Privacy

Stackaible is a static website that collects almost nothing. This page is the complete list of "almost" — what we process, why we're allowed to, where it goes, and what you can do about it. No ad trackers, analytics runs cookieless until you opt in, and optional cookies are off until you switch them on.

Who is responsible

The data controller for this site is Stackaible, run by David Bowers (United States). For anything on this page — questions, requests, complaints — email [email protected].

What we process, and why

• Newsletter email address. If you subscribe, your email address goes to Kit (kit.com), the email service that stores our list and sends the letter. Legal basis: your consent (GDPR Art. 6(1)(a)), given by double opt-in — you confirm by clicking the link Kit emails you. Withdrawing is the unsubscribe link in any issue; your address is then removed from the active list. We never sell or rent the list.
• Page analytics. Google Analytics tells us which pages get read. Until you choose "allow" in the cookie banner it runs in Google's consent mode: anonymous, aggregate pings with no cookie and no persistent identifier (legal basis: legitimate interest, GDPR Art. 6(1)(f), in knowing what to write next). Only after you allow does it set its cookies (legal basis: consent). No ads features are enabled either way.
• Optional cookies. Three things on this site set cookies, and only after you choose "allow" in the cookie banner: Google Analytics, Kit's form script on the newsletter page, and the Orbital Drop game embed. The full inventory, with lifetimes, is on the cookies page. Legal basis: consent. Default: off.
• Server logs. Cloudflare, our host, processes IP addresses transiently to deliver pages and block abuse. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) in running a working, secure site. Alongside the analytics above, we read aggregate traffic counts — never cross-site profiles.
• Your cookie choice. Stored as a single value in your browser's localStorage so we don't re-ask on every page. Strictly necessary; it never leaves your browser.
• Payments. Buying a service happens on Stripe's checkout pages, on Stripe's domain, under Stripe's privacy policy. We receive what a seller needs to deliver the work — your name, email, and what you bought — and keep it as business records. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• Affiliate links. Clicking one takes you to the vendor's site, which sets its own cookies on its own domain to attribute the referral — under its policy, not ours. How the money works is in our disclosure.

Where data goes

Three processors touch personal data for us, all based in the United States, and all three are certified under the EU-U.S. Data Privacy Framework (verified 2026-07-12):

• Kit (ConvertKit LLC) — newsletter list and delivery.
• Cloudflare — hosting, DNS, and security.
• Stripe — payment processing.

Transfers out of the EEA, UK, and Switzerland rely on that certification, backed by standard contractual clauses in each provider's data processing agreement. Nobody else gets your data, and nobody gets it for advertising.

How long we keep it

• Newsletter address: until you unsubscribe or ask us to delete it.
• Server logs: handled and expired by Cloudflare on its standard short retention.
• Purchase records: as long as tax law requires.
• Cookie choice: lives in your browser until you clear it.

Your rights

Under the GDPR and UK GDPR you can ask for access, correction, deletion, restriction, or a portable copy of your data, object to processing based on legitimate interest, and withdraw consent at any time without affecting what happened before. Email [email protected] and we'll answer within a month. You can also complain to your local supervisory authority — though we'd appreciate the chance to fix it first.

California residents: we do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of under the CCPA/CPRA. Your rights to know, delete, and correct work through the same email. If your browser sends a Global Privacy Control signal, we treat it as "decline" for optional cookies automatically.

Children

This site is written for business operators and is not directed at children under 16. We don't knowingly collect their data; if you believe a child subscribed, email us and we'll remove the address.

Changes

Material changes to this policy will be dated at the top of this page.