Until 3 September 2026 this page told you we didn't record which pages a signed-out reader opened. That day we started, and we rewrote the page in the same change. We now give your browser a random id that lasts a year, and we record the pages you open against it, in order, with the time on each. Open an account and what you read while signed in joins to it. You can export that yourself, and delete what names you.
Updated 2026-09-03The company is the data controller for everything below. Jerry is the editor and the person who answers the mail. Write to hello@saasthinktank.com about anything on this page, including a request we've been slow with. Hong Kong law governs it.
On your first page we give your browser a random id and keep it in a cookie for a year. It isn't your name, and we never ask who you are. But it's the same id on your next page, and on your next visit, so it does let us follow one browser across this site for months at a time. Both halves of that are true and the second is the bigger one: signed out you are anonymous to us, and you are not untracked.
Against that id we record:
A visit ends after thirty minutes of nothing. Come back an hour later and the next page starts a new visit under the same id, so we can see one browser return. If you open an account, that id is joined to it, and from then on every line we write while you're signed in carries your account as well as the id. What you read before you ever signed in doesn't: those lines keep the browser id, carry no name, and stay that way. A browser gets shared, and we can't tell that the person reading last week was you. That join is the one place a signed-out record and a name meet, and it happens because you signed in and for no other reason. We keep the detail for 365 days and then delete it.
Your network address is not on that list and we don't keep it. It is used while the request is in flight, for one thing: a counter that stops one machine sending us a million requests. What goes into that counter is a one-way scramble of the address, not the address — enough to tell that two requests came from the same place, and no way back to the place.
Two things stop it. If your browser sends Global Privacy Control, we send nothing at all — not a page, not a click, not a question — and since the page view is also the request that would have minted your id, you never get one. It's a setting in your browser or an extension, it costs us nothing to honour, so we honour it twice: the page sends nothing, and our server refuses the same signal again in case anything on the page ever forgets to. What it doesn't do is break an affiliate link. Press one and you reach the vendor exactly as before, carrying the random click id, so the network can still credit the sale to us — what stops is our own copy of the click. And clearing your cookies ends the record: the next page mints a new id, and nothing after it is joined to anything before it.
Google Analytics 4 and Microsoft Clarity also run on every page and count readers their own way. What's above is ours, on our own servers, under this site's own address.
The search box is the one place on this site where your own words are kept, so here is exactly what happens to them. Nothing is recorded while you type. When you press Ask, or Enter, or one of the example questions, we store the question, whether we had an answer for it, and which capability answered. We lower-case it and drop a trailing question mark first, so the same question asked two ways counts once. Anything with an @ sign in it, or a long run of digits, is thrown away instead of stored — a search box is how an email address or a phone number ends up somewhere it shouldn't, and a question with its middle blanked out would be no use to us anyway. The words are kept in one place and one place only: a table of questions that carries no id of any kind — not your browser's, not your account's. The record above gets that you asked something here and which capability answered, and never the words themselves. Both go at 365 days: the question, and the line saying you asked one. If you start typing and leave without asking, we count that you did, and never what you had typed.
The address you typed, the day it arrived, which form it came from, the moment you confirmed it and the moment you unsubscribed. If you also have an account under the same address, the two records are linked, which is how the account page can tell you the emails are on. Unsubscribing also writes the address to a do-not-email list that outlives everything else here, because it's what stops us mailing you again. It stops the emails you subscribed to, not your sign-in links: leaving the list should never lock you out of your own account.
Open one and we store:
Why hold any of it? Because a comparison we pick from a guess is worse than one we pick from what readers actually opened. That's the use. We don't build the record for anyone else.
The first is the reader id above. It holds a random value, it lasts a year, and our server sets it on your first page rather than the page setting it in script — which is also why a content blocker doesn't stop it. The second keeps you signed in: it holds a random id, not your address, and signing out both clears it and cancels it on our side. The third lasts fifteen minutes and only exists while a sign-in link is in flight: it's how we check the link is being opened in the browser that asked for it, and it's why opening one on a different device asks you to confirm. None of the three can be read by page script. Google Analytics 4 and Microsoft Clarity set their own cookies, which is how they count a returning reader.
