Data Protection Policy

1Collect as little as possible

Every field on this site had to earn its place. The newsletter asks for an email address and not a name, because a name is not needed to send an email. The prayer builder stores nothing at all, because there was no reason for me to keep a man's prayer.

Information that is never collected cannot leak, cannot be subpoenaed, and cannot be sold by whoever owns this domain in ten years. That is the whole strategy.

2Who can reach it

I can. Nobody else. There are no staff, no contractors with logins, and no shared account.

The private area of this site is behind a password, and its session expires. The database is not exposed to the public internet for browsing, and the credentials for it and for every outside service are stored encrypted rather than as plain text.

The site's source code is public on GitHub, which is deliberate. Anyone can read exactly what it does with your information. No password, key, or database contents are in that code.

3Where it is stored

The site and its database run on Railway, in a data centre in the western United States.

If you are writing from outside the United States, your information is being handled in the United States, which may have different protections than your own country. Using a form here is your agreement to that.

4The full list of companies involved

Four, and no more. Each is named with the one job it does.

Railway. Hosting for the site and the database.

Resend. Email delivery for contact messages and for prayers sent back to the reader.

Microsoft Clarity. Analytics and session recording, described in section 4 of the Privacy Policy.

GoHighLevel. The mailing list, holding only addresses given through the pop-up on blog posts.

There is no advertising network on this site, no tracking pixel from any social platform, no comment system, no chat widget, and no embedded video. Those are the usual places a visitor's information quietly escapes, and none of them are here.

5Writing that touches hard things

I write about suicide, addiction, grief, and men who are struggling. That means people arrive here in bad moments and sometimes write to me from inside one.

Two decisions follow from that. The prayer builder keeps no copy of anything, so a man can write the worst sentence he has and it exists only in the email he sent himself. And both the contact form and the prayer builder are hidden from the analytics recording, so what is typed there is never captured.

If you write to me about something heavy, that email sits in my inbox and I treat it as private. I do not forward it, publish it, or quote it in my writing without asking you first.

6How long things are kept

Mailing list addresses are kept until you ask to be removed. There is no automatic deletion running on a schedule, and I would rather say that plainly than imply a process that does not exist.

Contact emails are kept in my inbox until I delete them.

Prayers and IP addresses are not retained at all.

7If something goes wrong

If I find out that information held here has been exposed, I will say so. I will email the people affected, I will publish a note on this site, and I will say what happened and what I did about it. I will not wait to be asked and I will not phrase it to sound smaller than it was.

Because the only visitor information stored here is email addresses, the realistic worst case is that a list of addresses gets out. That is bad and I would rather it never happened, which is the reason the list is the only thing kept.

8Asking to see or delete your information

Write to [email protected] and tell me what you want: a copy of what is held, a correction, or deletion.

I aim to answer within a few days and to finish within 30 days. Since the most I hold about anyone is an email address and a date, this is usually a same-day job.

I will not ask you to justify the request or try to talk you out of it.