Privacy policy

Last updated: 2026

The short version

You can read this entire site without an account and without telling us anything about yourself. If you sign in, we store your email address, a display name and a username. That is it. There is no password, because we never ask for one.

What we collect

  • Your email address, if you sign in. It is how we send your sign-in code and nothing else. We do not sell it and we do not send marketing you did not ask for.
  • Your profile — display name, username and an optional bio, all of which you choose and can change.
  • Passkey public keys, if you register a passkey. A public key cannot be used to impersonate you and your biometric data never leaves your device.
  • What you post — your comments, likes and reactions, which are public.
  • Session records — a session identifier, the time, and the browser and IP that created it, so you can be signed out everywhere if your account is misused.
  • Aggregate page counts, with no identifier attached, so we know which stories are being read.

What we do not collect

No passwords. No advertising cookies. No contact list, location or device fingerprinting.

Cookies

One cookie of ours, named cm_session, holds your signed session so you stay logged in. It is httpOnly, expires after thirty days, and is deleted when you sign out. During a sign-in there is briefly a second cookie holding the security parameters of that exchange, which is discarded the moment it completes.

Google Analytics sets its own cookies (named _ga and _ga_…) to count visits and see which pages are read and how people arrive. Google processes that data under its own policy; you can block it with any content blocker or Google’s opt-out add-on, and the site works the same without it.

Who else is involved

  • Logto handles sign-in and account management when enabled.
  • Bird delivers your sign-in codes. They see the address the code goes to.
  • Google Analytics counts visits and page views, as described under Cookies.
  • Amazon (and later other retailers) — a “Buy” link takes you to the retailer with our affiliate code, so they can tell the visit came from us. What you do there is between you and them.
  • YouTube serves the review videos, but only after you press play — the player does not load and can set nothing until you ask for it.

Your rights

Email the contact form to get a copy of everything we hold on you, correct it, or have your account and comments deleted. We act on deletion requests within thirty days and we do not keep a shadow copy afterwards.

Children

This site is not intended for anyone under 13, and we do not knowingly create accounts for them.

Changes

If this policy changes in a way that affects what we collect, the date at the top changes and we say so on the site.