Privacy Policy
What we collect, why, and your rights.
Last updated: May 2026
What data we collect
Data you provide
Newsletter subscriptions. If you subscribe to our newsletter, we collect your email address. We do not collect your name unless you provide it. Email addresses are stored in our database (Supabase, hosted on AWS infrastructure) and used solely to send you new reviews and updates. Every email we send includes an unsubscribe link.
Contact form submissions. If you use our contact form, we collect your name, email address, and message content. This data is stored in our database and used solely to respond to your inquiry.
Data collected automatically
Affiliate clicks. When you click an affiliate link, we log the destination slug, referring URL, and a truncated user agent string. We do not log IP addresses or any personally identifying information. This data is used for internal analytics only.
Hosting logs. Our hosting provider (Vercel) maintains standard server access logs as part of normal infrastructure operation. We do not use hosting access logs for behavioral analytics or advertising purposes.
We do not use cookies for advertising, tracking, or third-party analytics. We do not use:
- Third-party analytics scripts (Google Analytics, Mixpanel, etc.)
- Third-party advertising networks
- Session recording tools
How we use your data
| Data | Purpose | Retention |
|---|---|---|
| Email address (newsletter) | Send new review notifications | Until you unsubscribe |
| Contact form submissions | Respond to your inquiry | 12 months |
| Affiliate click logs | Internal revenue reporting | 24 months |
Data storage and security
Your data is stored in Supabase, a PostgreSQL database service hosted on Amazon Web Services infrastructure in the United States. Supabase is SOC 2 Type II certified.
Data in transit and at rest is encrypted using industry-standard encryption practices.
International transfers. If you are located outside the United States, your information may be transferred to and processed in the United States, where our infrastructure is hosted.
Legal basis for processing (EEA users)
We process personal data on the following bases:
- Consent — newsletter subscriptions, where you have opted in
- Legitimate interests — responding to contact form inquiries, maintaining and improving the site, and internal affiliate revenue reporting
- Legal obligation — where required by applicable law
Your rights
Under GDPR (EEA residents): You have the right to access, correct, port, restrict, and erase your personal data. You also have the right to object to processing and to withdraw consent where processing is based on consent.
Under CCPA (California residents): You have the right to know what personal information we collect, to delete it, and to opt out of its sale. We do not sell personal information.
To exercise any of these rights, contact us with the subject line "Privacy Request." We will respond within 30 days.
Data sharing
We do not sell, rent, or share your personal data with third parties for their marketing purposes.
We share data only in the following circumstances:
- With Supabase as our data processor (covered by their Data Processing Agreement)
- With Vercel as our hosting provider for normal infrastructure operation
- When required by law or to comply with valid legal process
Children
This site is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, contact us.
Changes to this policy
We will post changes to this policy on this page with an updated "last updated" date. For material changes, we will notify newsletter subscribers by email.
Contact
Privacy questions: contact us with the subject line "Privacy Request."