01
The short version
- We only ask for information we actually need.
- We never sell it and we never trade it.
- You can email us any time and ask what we hold, or ask us to erase it.
- The store, customer accounts and personalized video requests are not open. Parts of this page describe what will happen when they are, and say so plainly.
02
What we collect right now
Today the site is simple, so there is very little.
- The contact form. Whatever you type into it. That is normally a name, an email address and a message.
- Newsletter signups. Your email address, so the newsletter has somewhere to go.
- Ordinary web traffic. The site is hosted by Cloudflare. Like every web host, Cloudflare handles the request your browser makes, which includes your internet address, so the page can reach you and so the site can defend itself.
That is the whole list. No account, no basket, no order, no card.
03
Every single thing, one at a time
The sections above are the summary. This is the whole of it: every piece of information this site handles, what happens to it, why we are allowed to, and how long it stays. Nothing is left out to keep the page short.
It is generated from the same file the code reads, so it cannot quietly fall behind what the site actually does. If a form starts asking for something new, it appears here on the same day.
When you send a message through the contact form
So a real person can read what you wrote and reply to you.
What is collected
- Your name, as you typed it
- Your email address
- The topic you chose from the list
- Your subject line, if you wrote one
- The message itself
Where it goes
A row in our own database, which is Cloudflare D1. The columns are name, email, subject, message, topic, a status the owner updates as it is dealt with, and the time it arrived.
Not your IP address, not your browser, not your device, not the page you came from. None of those are written down.
Why we are allowed to
We need it to run the site sensibly, and it does not override your rights.
A message about buying something is handled under Article 6(1)(b) instead, because answering it is a step you asked us to take before a purchase.
Article 6(1)(f), legitimate interests
How long it is kept
No period has been decided yet, and we would rather say so than print a number nobody has agreed to.
Also seen by Resend and Google LLC, each of which is doing a job for us and none of which may use it for anything else.
When you join the mailing list
So we can email you when there is something worth emailing about.
What is collected
- Your email address
- A note of which form you used, so we know where people are joining from
Where it goes
A row in Cloudflare D1 holding your address, a lowercased copy of it used to stop the same address joining twice, a one time confirmation token, a permanent unsubscribe token, and the times you joined, confirmed and left.
Not your IP address and not your name, because the form never asks for either.
Why we are allowed to
You asked for it, and you can change your mind at any time.
The list is double opt in. Your address is stored the moment you submit the form, and nothing is sent to you as marketing until you open the link in the confirmation email. You can withdraw consent at any time from the link in any email.
Article 6(1)(a), consent
How long it is kept
No period has been decided yet, and we would rather say so than print a number nobody has agreed to.
One part of this is decided. If you unsubscribe, the row is kept rather than deleted, with the date you left recorded on it. That is not us hanging on to you: a deleted row would let the same address be added again by mistake, and keeping it is what makes the opt out stick. Ask us to delete it outright and we will.
Also seen by Resend, each of which is doing a job for us and none of which may use it for anything else.
The bot check on both forms
To tell a person apart from a script, without making you solve a puzzle.
What is collected
- Your IP address
- A token the bot check widget creates in your browser
Where it goes
Nothing. We do not write either of these down. They are sent to Cloudflare, which answers with a yes or a no, and that answer is all we keep long enough to act on.
Why we are allowed to
We need it to run the site sensibly, and it does not override your rights.
Without it both forms fill up with automated submissions within days, and the newsletter becomes a way of sending confirmation emails to addresses that never asked for them.
Article 6(1)(f), legitimate interests
How long it is kept
No period has been decided yet, and we would rather say so than print a number nobody has agreed to.
Nothing to keep, because nothing is stored on our side.
This is the one place your IP address leaves this site. It goes to Cloudflare as part of the check and nowhere else.
Also seen by Cloudflare, Inc., each of which is doing a job for us and none of which may use it for anything else.
Stopping one person from flooding a form
So one script cannot send ten thousand messages and bury the real ones.
Where it goes
A one way hash of it, never the address itself. The address is combined with the name of the form, run through SHA 256, and cut to the first 128 bits. What is written down is that string and a count, in Cloudflare KV, and it deletes itself once the time window has passed.
