Collect little. Explain it plainly.

Email updates

If you subscribe, the site stores your normalized email address, display email, consent version, date, source path, and limited UTM or referrer-domain context in Cloudflare D1. A sending provider is not connected, and the public response does not reveal whether an address was already present.

Active subscriber email addresses are retained while the subscription remains active, until the subscriber unsubscribes or requests deletion. After unsubscribe, the address is removed from the active subscriber database. Only the minimum suppression information reasonably necessary to prevent unwanted future email may be retained if that becomes necessary after outbound email infrastructure is activated.

Limited source-attribution information legitimately associated with an active subscriber record may remain for the life of that subscription.

Corrections and data requests

The form stores your correction type, message, optional source URL, optional email, page path, date, and review status in D1. Do not submit sensitive information.

Correction submissions are retained for up to 24 months, unless earlier deletion is appropriate or a longer period is reasonably necessary for an unresolved editorial matter. Privacy, deletion, and similar data-rights request records are retained for up to 24 months for operational and compliance recordkeeping.

First-party interaction events

The site records a small allowlist of events such as diagram control use, research filters, source opens, copy actions, and completed forms. Records can include path, time, a numeric control value, and limited UTM or referrer-domain context. They do not include submitted email addresses, free-form page content, or keystrokes.

First-party interaction-event records are retained for up to 13 months. Referrer-domain and campaign or UTM information used for aggregate interaction measurement is also retained for up to 13 months.

Abuse prevention

Form requests use short-lived rate-limit records derived from a one-way hash of an IP address. Raw IP addresses are not written to the application database by these handlers.

Temporary rate-limit and abuse-prevention records are retained for no longer than seven days and are deleted earlier whenever the technical protection no longer requires them. The current implementation removes expired records during subsequent form or event requests.