Privacy policy

What this covers

This page, and the site you are reading it on. Listening happens in PodcastHERS, which is a separate application with its own account and its own policy; nothing you do there is described here.

The terms of service are a separate document: what you agree to when you use the site, as opposed to what the site holds about you.

What is held

Nine things, and there is no tenth in our database. One measurement runs beside them: Google Analytics counts page visits — which pages, from roughly where, on what kind of device — under a random identifier of its own, never your name or email address, and nothing it collects lands in our database or is joined to your account. There is no advertising network on this site and nothing here builds a profile to sell.

• Your account

  Your email address, because it is how you sign in and how we reply. Your name and profile picture too, if you chose to sign in with Google — Google passes those across, and nothing else. There is no password: we never stored one, so there is none to lose or leak.

• How you signed in

  The links and codes we email you, until they expire or you use them. Alongside each request, a one-way hash of the address it came from — never the address itself — so that somebody hammering the form can be slowed down without us learning where anybody lives.

• Your membership

  Which plan you are on, whether it is active, paused, overdue or cancelled, when it next renews, and the reference numbers Stripe uses for you. No card number, expiry date or security code ever reaches SHEQONOMI: the card is typed on Stripe's own page and Stripe hands back a reference. If you cancel we ask why, you do not have to answer, and whatever you choose to tell us — including anything you write in your own words — is kept alongside the rest of this and goes when your account does.

• What you told us when you joined

  Which of the identity groups you picked, the roles under them, and the goals you ticked — the answers that decide which parts of the site open for you. Your part-finished answers are saved as you go so you can come back to them, and that draft is deleted 60 days after you last touch it whether you finish or not.

• Your public listing, if you make one

  The display name, headline, biography and location you write — the four things the editor asks for — plus every earlier version of them. The history is kept on purpose: an approved public page may not be quietly rewritten, so a change that materially alters it goes back for review with the last approved version still standing.

• The podcast feeds you connect

  The address of the feed, and what the feed itself publishes — episode titles, dates, and the download figures your hosting company reports. All of it comes from a source you control and can disconnect.

• What you write to us

  Anything sent through the contact form or the support form, kept as a record rather than only as an email — an email-only form loses your message on a bad minute at the mail provider and shows you the same thank-you either way. We also keep a log of which emails we sent to which address and whether the provider accepted them.

• Who referred you

  If you arrived through somebody's referral link, the code travels with you in a cookie named sheq_ref for 30 days and is attached to your account once, the first time. It is attribution and nothing else — a code has never unlocked anything, and the code that brought you cannot be overwritten by a later link.

• Your email address, if you ask for the newsletter

  If you subscribe from the footer, we keep the address, the exact sentence you were shown when you agreed, where on the site you were, and when. The sentence is stored word for word, in the language you read it in, so what you agreed to cannot be quietly rewritten later. Every email carries a one-click unsubscribe; EmailOctopus records that and stops sending. We keep our own copy of the address rather than deleting it, so that a later import cannot quietly put you back on a list you left — and you can have it removed entirely by asking, which is a different thing and is covered below.

• What we changed on an account

  Every change we make to an account by hand: who made it, what the record looked like before and after, and the reason they gave. This is the one thing on this list that outlives an account, and the section on deletion below says why.

Cookies

Four. One keeps you signed in, and clearing it signs you out. One is sheq_ref, which remembers for 30 days that somebody referred you. The last two — _ga and one beginning _ga_ — belong to Google Analytics and carry the random identifier it counts visits under. Google can read those two, and its entry below says what for. None of the four is sold.

Who else sees it

Five companies, named rather than summarised. Nobody else — we do not sell anything on this list, and there is no advertising business here to sell it to.

• Stripe

  Takes payments and runs subscriptions. Your card details are theirs, not ours, and we could not show them to you if you asked. They hold their own record of what you paid under their own obligations.

• Resend

  Delivers our email — sign-in links, receipts, and anything we send you in reply.

• EmailOctopus

  Sends the newsletter, and only to people who asked for it. They hold the address you gave us and their own record of whether you have unsubscribed. They are deliberately not the same company that sends our sign-in links — a newsletter and a sign-in code should not share a sending reputation, so trouble with one cannot stop the other reaching you.

