Privacy policy

Version 2026-09-14

The short version

We collect what we need to build your site, take your payment and answer you, and nothing else. We do not run analytics, we do not advertise, we do not sell or share anyone's details, and the author sites we host make no requests to any third party at all — the type they use is served from our own server rather than from Google.

If you ask us about a site

The form on this website asks for your name, your email address, and your book's ISBN or title, with an optional note. We keep that so we can build your site and reply to you. We keep enquiries that never become orders too, because an unanswered one is the most useful thing to be able to look back at.

If you buy

You sign the hosting agreement, and we record your name as typed, the version you signed, the date, your IP address and your browser's user-agent string — the ordinary evidence that a signature was made. Payment is handled by Stripe: your card details go to them and never reach us. We keep the customer and subscription identifiers Stripe gives us, and a record of the payment events they send.

If you are an author with a site

We hold your email address and a hashed password for signing in, along with whatever you put on your site — your biography, book description, photographs, posts and events. Messages readers send through your contact form are stored so you can read them, and include what the reader typed along with their IP address and browser, which is how we tell a reader from a spam robot.

Cookies

Two, and neither follows you anywhere. One keeps you signed in when you sign in. The other is set when a page of an author site is served and is used only to tell a person filling in a contact form from a script submitting it repeatedly. Both are httpOnly, which means no script on the page can read them, and neither is used to track anyone between sites.

Who else sees anything

Stripe, for payments. Google, only for staff signing in to our own admin tool. Our design tool, which is given a book's public details in order to build a site from them. Our hosting provider and our DNS provider, in the ordinary course of serving a website. Nobody else, and none of them for advertising.

How long we keep things

Your site's content for as long as you have a site, and your billing records for as long as the law requires us to. Contact-form messages and enquiries until you ask us to remove them. If a payment fails, your site is replaced with a holding page after 10 days rather than deleted, so nothing is lost while it is sorted out.

What you can ask for

A copy of what we hold about you, a correction, or its deletion. Ask us through the form at /contact and we will do it. Deleting everything means closing your site, so we will say so before we act.

Changes

If this changes we will publish the new version here, and the version below tells you which one you are reading.