Privacy Policy

The short version

This is Caruso's Conjecture, a personal website and interactive blog run by me, Chris Caruso. This policy explains what happens to your data when you read, sign in, or take part in the community here. I've tried to write it the way I'd want it written for me: plainly, and without hiding the interesting parts in a wall of legalese.

You can read almost everything here without an account and without handing over anything about yourself. Data only really enters the picture when you choose to sign in, react, comment, sign the guestbook, reply, fork a post, or voluntarily support the work.

What I collect

When you sign in

Signing in is optional and handled by GitHub or Google, whichever you choose. I never see your password. Once you approve the sign-in, I receive a small profile from that provider: your name or username, email address, avatar image, and an account identifier. That becomes your account here so you can be recognized on the things you post.

What you create

If you react, comment, sign the guestbook, reply, or fork a post, I store that content along with your account, so it can be shown back to you and to other readers.

• Reactions you add to posts.
• Comments you write (published as marginalia in the margins of a post, next to the text they respond to).
• Your guestbook signature and replies, including structured page, constellation, illustration, or photography mention ids, text offsets, and the display text you selected.
• Forks: your own edited version of a post, saved to your account.

Comments, published forks, guestbook signatures, and guestbook replies are public by design. Assume that what you post, along with the display name and avatar on your account, can be seen by anyone who visits.

When you buy some tokens

Support is optional and payment is handled on Stripe's hosted Checkout page. Your card entry stays there. Stripe's signed completion event can include the receipt email and billing contact as part of its event snapshot; this site ignores those fields and does not store or log them.

To create and reconcile a Checkout session, I store the amount, currency, an estimated token value, payment status and timestamps, and the Stripe session and payment-intent identifiers. If you explicitly opt into the public thanks page, I also store the public name you choose. The public page shows only that name, a coarse month, and estimated tokens, never the payment amount or Stripe identifiers. Public attribution is off by default and may be held for moderation.

How the site is read

I collect privacy-conscious usage analytics to understand how the writing lands: which posts get read, how far, how the reader and narration are used, and where things break. Crucially, this records shapes, not substance. It logs things like page views, reading and listening progress, which sections hold attention, clicks on links, theme changes, and performance or error signals. Guestbook analytics contain only public content ids, counts, lengths, actions, and outcomes. Support analytics record only that the page was viewed, Checkout was opened, or a browser returned. They never contain message text, names, amounts, Stripe identifiers, payment links, author details, or search terms.

If you're signed in, these analytics are tagged with a pseudonymous code derived from your account: a one-way hash, never your name or email, applied only in the moment and never stored on your device. It lets me see how signed-in readers return over time without following anyone around with a cookie.

Separately, and much more simply, the site keeps a few running totals of its own: how many times a page has been opened, and roughly where in a narration people scrub back to. These are integers in a table and nothing else. There is no visitor, no session, no device, no IP address, and no timestamp finer than a day attached to them; hundreds of readers and one reader leave a record of exactly the same shape, and once added they cannot be traced back to anyone. They exist so the site can show a listener where other listeners returned, and so I can see what is worth writing more of without keeping anything about the people who read it. They respect the same analytics off switch and Do Not Track signal as everything else on this page.

Technical and security data

Like any website, mine sees ordinary request information such as your IP address, browser, and the time of a request. This is used transiently to serve pages, deliver images and audio, and protect the site from spam and abuse (for example, rate-limiting and basic content moderation on the things people post).

The legal bases I rely on

If you're in the EEA or the UK, data protection law asks me to have a lawful basis for each way I use your data. Here's the honest mapping:

• Your account and publishing what you post: performing the agreement between us (the Terms) and taking the steps you asked for when you signed in.
• Creating and reconciling voluntary support: performing the request you make at Checkout, meeting accounting or legal obligations, and, only when you opt in, publishing the public name and estimated tokens you asked me to show.
• Cookieless usage analytics, security, and abuse prevention: my legitimate interests in keeping the site healthy and understanding how the writing is read, weighed against your privacy. You can object to this at any time.
• Analytics cookies that recognize a returning browser: your consent, which you give (or withhold) and can withdraw whenever you like.
• Meeting a legal obligation, in the rare case one genuinely applies.

Cookies and local storage

The site keeps a few things in your browser. Most of them never leave your device.

• A session cookie, set only after you sign in, that keeps you signed in. It's essential and needs no consent.
• Local storage for your own preferences (theme, reading font and width, illustration mode), your reading progress, which editor tabs you have open, and your analytics choice. This stays in your browser and is not sent to me.

