Privacy.

When you browse the public site: a self-hosted analytics script (Rybbit) records aggregated usage data. See the “Analytics” section below for the exact field list. Account identifiers, email addresses, order IDs, authentication codes or links, and private download URLs are not sent to Rybbit.

When you submit the contact form: your name, your reply-to email address, the topic you selected, and the message you wrote. The server log of the Cloudflare Worker that processes the form also captures your IP address and User-Agent header as part of normal HTTP request handling. Cloudflare Turnstile receives a browser-generated token confirming you are human; we forward that token to Cloudflare’s verification endpoint and do not store it afterward.

When you request account access: your email address, a keyed network-rate-limit value, the sign-in link or code’s creation and expiry time, use and failed-attempt records, and the requested safe return path. Sign-in links expire after 15 minutes, purchase-access links after 24 hours, and legacy codes after ten minutes. The database stores keyed credential hashes rather than usable links or codes.

When you use an account: verified email addresses, active and revoked sessions, purchasing-account membership, accepted license versions, and an audit history of sensitive account changes.

When you start checkout: we store your chosen download email and the product, release and purchase terms you reviewed so payment and delivery can refer to the same purchase. This includes checkouts you do not finish.

When you purchase: Stripe processes new payments and billing information. Historical purchases may have been processed by Polar. Every City receives the customer and order identifiers, purchase email, product, amount, currency, tax amount, payment status, refund status, and timestamps needed to provide access and reconcile the transaction. Every City does not store card numbers or bank-account details.

When you download a paid file: the account or browser-bound checkout, entitlement, release, artifact, byte range, response status, byte count, and time are recorded for access control, support, and abuse investigation. A download authorization is not treated as proof that a transfer completed.

This site uses Rybbit, a self-hosted, open-source analytics tool. The script is loaded from rybbit.nmajor.net, which is operated by the site owner. Rybbit data is kept separate from account, order, and entitlement records.

Fields recorded on each page view: page hostname, URL path, screen width and height, browser language (navigator.language), page title, and HTTP referrer. URL-query collection and automatic outbound-link tracking are disabled. Public product telemetry also stays off when the page URL contains a query or fragment, or the referring URL contains a query or a private account path.

Additional events recorded: CSV and public data asset download clicks (which page the click came from, file path, and file type), homepage explorer filter usage (which quick-filter was clicked), explorer “Download visible rows” clicks (row count at time of export), public product views, sample clicks, purchase-review opens and checkout starts or failures using public catalog identifiers and separate sandbox/live labels, SEO test exposure and contextual-link clicks (test ID, variant, destination path, and link role), press-campaign visits when a URL contains a campaign marker, and contact form submissions (no form content is included in the event). Checkout events include no email, form contents, payment URL or order identifier. Sample clicks do not prove a completed download, and checkout starts do not prove a payment. Account, authentication, payment-return and private-download pages do not load Rybbit.

Campaign markers: if you arrive through a short outreach link such as /r/example-campaign, the redirect lands on the destination page with a short ref code. The browser keeps that campaign code in sessionStorage while you browse so downloads can be counted by campaign. These markers identify the campaign, not the individual recipient.

Free and paid download choices: we record aggregate views and clicks on the population download choices. When analytics is allowed, this browser tab keeps a fixed population-page source label in sessionStorage. If you later start checkout in the same tab, that label is included in Stripe checkout and payment metadata so we can assess orders originating from this offering. It contains no visitor identifier, email address or form contents, and we do not send order or payment identifiers to Rybbit. The label is observational and does not prove that the page caused a purchase.

IP address: your IP address reaches the server as part of the normal HTTP request. Rybbit derives a coarse location (country, region, city) from it. Rybbit’s documentation does not specify whether raw IPs are stored after geo-lookup; because this is a self-hosted instance, any retention policy is set by the operator, not a third party.