Resend sends our email, so it sees the address we're sending to. Cloudflare hosts the site and the database, so the address sits in storage there. Google Analytics 4, Microsoft Clarity and Google Tag Manager see pages and clicks, and no address ever reaches them. Analytics 4 and Clarity decide for themselves what they do with what they collect, so their own policies apply to that half.
Click through to a vendor and we generate a random id in your browser and pass it along with the link. If the affiliate network later reports the click became a sale, that id is what joins the two rows. The network learns a click happened. It doesn't learn your address, and we don't send it one. On our side the same click is also a line in the record above, under your browser's id.
A sweep runs once a day and enforces every period here. The signed-out record goes at 365 days, oldest first and in that order: the events, then the visits they belonged to, then any browser id with nothing left against it. Deleted, not counted up — a total that kept the question you asked and threw away the day you asked it would be the wrong half to keep. After 365 days we roll the view rows up into one count per account and drop the path and the dates. A referral recipient's address is deleted at 90 days unless that person subscribed or opened an account in the meantime. You stay signed in for 30 days between visits, and 90 days at the outside, then you sign in again. A link we emailed you is deleted once it has expired — fifteen minutes for a sign-in link, seven days for a subscription confirmation or an unsubscribe, 90 for a referral. The search-box rows go at 365 days as well, and they are deleted rather than rolled up: a count of how often a question was asked would keep the question itself forever, which is the opposite of the point.
Both controls are on the account page. Export hands you a JSON file of everything we hold under your account, the reading record above included — the pages, the times, the finder answers, the visits and where each one came from — back as far as the first line that carries your account. Delete erases the parts that are you, in one go: your email address, every profile field, your saved answers, your page-view history, every line of the reading record that carries your account, your row on the mailing list, and your address off any referral that carries it. It clears the reader id out of your browser too, so the next page you open starts a new one with nothing behind it.
Here is exactly what stays. The account row itself, holding an id, the date you deleted it and no fields at all: the records below are attached to it, and an id with nothing on it names nobody. Your published comments stay on the page, from a deleted account, because a thread with holes in it rewrites a conversation other people took part in. Your affiliate clicks stay, and any purchase a vendor reported against one, with nobody attached: we still need to know a link was clicked, and we no longer know who clicked it. And the reading you did before you ever signed in stays. Say that one straight, because it's the part that reads like a catch: those lines never carried your account, only the browser id, and a browser gets shared — deleting them on your word would mean deciding, with nothing to go on, that somebody else's reading was yours. They aren't in your export either, for the same reason, and they go at 365 days like every other line. The browser id they hang off stays as well, with your account taken off it, pointing at nobody. Deleting takes your name off the record; it doesn't stop us recording the browser afterwards, and the new id starts empty and fills up again. Global Privacy Control is what stops that. If you'd unsubscribed, that entry stays too — see above; it's the one record that has to outlive the account.
Access, correction, deletion, a copy you can take elsewhere and an objection to what we do with the record. The account page covers access, export and deletion in about a minute, which is faster than we can answer an email. For anything else, write to hello@saasthinktank.com and we'll come back inside a month. You can also complain to your own regulator, and in the UK that's the ICO.
Not in the plain sense, and not in the broader sense California's CPRA uses, which also catches some ad-tech sharing. We take a commission from a vendor when a reader buys through a link, and that whole arrangement runs on click ids rather than on people.
Google Analytics 4, Microsoft Clarity and Google Tag Manager start when the page does. We haven't put a banner in front of them and we aren't asking you to accept anything, so it's fair that you know they're running. A content blocker or your browser's tracking protection stops all three, and the site reads exactly the same without them.
A blocker does not stop our own recording. It runs on this site's own address, from our own server, with nothing third-party in it to block, so a reader who blocks everything is still in it. Global Privacy Control is the switch that turns it off, and clearing your cookies is what resets the id behind it. We're telling you this because a blocker is what most of our readers assume covers them here, and on this one it doesn't.
We won't start holding something new under an old policy. When we add a field or a processor, this page is edited in the change that ships it and the date at the top moves. We rewrote it on 30 August 2026, the day we built the accounts, and again on 3 September 2026, the day we started recording the reading record above — that second edit took out a sentence saying we didn't record which pages a signed-out reader opened, because we now do. The terms cover the other half: comments, referrals and what closing an account does. Let us know if you find a line here that doesn't match what the site does.