Privacy

What we store if you subscribe

Exactly these fields, and nothing else. We do not store IP addresses, browser details or open and click tracking.

• a random ID used in your unsubscribe link (instead of your address)
• your email address, lower-cased
• the language you signed up in (English or Chinese)
• whether you have confirmed yet (pending or confirmed)
• a SHA-256 hash of the confirmation link’s token, deleted when you confirm
• when that link expires (48 hours)
• when you signed up
• when you confirmed
• when we last sent you a confirmation email (to limit resends to one per 10 minutes)
• after you unsubscribe, or if an email bounces or is marked as spam: a SHA-256 hash of the address (not the address) so we never mail it by mistake
• why it is on that list (unsubscribed, bounced or complained)
• when it was added to that list
• which monthly digest we sent you (so a re-run never mails you twice)
• the hash of your address for that record
• when it was sent
• the email provider’s message ID
• for each email we send you, a SHA-256 hash of the address (not the address), to cap sending (at most 3 confirmation emails per address a day). Erased when you unsubscribe; the row itself (email type and time only, still counted toward our daily sending limits) is deleted by the daily clean-up once it is 48 hours old
• which email it was (confirmation, welcome or digest)
• when it was sent

How long

Unconfirmed sign-ups are deleted by a daily clean-up once 48 hours have passed since the last confirmation email. The same clean-up also runs on every sign-up, confirmation, unsubscribe, bounce report and digest run.

While you are subscribed, we keep your row. When you unsubscribe, it is deleted from the live database immediately, together with the record of which digests you received. In the send log, the hash of your address is erased at the same time; only the email type and time stay, until the daily clean-up deletes rows older than 48 hours.

Copies outside the live database last longer. Our database host, Turso, keeps point-in-time backups, so a deleted address can remain in those backups for up to 24 hours (on Turso’s free plan; if we move to a paid plan, which keeps 10 to 90 days, this page will say so). Turso does not support overwriting deleted data on disk (SQLite secure_delete); a local SQLite database does, and has it switched on. Resend keeps its log of sent emails, including the recipient address, for 30 days, and its backups for about 7 days more.

The suppression list keeps only the hash of an address, with no expiry, so a bounced, reported or unsubscribed address is not mailed again by mistake. If you sign up and confirm again, an "unsubscribed" entry is removed.

How to unsubscribe

Every email has an unsubscribe link. Open it and press the button, or use your mail app’s built-in Unsubscribe button (one-click, RFC 8058). Either way your address is deleted from our list at once (backup and email-log copies expire as described above). No login, no questions.

Who processes it

Emails are sent through Resend (resend.com), which processes your address to deliver them and tells us about bounces and spam complaints. The database is hosted by Turso, which keeps 24 hours of backups. Rate limiting uses short-lived in-memory counters keyed by a hash, never stored.

Server logs record only event types and counts, never email addresses.