The IP address itself is never written to storage anywhere on this site.
Why we are allowed to
We need it to run the site sensibly, and it does not override your rights.
A hash cannot be turned back into an address. It exists so that two submissions from the same place can be recognised as the same place, which is the whole of what a rate limit needs to know.
Article 6(1)(f), legitimate interests
How long it is kept
Minutes. The counter is given a lifetime slightly longer than the window it guards, and Cloudflare removes it automatically when that expires.
When we send you an email
To send the confirmation, acknowledgement or newsletter you asked for.
What is collected
- The address we are sending to
- What the email says
Where it goes
A line in our own log recording the address, which template was used, the subject, whether it was sent or failed, the id our email provider gave it, and when. It exists so the owner can tell whether a message you were expecting actually went out.
No open tracking, no click tracking, no tracking pixel. We do not know whether you opened anything.
Why we are allowed to
We need it to run the site sensibly, and it does not override your rights.
For marketing email the basis is your consent, and the unsubscribe link in every one of them is how you take it back.
Article 6(1)(f), legitimate interests
How long it is kept
No period has been decided yet, and we would rather say so than print a number nobody has agreed to.
Also seen by Resend, each of which is doing a job for us and none of which may use it for anything else.
Simply visiting the site
To serve you the page, and to keep the site up.
What is collected
- The usual things any web server receives: your IP address, the page you asked for, the time, and what your browser says it is
Where it goes
Nothing by us. Cloudflare handles these as part of hosting and applies its own retention, and we do not have a copy of them in any database of ours.
Why we are allowed to
We need it to run the site sensibly, and it does not override your rights.
A web server cannot answer a request without knowing where to send the answer.
Article 6(1)(f), legitimate interests
How long it is kept
No period has been decided yet, and we would rather say so than print a number nobody has agreed to.
Set by Cloudflare, not by us. Their policy is linked below.
Also seen by Cloudflare, Inc., each of which is doing a job for us and none of which may use it for anything else.
And here is what we never collect
- No analytics of any kind. No Google Analytics, no Plausible, no Fathom, nothing counting your visit.
- No advertising, no ad networks, no retargeting, no conversion pixels.
- No profiling, and no automated decision making that has any effect on you.
- No location data beyond the IP address that any web server receives.
- No special category data. We never ask about health, beliefs, politics, ethnicity, sex life or anything similar, and you should not put any of it in the message box.
- No payment details, because there is nothing to buy yet.
- No account and no password, because there is no way to sign in yet.
- No social media buttons or embeds, so no other company learns which pages you read here.
- No fonts, scripts or images loaded from anybody else, apart from the bot check widget. Everything else is served from this site.
04
Your IP address
Every device on the internet has an address, and yours is sent to any website you visit, because otherwise the page has nowhere to go. That much is unavoidable and true of every site you have ever opened.
What matters is what a site then does with it, so here is exactly what this one does, in all three cases.
- When you submit either form, your address is sent to Cloudflare as part of the check that tells a person apart from a script. This is the one moment your address leaves this site, and it goes to Cloudflare and nowhere else.
- To stop one person flooding a form, your address is scrambled with a one way hash the instant it arrives, and only the scrambled version is written down, alongside a count, in storage that empties itself within minutes. The scrambling cannot be undone.
- Simply loading a page, your address reaches Cloudflare because it is the server answering you. We keep no copy of it.
Your IP address is never written into any database of ours in a form we could read back. Not against your message, not against your subscription, not anywhere. There is no column for it, which is a stronger promise than a sentence in a policy: there is nowhere to put it.
05
Where that information lives
Messages and newsletter signups are saved in a small database run by Cloudflare, called D1. It sits behind the website and is not open to the public. A copy of each contact message is also sent to us by email through a company called Resend, so a person actually sees it.
Both forms are protected by Cloudflare Turnstile, a bot check. Its job is to tell a person apart from a script, which is what stops the inbox filling with junk.
We do not sell your information. There is no version of this where we do.
