Draft, last updated 13 September 2026.
Your email address (to sign you in), the site configuration you enter in the wizard (name, links, settings), an encrypted copy of the Cloudflare API token you give us, billing status from Stripe (never your card number), and basic usage events (which wizard step you completed, when a publish ran). Server logs include IP addresses for a short time for security.
Your site's visitors, your subscribers' emails, your photos and your analytics are stored in your Cloudflare account and are not sent to us. When you use "log in as" support, we see what you would see in your admin, and only while helping you.
Cloudflare (your account, where your site runs), Stripe (payments), and an email provider (sign-in and notification emails). We don't sell or rent your information.
We keep your account data while you use the service and for up to 12 months after, then delete it. You can ask us to delete it sooner, or to send you a copy, by replying to any email from us. Revoking your API token in Cloudflare cuts our access immediately.
One session cookie to keep you signed in. No tracking or advertising cookies.