Privacy policy
Who we are
Steffan’s Archive is written by Steffan Lynch and published and operated by Misppelled Ltd, a private limited company registered in England and Wales (company number 17447906), registered office 106 Hither Farm Road, London, England, SE3 9QU. Misppelled Ltd is the data controller for the personal data described here. Contact: [email protected].
Reading the site
You can read everything without an account. We don’t use advertising or social media pixels. Our hosting provider records standard request logs (including your IP address, the page requested and your browser’s user agent) to keep the service secure and working. These logs are kept for up to 30 days.
With your permission only (the cookie question on your first visit), we use Google Analytics and PostHog (EU region) to count visits and see which pieces, links and features are used. They receive your IP address, browser details and the pages you view, and set cookies to tell visits apart. Session recording is switched off. Neither loads if you say no or if your browser sends a Global Privacy Control signal, and you can withdraw at any time under Cookie settings. The lawful basis is your consent.
If a page fails to load or something breaks, an error report goes to Sentry so we can fix it: the error and where in our code it happened, the page address (without anything after a “?”), and your browser and operating system. We remove email addresses, names, IP addresses, cookies and anything you typed before the report leaves the site or your browser, and Sentry is told not to store IP addresses. It sets no cookies and stores nothing on your device. The lawful basis is our legitimate interest in keeping the site working.
Your theme, text size and “saved for later” list are stored only in your own browser’s local storage. They never leave your device and we can’t see them. See the cookie notice.
The newsletter
If you subscribe, we process:
- your email address and, if you give it, your first name;
- which emails you chose (the weekly digest, occasional letters, book news) and where on the site you signed up;
- evidence of your consent: the exact wording you agreed to (by version), when you asked and when you confirmed, and a one-way keyed hash of your IP address (not the address itself);
- whether you later unsubscribe or report an email as spam, so we never email you again by mistake.
Our lawful basis is your consent (UK GDPR Article 6(1)(a)), given through a double opt-in: nothing is sent until you confirm from the email we send you. You can withdraw consent at any time with the link in every email, which also lets you drop individual kinds of email. Open and click tracking in emails is currently switched off.
To prevent abuse we keep short-lived rate-limit counters keyed by a hash of your IP address and email address. Unconfirmed signup requests expire after 48 hours and are deleted within about a week.
Who processes data for us
- Resend sends our emails and stores the subscriber list. [To confirm with Resend’s data processing agreement: where data is processed, and the safeguard used for any transfer outside the UK.]
- Google Cloud (Cloud Run, Firestore, Cloud Logging) hosts the site and stores signup, consent and unsubscribe records, in the London region (europe-west2).
- Sanity stores the published writing. It holds no subscriber data.
- Sentry (Functional Software, Inc.) receives the error reports described above, stored in its EU region (Frankfurt). [To confirm with Sentry’s data processing agreement: the safeguard used for any access from outside the UK and EU.]
- Google (Google Analytics) and PostHog (EU region), only if you accept analytics cookies; and, if enabled, Cloudflare Turnstile (a check that signups come from people, not bots).
How long we keep it
- Unconfirmed signups: up to 48 hours, deleted within about a week after that.
- Your subscription: until you unsubscribe or ask us to delete it.
- Consent records: while you are subscribed and for up to six years afterwards, so we can show that we had permission (a hash of your address is kept after that so an unsubscribe is never undone).
- Rate-limit counters: about a day. Request logs: up to 30 days.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to or restrict its use, or ask for it in a portable format. Write to [email protected] and we’ll respond within one month. You can also complain to the Information Commissioner’s Office (ico.org.uk). See the contact page for how requests are handled.
Changes
If we change how your data is used, we’ll update this page and, for material changes, tell subscribers by email.