06
What we would collect later
These are plans. None of it is being collected today, because none of these features exist yet.
- Orders, if the shop opens. A name, an email address, the address the parcel goes to, and what was ordered.
- Payments, if the shop opens. Payments would run through Stripe. Your card number would go straight to Stripe. This site would never see it and never store it.
- Custom video requests, if they open. The details that make the video make sense: names, how to say them, the occasion, and the message you want in it.
- Customer accounts, if they open. An email address and a way to sign in.
On the day any of this becomes real, this page changes first.
07
Why we collect it
Only to do the thing you asked for. A message so we can reply. An email address so the newsletter arrives. Nothing is gathered because it might be handy one day.
We do not sell your information. We do not trade it. We do not hand it to advertisers.
08
How long we keep it
We keep information for as long as it is useful for the reason you gave it, and then we let it go. If you ask us to delete something sooner, we will.
Owner suppliedThe exact length of time contact messages and newsletter records are kept. No number is written here, because none has been decided, and a guessed retention period is a promise waiting to be broken.
09
Who else touches it
A few companies help run the site. Each one gets only what it needs, and each publishes a privacy policy of its own that you are welcome to read.
- Cloudflare. Hosts the site, serves the pages, runs the D1 database the forms write to, and runs the Turnstile bot check.
- Resend. Delivers our email. Mail from us arrives from info@potatoandhash.com.
- Stripe. Would handle payments if the shop opens. Not in use today, because nothing is for sale.
10
Information leaving your country
Everyone who helps run this site is a company in the United States, so information about you reaches the United States. That is worth saying plainly rather than burying, because if you are in the United Kingdom or the European Union it is something you have a right to know before you type anything in.
- Resend, in the United States. Delivers the emails this site sends. Their privacy policy.
- Google LLC, in the United States. Runs the inbox that receives messages sent through the contact form. Their privacy policy.
- Cloudflare, Inc., in the United States. Hosts the site, serves it, runs the database, and provides the bot check. Their privacy policy.
Each of them publishes terms covering transfers of this kind. The agreements have not been signed yet, and until they are, this page will not claim a safeguard that is not in place. It is listed under still to be supplied, further down, so it cannot be quietly forgotten.
11
Analytics
There is no analytics on this site. No measurement code is installed, no measurement account is connected, and nothing is counting your visit.
If that ever changes, we would say so here, in plain words, on the day it happened. Analytics counts the crowd, not you, and we would never use it to work out who you are.
12
Cookies and the bot check
A cookie is a small note a website leaves in your browser so it can remember something later. This site sets no advertising cookies and no analytics cookies.
The Turnstile bot check on our two forms is run by Cloudflare and looks at signals from your browser to decide whether you are a person. The cookie page goes through all of this properly.
Read the cookie page
13
Seeing it, or deleting it
These are yours under United Kingdom and European Union data protection law. In practice we will do all of them for anybody who asks, wherever you live, because sorting people by jurisdiction before deciding whether to respect them is not a way we want to run anything.
- See it. Ask for a copy of everything we hold about you.
- Fix it. Tell us something is wrong and we will correct it.
- Delete it. Ask us to erase it. We will, unless a law says we have to keep it.
- Pause it. Ask us to stop using it while something is being sorted out.
- Take it with you. Ask for it in a form you can hand to somebody else.
- Object. Tell us to stop using it where we rely on legitimate interests.
- Change your mind. Withdraw consent at any time. It does not undo anything already sent, and it stops everything after.
- Complain. Take it to your data protection authority. In the UK that is the Information Commissioner. In the EU it is the authority where you live.
To use any of them, write toinfo@potatoandhash.com. There is no form to fill in and no fee. We may need to check that the request really comes from you, which for an email address usually means replying from it.
We will answer within one month. If a request is genuinely complicated we may take longer, and if we do, we will tell you why before the month is up rather than after.
14
If you live in California
California law gives you a specific set of rights and asks for a specific set of disclosures. Here they are. Most of this section is short, because most of what the law exists to control is not happening here.
We do not sell or share your information
Not for money, and not for anything else of value. We have not in the twelve months before this page was written, and we have no plans to. That is why there is no Do Not Sell or Share link on this site: there is nothing behind it to switch off.