• Google

  Two ways, and only one of them is your choice. If you sign in with Google, Google confirms the address to us and passes your name and picture; sign in by emailed link instead and none of that happens. Separately, Google Analytics measures visits across the site and reports them to Google under its own random identifier — that runs whichever way you signed in, or if you never sign in at all.

• Vercel

  Runs the site itself, so every request you make passes through their servers.

• Neon

  Runs the database everything above is stored in.

How long it stays

Sign-in links and codes expire on their own, in minutes. A part-finished sign-up is deleted 60 days after you last touched it. Everything else stays for as long as your account does, and then until somebody carries out your request to remove it.

Three things outlive the account deliberately. Our record of what was changed on an account by hand — including deleting it — is kept, because an audit trail that can be edited by the person being audited is not an audit trail. Stripe keeps its own record of what you paid, under obligations that are Stripe’s and not ours to waive. And a newsletter subscription is kept whether or not there is an account behind it, including after you unsubscribe — so that a later import cannot quietly put you back on a list you chose to leave. Ask us to remove it and it goes.

Getting a copy

While your membership is active you can download your public listing yourself, without asking, from Creator tools. That download is part of the membership, so it stops working when the membership does — nothing is deleted, and it works again if you start paying again.

Your right to a copy does not depend on paying us. Ask, by either route below, and we send you everything held about you — whether or not you have ever paid, and whether or not your membership has lapsed. There is no charge and you do not have to give a reason. We follow a written procedure each time, so that what you get back does not depend on who happens to answer.

Deleting your account

A person does this, not a program. Somebody here carries out your request by hand, working through a written procedure, and replies to the address on your account when it is done.

We are saying that plainly because the alternative is to imply otherwise. There is no button you can press that deletes your account, no countdown running in the background, and no scheduled job that anonymises anything. The removal is carried out only after a person has verified the request, and there is no way for it to start on its own. If this page one day describes something automatic, it will be because something automatic was built.

To ask, use Support if you can still sign in, or the contact form if you cannot — both carry a topic called “My data, or deleting my account”, and choosing it is what routes your request to the people who handle it rather than into the general queue. Because a person is doing the work, they will check that you control the account before removing anything; usually that is a reply to the address held on it.

What to know before you ask

Five things, because they are the ones that are hard to undo or easy to be surprised by.

• It cannot be undone. There is no recovery window, no thirty-day grace period, and nothing anywhere that offers to put the account back. Ask only when you mean it.
• A paid membership has to be cancelled first. We cancel it in Stripe before removing anything, and the removal will not run while a live subscription is still attached — otherwise Stripe would go on charging your card against an account that no longer exists here.
• Some of it stops the moment they start. Your public listing is taken down, you are signed out everywhere, and any sign-in link already sent to you stops working — all before the removal itself.
• Your photograph goes too. It is stored It is deleted separately and deliberately, including any version waiting to be reviewed. If that step fails it is reported rather than passed over silently, and we finish it by hand.
• There is no token balance to expire. The token system is not built — there is no ledger, no balance and nothing accumulating anywhere behind your account — so there is nothing of the kind to be cancelled, forfeited or paid out when it goes. If you have read otherwise elsewhere on this site, that copy is wrong and is being corrected.

What deletion does not reach

Your sign-in, your membership record, your answers, your listing, your feeds and your messages all go. Three things do not, and it is better that you know which before you ask than after.

• The record described above of what was changed on the account, including the deletion itself.
• Stripe’s own record of your payments, which lives on Stripe’s systems and which we cannot reach from here.
• Backups taken before your request. They still contain what you asked us to remove until they are replaced or destroyed. They serve no page and are opened only if the live database is lost.

Correcting something, or complaining

Most of what is held about you, you can edit yourself in Settings and Creator tools. For the rest, or if you think we have got something wrong and want it looked at by a person, the same two routes above reach one.

Changes to this page

This page describes the site as it is built today. When the site changes, this changes with it in the same release — that is enforced by a test rather than left to somebody remembering.