Privacy notice
This site collects very little, and this page says exactly what, why, for how long and who else can see it. Where the honest answer is nothing, we have written nothing rather than padding it out.
This notice explains what personal information Gritwright collects, the reason for collecting it, how long it is kept, who processes it on our behalf and what rights you have over it. It applies to gritwright.com and to the newsletter sent from it, and it is written in the same language as the rest of the site, because a privacy notice nobody can read protects nobody.
Most privacy notices are long because the site behind them collects a great deal. This one is detailed for the opposite reason: when a site collects almost nothing, the only way to prove it is to enumerate what it does not do, name every third party involved, and state the legal basis for the single piece of data that does exist.
The short version
Reading Gritwright requires no account, no login and no consent banner. We do not run analytics, we do not set tracking cookies, we do not fingerprint your device, we do not build a profile of you, and we do not sell or share data with advertisers. The only personal information we ever hold is an email address, and only if you choose to give us one by subscribing to the newsletter.
Everything we collect, in one table
This is the complete list. If a category is not in this table, we do not collect it.
| What | Why | Legal basis | How long |
|---|---|---|---|
| Email address | To send you the newsletter you asked for, and nothing else. | Consent, which you give by subscribing and withdraw by unsubscribing. | Until you unsubscribe, then deleted. |
| Server request logs | To serve pages, keep the site online and block attacks. Held by our host. | Legitimate interests: operating and securing the site. | Short-term, under our host's own retention schedule. |
| Correspondence | To answer you when you write to us, usually about a correction. | Legitimate interests: replying to a message you sent us. | As long as the exchange is useful, then deleted. |
The legal bases above are those set out in Article 6 of the General Data Protection Regulation (official source). Where consent is the basis, it is a real choice: nothing on this site is withheld from you for declining, because there is nothing to withhold.
What we deliberately do not do
A list of absences is unusual in a privacy notice, but it is the most useful thing we can tell you, because each item below is something the overwhelming majority of publishers do.
- No analytics. No Google Analytics, no Plausible, no Fathom, nothing.
- No tracking cookies. The site sets no cookies of its own at all.
- No tracking pixels or web beacons, in pages or in the newsletter.
- No device fingerprinting and no attempt to identify you across visits.
- No advertising network is connected. The ad slots you see are placeholders.
- No social media embeds, which are among the most aggressive trackers on the web.
- No sale or sharing of personal information, under any definition, ever.
- No profiling and no automated decision-making about you.
- No account system, so there is no password of yours for us to lose.
Cookies and local storage
This site sets no cookies of its own. There is no consent banner because there is nothing to consent to, and we would rather not perform a compliance ritual over a decision we did not make.
Two small values are stored by your own browser, on your own device, and are never transmitted to us or to anybody else:
| Key | Store | What it holds | Lifetime |
|---|---|---|---|
gw:helpful:* | localStorage | Your answer to "Was this helpful?" on a given guide, so the page remembers you already answered. This vote currently goes nowhere: it is not sent to a server, not counted and not linked to you. | Until you clear site data. |
gw:header-intro, gw:ai-tip | sessionStorage | Flags that stop the header animation and the Ask AI tip from replaying on every page you open. | Discarded when you close the tab. |
You can delete both at any time by clearing site data in your browser. Nothing on the site breaks if you do, and no feature is withheld from you for doing it. If we ever start collecting the helpful votes, this page changes before that collection starts, not after.
The newsletter
If you subscribe, we collect one thing: the email address you type. It is passed to our email delivery provider and used for one purpose, which is sending you the newsletter. We do not sell it, rent it, trade it, or pass it to advertisers, and we do not use it to try to identify you elsewhere.
Every email carries an unsubscribe link, and unsubscribing removes you from the list rather than marking you inactive. You can also write to us and ask to be removed, or ask what we hold about you, and we will tell you.
The signup form contains a hidden field that real people never see. If it is filled in, the submission is treated as automated and discarded. That is spam prevention rather than tracking: it stores nothing and inspects nothing about you.
Hosting and server logs
This site is hosted on Cloudflare (official source). Like any web host, their systems process the technical information your browser sends with every request: the page requested, your IP address, the time, your browser and operating system, and the page you arrived from.
This is standard infrastructure logging, used to serve the site, block attacks and keep it online. We do not query it to identify individual readers, we do not export it, and we do not combine it with anything else. It is not connected to the newsletter list.
Who else processes data for us
Every third party with any access to data is named here. There are three, and the list is complete as of the date at the bottom of this page.
| Provider | What they do for us | What they can see |
|---|---|---|
| Cloudflare | Hosts and delivers the site. | Standard server request logs. |
| Email provider | Stores subscriber addresses and sends the newsletter. | Your email address, if you subscribed. |
| Buy Me a Coffee | Handles voluntary reader support, only if you follow that link. | Whatever you give them on their site. We never see card details. |
No advertising network is connected to this site at present. If that changes, this page will name the network and explain what it collects before it goes live rather than afterwards, and our advertising policy sets out the commercial rules that will govern it.
International transfers
The site is served from a global content delivery network, which means the server that answers you is the one physically closest to you. Our email provider may store subscriber addresses outside your country. Where personal data moves between jurisdictions, it does so under the transfer safeguards those providers maintain, which are described in their own privacy documentation.
Your rights
Depending on where you live, data protection law gives you rights over personal information an organisation holds about you. Because the only personal information we hold is a newsletter email address, exercising every one of them with us is unusually simple.
| Right | What it means | How to use it here |
|---|---|---|
| Access | Ask what we hold about you and get a copy. | Write to us. The answer is your email address, or nothing. |
| Rectification | Have inaccurate data corrected. | Write to us, or resubscribe with the correct address. |
| Erasure | Have your data deleted. | Use the unsubscribe link. It deletes rather than deactivates. |
| Objection | Object to processing based on legitimate interests. | Write to us and say so. |
| Portability | Receive your data in a portable format. | Write to us. It is one line of text. |
| Withdraw consent | Take back consent you previously gave. | Unsubscribe, at any time, with no reason required. |
In the European Union and the United Kingdom these rights are set out in Articles 15 to 21 of the GDPR (official source). In California, the California Consumer Privacy Act (official source) gives comparable rights, including the right to know, the right to delete and the right to opt out of the sale of personal information. We have nothing to opt out of, because we do not sell or share personal information under any definition.
Security
The site is served over HTTPS everywhere, with no mixed content and no unencrypted endpoints. There is no user account system, no password database and no payment processing on our infrastructure, which removes the three things most commonly breached at a publisher of this size.
Credentials for the newsletter provider are held as environment secrets and are never present in the site's source code or its public repository. If a breach ever affected personal data we hold, we would say so publicly and directly, and notify the relevant supervisory authority where the law requires it.
Children
Gritwright is written for adults and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has subscribed to the newsletter, tell us and we will delete the address without asking for anything in return.
Changes to this notice
The date at the bottom of this page is the day it was last reviewed. If we start collecting something new, connect an advertising network, or add a third party, we will update this page before that change goes live rather than after it. We do not treat a privacy notice as a document that gets quietly rewritten.
Contact and complaints
For any privacy question or request, write to info.remove.this@gritwright.com. We answer these directly and we do not require a particular form of words.
If you are in the European Union or the United Kingdom and you believe we have handled your data improperly, you also have the right to complain to your national data protection authority. We would rather you told us first so we can fix it, but that route exists independently of us and we will not obstruct it.
Last reviewed: 11 August 2026. This page covers what we collect, which is very little, and why.