Trust, Privacy & Security

This site collects information you voluntarily provide through its forms: newsletter sign-ups (email), contact and booking enquiries (name, email, message and related context), and resource downloads (email). We also store anonymous analytics about page views to understand which essays and resources are useful.

We do not sell your data, and we do not share your email with third parties for marketing.

Form submissions and content are stored in a managed Postgres database hosted on Lovable Cloud (Supabase) with row-level security enabled. Access is scoped: public visitors can submit forms but cannot read other people's submissions, and administrative reads are restricted to the site owner.

Data is encrypted in transit (TLS) and at rest by the hosting provider.

Administrative areas require authentication. Role assignments are stored in a dedicated table and writes are restricted to administrators only — no signed-in user can elevate their own privileges through the API.

To run this site we rely on a small set of trusted providers:

• Lovable Cloud / Supabase — database, auth, and storage
• Email delivery providers for newsletter and transactional email
• Hosting & CDN for static assets

Each provider receives only the data needed to perform its function.

This site uses a small number of cookies and similar storage items to keep the experience secure, functional, and measurable. Below is a clear list of what is set, why, how long it persists, and which third party (if any) receives it.

Third-party processors

• Google Analytics (Google LLC / Google Ireland Ltd) — aggregated, pseudonymised page-view and event analytics. IP addresses are truncated by Google before storage. Raw event-level data is retained for 14 months inside the Google Analytics property; aggregated reports may be retained longer. International transfers rely on the EU–US Data Privacy Framework and Standard Contractual Clauses. See Google's privacy policy.
• Typeform (TYPEFORM SL, Spain) — renders and processes some embedded forms. Responses are stored by Typeform on our behalf and retained for the lifetime of the form, or until we delete them on request. Typeform may set its own cookies on the embedded form iframe. See Typeform's privacy policy.
• Lovable Cloud (Supabase) — hosts the database, authentication sessions, and form submissions. Session cookies set by this provider are first-party. Form submissions are retained until you ask us to delete them.

Data retention summary

• Session cookies: deleted automatically when they expire or when you sign out.
• Analytics events (Google Analytics): 14 months at event level, then aggregated.
• Newsletter subscribers: kept until you unsubscribe; the unsubscribe link is in every email.
• Contact & booking form submissions: retained for up to 24 months for follow-up and record-keeping, then deleted — or sooner on request.
• Typeform responses: retained until the form is archived or the entry is deleted on request.
• Backups: encrypted database backups may retain copies for up to 30 days after deletion.

How to manage cookies: You can block or remove cookies through your browser settings at any time. Blocking necessary session cookies may prevent sign-in from working. To opt out of Google Analytics specifically, install the Google Analytics Opt-out Browser Add-on or enable your browser's "Do Not Track" / tracking-prevention settings. Blocking analytics or Typeform cookies will not affect core site functionality.

You can unsubscribe from the newsletter at any time via the link in every email. To request a copy of, correction to, or deletion of your data, email mrdaveastro1@gmail.com and we will respond within a reasonable timeframe.

If you believe you have found a security issue, please report it privately to mrdaveastro1@gmail.com with steps to reproduce. Please do not publicly disclose the issue until it has been addressed.

This page is editable content owned by the site operator and may be updated as practices evolve. For questions, use the contact page.