Privacy policy

Who is responsible

This site is operated by operator legal nameoperator company number, at operator address. For data-protection purposes we are the controller of the personal data described here.

You can reach us about anything on this page at privacy contact email.

Our registration with the Information Commissioner’s Office is ico registration.

What we collect, and why

Your email address, when you create a free account to unlock full playbooks. We use it to sign you in, to keep your saved plans and shortlists attached to you, and — only if you ask for it — to send the weekly email. The lawful basis is performance of a contract for the account itself, and consent for the newsletter.

What you do with your own plans: which steps you have ticked, what a step actually cost you, and any outcome report you choose to file. This exists so the launch tracker works. The lawful basis is performance of a contract.

Your answers to the optional profile questions — budget, hours available, country — used only to re-score ideas against your situation. Every one of them is skippable.

Which country folder you are reading, stored in a cookie so you land in the right market next time.

We do not ask for your name, your address, your phone number or any payment details, because nothing here is paid for.

What we do not do

We do not sell personal data, and we do not share it with anyone for their own marketing.

Outcome reports are readable by the person who filed them and by nobody else, including other readers. Where we publish anything derived from them it is an aggregate count across at least fifty reports, never an individual answer.

Our affiliate click log records the destination, the country and the idea. It contains no user identifier and no session, so it cannot be traced back to a person.

Who processes data for us

Supabase — the database and the accounts system. supabase region.

Vercel — hosting and delivery.

email provider — sending sign-in links and the weekly email.

analytics provider — how the site is used in aggregate.

ad network and cmp vendor — advertising and consent management, where you have consented.

Each acts on our instructions under a data-processing agreement. Where any of them transfers data outside the UK or EEA it is done under the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.

How long we keep it

Account and plan data: for as long as the account exists, and retention after deletion after you delete it.

Accounts created by unlocking but never confirmed by email are removed automatically after retention unconfirmed.

Aggregate, non-identifying figures derived from outcome reports are kept indefinitely, because they are no longer personal data.

Your rights

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop processing it, object to processing, and ask for it in a portable form. Where we rely on consent you can withdraw it at any time, and doing so does not affect what we did before you withdrew it.

Write to privacy contact email and we will respond within one month.

If you think we have got this wrong you can complain to the Information Commissioner’s Office at ico.org.uk, or to your own supervisory authority if you are in the EEA. We would rather you told us first.

Changes

If we change this policy in a way that materially affects you, we will say so on the site rather than quietly updating the date.