It is easy to say and worth explaining why it is true. Selling information requires somebody to sell it to, and the machinery for that is advertising technology and analytics. There is none of either here. The only company whose code runs in your browser on this site is Cloudflare, for the bot check, and it is not being paid in data.
What is collected, in the categories the law uses
Identifiers
Your name and email address, if you use a form. Your IP address, which reaches our host on every request.
Where it comes from: You, directly. The IP address comes from the connection itself.
What it is used for: Answering you, sending what you asked for, and keeping the forms usable.
Who else sees it: Service providers only: our host, our email provider, and the inbox provider.
Internet or network activity
The page requested and the time, handled by our host as part of serving it.
Where it comes from: The connection itself.
What it is used for: Serving the page and keeping the site up.
Who else sees it: Our host, as a service provider.
No sensitive personal information is collected. We never ask for it, and there is no field on this site that requests it.
What you can ask for
- Know what is collected, used and disclosed, and get a copy.
- Delete what we hold, with the narrow exceptions the law allows.
- Correct anything inaccurate.
- Opt out of the sale or sharing of personal information. There is nothing to opt out of here, because none of it is sold or shared, and that is why you will not find a Do Not Sell link on this site.
- Limit the use of sensitive personal information. Also nothing to limit, because none is collected.
- Be treated no differently for exercising any of these.
15
Children and families
Plenty of our visitors are kids, and we are glad they are here. Two silly dogs are for everyone.
We do not go looking for information about children and we do not need it. Accounts are not open. If a child has sent us a message and a parent or guardian would like it removed, email us and we will take it out. No explanation needed.
Grown ups: if your child wants to send a drawing or a note, we love it, but please send it from your own email address.
16
Keeping things safe
We keep the pile small on purpose, because the safest information is the information nobody collected. No card number ever reaches this site. We can tell you what the site does, but nobody can honestly promise that any website anywhere is perfectly secure, so we will not pretend otherwise.
17
Changes to this policy
If how any of this works changes, this page changes with it. For a big change, such as switching analytics on or opening the shop, we will say so clearly at the top of this page and mention it in the newsletter.
18
Still to be supplied
This page is honest about being unfinished. These are the pieces only the owner can fill in, gathered in one place so none of them gets quietly forgotten.
Who is legally responsible for your data
A privacy policy has to name the person or company that decides what happens to your information. That name has not been supplied yet, so this page names the site and the email address to write to, and nothing more. Until it is filled in, treat the contact address as the way to reach whoever it turns out to be.
How long each kind of record is kept
No period has been set for contact messages, subscriber records or the email log. We would rather say that than print a number nobody has agreed to. Ask us to delete something and we will, whatever period is eventually written here.
The paperwork behind sending data to the United States
Everyone who helps run this site is a United States company, so information reaches the United States. Each of them publishes terms covering that, and the agreements have not been signed yet. This will say which safeguard is relied on once they are.
Which country’s law applies
A policy has to say whose rules govern it and where a disagreement would be settled. That follows from where the business is registered, which has not been decided, so it is not stated. In the meantime this page gives you the rights that United Kingdom, European Union and California law describe, whichever of them you happen to be covered by.
The date this takes effect
There is no effective date on this page yet, because the site has not launched. It gets one on the day it goes live, and any later change gets its own date beside it so you can see what changed and when.
How quickly a request is answered
One month is the legal maximum and it is what this page commits to. Whether the owner wants to promise something faster than that is a decision nobody has made, so nothing faster is promised.
Which Cloudflare features are switched on
Some of Cloudflare’s security settings store something on a visitor’s device, and which of them are enabled is a dashboard setting rather than anything in this code. This has now been checked against the live site and nothing is being set, which is why the cookie page says none rather than saying maybe. It stays on this list because it is a setting somebody could change without touching the code, and the page would then be wrong until it was checked again.
Not legal adviceThis page was written to be clear and truthful, not to be a finished legal instrument. It has not been reviewed by a lawyer, and nothing on this site claims to be certified or compliant with any privacy law.