trade it, or hand it to a partner. There is no list-swap arrangement with another newsletter, and there never will be — that's the same policy as no sponsors and no affiliate links, applied to you instead of to money.

One click unsubscribes you, and there's no exit survey waiting on the other side.

Ghost, which sends the newsletter, records whether an email was opened and which links were clicked. I have it on, and I want to be straightforward about why: it tells me whether an issue landed in inboxes at all rather than in spam, and which links were worth including.

I don't look at it per-person. I have never opened a subscriber record to see what one individual read, and I can't think of a reason I'd want to.

Open tracking works by loading a tiny invisible image. If you'd rather it didn't, most email apps have a setting to block remote images — turn it on and the tracking simply doesn't happen. That works on every newsletter you receive, not just this one.

Ghost keeps basic first-party analytics: which pages were viewed, roughly where in the world from, and what linked here. It doesn't follow you across other websites and it doesn't build a profile of you.

There's no Google Analytics on this site, no Meta pixel, no advertising trackers of any kind. That isn't an oversight — it's the reason there's no cookie banner nagging you on arrival.

I look at this data to see whether a piece got read. I have never done anything else with it, and there is nothing else I want to do with it.

One more thing, for completeness: two of Ghost's own scripts — the subscribe box and its built-in search — are served from jsDelivr, a public code CDN, on every page. Loading a file from any server tells that server your IP address, and this is no different. They set no cookies, and nothing about it comes back to me. It's a dull fact rather than a worrying one, but this page is meant to be the whole list.

The footer's "you are visitor" number is real, and it's the one other thing this site counts. Here is everything it does: a little database holds a single number, and your first page view of a session adds one to it.

Nothing about you is sent or stored — no IP address, no identifier, no cookie. Your own browser remembers it already counted you this session, so clicking through five pages doesn't inflate it. If the counter can't load, it hides rather than making a number up.

The contact form lets you leave your name and email blank on most kinds of submission. That isn't a technicality. If you send me a job to rate without telling me who you are, I genuinely do not know who you are, and I can't find out later.

If you do give me a name or an address, I use it to reply to you and nothing else. Submissions are credited as reader-submitted unless you ask to be credited by name.

When you send the form it goes to api.supporthuman.cx/contact, which is a corner of this domain, not somebody else's. Your browser never talks to a form company: there's no third-party script on the page and nothing to load. That little program checks the message over, hands it to Resend to deliver as an email, and keeps no copy. There's no database behind it and no dashboard I can log into — once it's sent, the only place your message exists is my inbox.

Resend is an email service, so it handles your message on the way to me, the same way any mail provider does. They don't sell it and they aren't building a profile on you. If I ever swap them out, the new name shows up here the same day.

If you support Support Human financially, Stripe or Buy Me a Coffee handles the payment. Your card number goes to them, never to me — I could not see it if I tried.

What I can see is roughly what you'd see on a receipt: that a payment happened, for how much, and the email attached to it. That's what I need to know your subscription is active, and it's all I keep.

Sometimes I use video in the newsletter. TikTok and Instagram embeds don't run until you press play — their player and the cookies that come with them are not in the page until you ask. What you see before that is a placeholder built here, and it tells you exactly what pressing play loads.

YouTube videos load through YouTube's no-cookie address. Vimeo doesn't have one, so its player gets a do-not-track flag instead — a different mechanism, same intent. Their players do load with the page, but nothing plays until you choose, and nothing autoplays anywhere on this site.

Every cited video also comes with one sentence of mine saying what happens in it, so you never have to play a video — or load anyone's player — to follow the argument.

Comments run on Ghost, the same software as the rest of the site — so they don't go to a third party at all. Your name and comment sit in the same place as everything else here.

You can read every comment without an account. Leaving one means being subscribed, since that's the account the comment attaches to.

Episodes are hosted by Captivate, which counts downloads the way every podcast host does — IP address, app, rough location — because that's how podcasting works at a technical level.

I see aggregate numbers. There is no subscriber list for a podcast feed and no way for me to know who you are.

If I ever end up with access to something I shouldn't have, or a service I rely on has a breach that touches your data, I'll tell you promptly and plainly — what happened, what was exposed, and what I'm doing about it.

No waiting to see if anyone notices. No paragraph buried in an unrelated email. It would be an actual message, sent because you're owed one.

You can ask me what data I hold about you, ask for a copy of it, ask me to correct it, or ask me to delete all of it. You can tell me to stop emailing you. You don't need a reason, and asking never affects what you can read — nothing on this site is gated.

Depending on where you live, some of that is a legal right rather than a courtesy: the GDPR covers readers in the UK and EU, the CCPA covers readers in California, and the Colorado Privacy Act covers readers here in my own state. They're named so anyone searching for them can find them.

I don't plan to check which one applies to you before answering. If you ask, you get it — the law is just a nice wingman if you need one.

There is no data protection officer to write to, because there is no department — there's me. Email me and I'll just do it. If you want everything deleted, say so and it's gone; I'd rather that than keep data belonging to someone who doesn't want me to have it.

If anything here changes in a way that matters — a new service handling your data, a change in what I collect — I'll update this page and say so in an issue. The date at the top is the last time it changed.