What I do with your data

Visit analytics. Every page view and link click on mcmartyfly.com records the page, the link you tapped, where you came from (referrer and any utm_ tags), a random session id, your device type, your country, your browser's user-agent string, and your IP address. It happens on my own server — no Google Analytics, no third-party pixels.

Your email, but only if you hand it to me. If you sign up for the list I store the address, the exact consent sentence you were shown, the page you signed up from, your user-agent, your IP, and the time. That last set is opt-in evidence: it is how I can prove you asked to be emailed rather than being added to a bought list.

Browser storage. Two small values live in your own browser and never leave it: a session id in sessionStorage, and a flag in localStorage so the email popup doesn't ask you twice. No advertising or cross-site cookies.

The analytics tell me which of my projects people actually care about and whether a video sent anyone here. The country and device fields keep me from designing for a phone nobody uses. The IP and user-agent are there for the boring reason: filtering out bots and abuse.

The email list exists so I can tell you when something real ships. That is the whole use. I do not run it as an ad channel for anyone else.

Everything is stored in a Supabase-hosted Postgres database that only I can reach — the tables have no public access and the site writes to them through a server-side key. The site itself is served by Vercel, which handles the request and derives the country from the connection before the page loads. Both are US companies, so assume your data is processed in the United States.

Supabase and Vercel are processors, not audiences: they hold the data because they run the infrastructure, not because they get to use it. The fonts on this site load from Adobe Typekit and Google Fonts, which — like any file your browser fetches — see your IP address in the process of serving them.

Analytics events are kept for 24 months, then deleted — past that they tell me nothing useful.

If you subscribe, your address stays until you unsubscribe. After that I keep the row, marked unsubscribed, for 24 months so I have a record that you opted out and don't accidentally re-add you. Ask me to erase it outright and I will.

I do not sell your data, rent it, trade it, or share it with advertisers, data brokers, or the other companies I've built. Nothing here feeds an ad profile.

Some links on this site are affiliate or referral links, which means I may earn a commission if you buy. Those are tracked by the destination site under its own policy — I don't receive your purchase details, only whether a referral converted.

The only time I'd hand anything over is if the law genuinely required it.

Every email I send carries an unsubscribe link, and one tap on it ends the list for you — it lands on mcmartyfly.com/unsubscribe. If your mail client mangled the link, reply to any email and I'll take you off myself.

You can also ask me for a copy of what I hold on you, ask me to correct it, or ask me to delete it. I'll do it — you don't need to live somewhere with a data-protection law to ask.

If you'd rather not be counted in the analytics at all, any browser-level tracker blocker stops the request, and I'd rather you browse comfortably than be measured.

Email privacy@mcmartyfly.com and it reaches me, not a helpdesk. I read my messages.

This site isn't meant for children under 13, and I don't knowingly collect anything from them. If that's happened, tell me and I'll delete it.

If I change any of this materially, I'll update the date at the top and say so in the newsletter rather than quietly editing the page.