Usage analytics run cookieless by default: they measure how a single visit unfolds without storing anything that could recognize you on a later one. One analytics cookie, used only to count unique and returning visitors, is set solely where I'm permitted to. Outside the EEA and UK it's on by default; inside the EEA and UK it's set only if you allow it when asked. You can change your mind at any time.

There is no advertising or cross-site tracking here, so there are no advertising cookies to manage.

How I use it

• To give you an account and show who you are on what you post.
• To publish, display, and moderate your reactions, comments, guestbook messages and mentions, and forks.
• To open Stripe Checkout, verify completed or refunded support, issue refunds when requested, and publish an optional public acknowledgement.
• To understand, in aggregate, how the writing is read so I can make it better.
• To keep the site running, secure, and free of spam and abuse.
• To respond to you if you get in touch.

I do not sell your data, I do not show ads, and I do not use your data to profile or target you anywhere else.

Who else is involved

Running the site relies on a small set of trusted service providers. They process data on my behalf, each under its own privacy terms:

• GitHub and Google, for sign-in, if you choose to use them.
• Stripe, which hosts Checkout, processes voluntary support, sends receipts, and handles the payment and receipt information you provide there.
• Microsoft Azure, which hosts the site, the database that holds your account and posts, and the usage analytics.
• Cloudflare, which delivers images and audio and helps protect the site; it sees requests for those files.
• Discord, which I use to receive a private notification when someone posts a new comment, guestbook message, or fork, or when Stripe verifies voluntary support. A support notification contains only the estimated tokens, public/private or review status, and sandbox/live mode — never the payment amount, name, email, receipt data, or Stripe identifiers. A guestbook notification contains message text only when the message is immediately public. Held messages, and replies hidden by a held ancestor, send status and link metadata without the body.

I may also disclose information if the law genuinely requires it, or to protect the site, its readers, or my rights. Otherwise, your data stays within this short list.

Where your data is handled

Some of the providers above (GitHub, Google, Stripe, Microsoft, Cloudflare, and Discord) are based in the United States, so running the site can involve transferring your data there. Where your data moves outside the EEA or UK, it's covered by an appropriate safeguard, such as the EU-US Data Privacy Framework for certified providers or the European Commission's Standard Contractual Clauses.

How long I keep it

• Your account and the things you post are kept until you delete them or ask me to remove them, subject to reasonable backup retention.
• Account removal redacts authored messages. A bodyless tombstone may remain where other readers' replies depend on that message to preserve the thread.
• Support records are kept as needed for reconciliation, refunds, accounting, disputes, and legal obligations. Optional public attribution is removed after a refund or when you ask me to remove it. Stripe keeps its own payment records under its policy.
• Usage analytics are retained only for a limited window and are used in aggregate.
• The site's own running totals — page opens and narration scrub positions — are kept indefinitely, because they are only ever counts. They contain nothing about you to delete.
• The temporary counters used for spam and abuse protection live in memory and are cleared regularly.

Your choices and controls

• Sign out at any time from the account menu, and simply don't sign in if you'd rather stay anonymous.
• Keep support private by leaving public thanks off, which is the default. If you opted in, ask me to change or remove the public name at any time. The accounting record may still need to be retained.
• Choose whether analytics may use a cookie: in the EEA and UK you're asked once. Declining keeps analytics running cookieless, and you can switch analytics off entirely at any time using the control below.
• Turn usage analytics off completely, anywhere in the world, by setting localStorage["cc-telemetry-opt-out"] = "1" in your browser. Your local reading preferences keep working; they never left your device to begin with.
• Ask me for a copy of your data, or to delete your account and everything tied to it, by emailing hello@chriscaruso.dev. I'll take care of it.

Your rights

If you're in the EEA or the UK, you have rights over the personal data I hold about you:

• Access: get a copy of the data I hold about you.
• Rectification: correct anything that's wrong.
• Erasure: have your account and data deleted.
• Restriction: ask me to pause certain uses.
• Portability: receive your data in a portable, machine-readable form.
• Objection: object to any processing I base on legitimate interests, including analytics.
• Withdraw consent: take back any consent you gave, without affecting what happened before.

To exercise any of these, just email me at hello@chriscaruso.dev. You also have the right to complain to your local data protection authority, though I'd genuinely appreciate the chance to put things right first.

Children

This site isn't directed at children, and I don't knowingly collect personal information from anyone under 13. If you believe a child has provided information here, email me and I'll delete it.

Changes to this policy

If this policy changes, I'll update the effective date at the top, and for anything material I'll make the change clear. Continuing to use the site after an update means the revised policy applies.

Questions

Anything here unclear, or want to exercise a choice above? Email me at hello@chriscaruso.dev, or use the contact page. Real person, real inbox.