Cookies: the Rybbit script sets no cookies. It uses localStorage to persist an anonymous session identifier if the user-identification feature is enabled. This site does not call rybbit.identify(), so no account ID is written to localStorage. Signed-in accounts use an essential Secure, HttpOnly session cookie. Checkout status uses an essential browser-bound cookie so a checkout ID alone cannot reveal purchase status. These cookies are not used for advertising.

Opt-out — one click:

The button writes disable-rybbit=1 to your browser’s localStorage for this domain. Clearing site data resets the choice. We also automatically skip loading the analytics script when your browser sends a Do Not Track or Global Privacy Control signal — you don’t have to take any action in that case.

Analytics data is not sold or used for advertising. Personal information collected for accounts and purchases is limited to the uses described on this page.

Cloudflare: the site, account service, account database, event queues, security controls, and private paid-file storage run on Cloudflare infrastructure. Cloudflare receives normal HTTP request data needed to provide and protect those services.

Stripe: new checkouts use Stripe Managed Payments. Stripe processes payment and billing details, tax information, invoices, receipts, refunds and transaction support under Stripe’s privacy policy. Managed Payments provides customer transaction support through Link. Polar: historical purchases may remain with Polar under Polar’s privacy policy.

Transactional email: an application email provider delivers secure sign-in links, legacy sign-in codes and purchase-access notices. It receives the destination email address and message needed for delivery. Correction and account-status notices remain in the signed-in account unless this policy is updated to name another implemented message type. This channel is not used by agents for outreach and is not used for promotional email without separate consent.

The form posts to a Cloudflare Worker, which submits the message to a self-hosted Chatwoot instance at chatwoot.nmajor.net. Chatwoot stores the conversation. The operator reads it to triage and respond if needed.

No third party sees your message. We do not share, sell, or distribute contact-form submissions. The Cloudflare Worker itself is the only intermediate processor; it does not write the submission anywhere other than Chatwoot.

When you call or text (855) 584-2489: we receive your phone number, the time of the call or message, and, where your carrier provides it, the caller name registered to your number. If you leave a voicemail, we keep the recording and an automatic transcript. If you text us, we keep the messages and any photos or files you send.

Who processes it: Twilio carries the calls and texts. Cloudflare runs the application that routes them and creates voicemail transcripts with Cloudflare Workers AI. Calls, voicemails, and texts are stored with contact-form messages in the self-hosted Chatwoot instance at chatwoot.nmajor.net, where the operator reads and answers them.

How we use it: only to answer your question or request. We text you only after you text us or ask us on a call to text you. We do not send marketing texts.

No sharing for marketing: we do not sell, rent, or share mobile phone numbers, text-message opt-in data, or consent with third parties or affiliates for marketing or promotional purposes. Text-message originator opt-in data and consent are excluded from every category of sharing described in this policy.

Opting out: reply STOP to any text to stop receiving texts, or HELP for help. To have call or text records deleted, ask by phone, text, or the contact form.

Canonical public pages load Google’s Preferred Sources control from news.google.com. Google receives the current page URL and normal request data, such as your IP address and browser headers, so the “Prefer on Google” action can open its source-selection flow.

If you use the control while signed in to Google, Google saves the source preference to your Google account under Google’s Privacy Policy. We do not receive your Google account details or learn whether you completed the selection.

Knowing which pages and features people actually use helps prioritize data updates and improvements. A self-hosted, cookieless tool lets us collect that signal without routing your data through a third-party advertising platform, without setting cookies, and without needing a consent banner. The data stays on infrastructure we control.

If you have an account, you may request a copy of your account information or deletion of optional profile data. Deletion revokes active sessions. Records needed for payment, refunds, fraud prevention, security, legal compliance, and the audit trail may be retained for the applicable period rather than silently erased. Stripe and Polar separately control the billing records they hold for the purchases they process.

If you have submitted a contact-form message and want it deleted, use the form to request deletion and we will remove it from Chatwoot unless retention is required for an unresolved request or legal obligation.

The same contact path handles access, correction, erasure, portability, and applicable privacy requests. We do not sell personal information.