Privacy Policy
DRAFT, not the final policy. This page is for review only and is not for production use. Two items marked PENDING have not been confirmed yet: D1, the controller’s legal name, and D2, its postal address.
In short
- Your reflection answers stay in your browser on your device. We never receive them, and they are not sent to analytics.
- Analytics (Umami Cloud) is off unless you choose Allow analytics. If you allow it, Umami counts visits and six named events. No answer text and no email address is sent to it. You can change your choice at any time with Analytics choices.
- If you ask to hear about the Interactive Edition, your email address is collected through a Tally form and used only for that.
- The Signal 01 page and this policy page do not set cookies themselves, and Umami’s tracker does not use cookies. The page stores your answers and your analytics choice in your browser (see sections 2 and 3). We do not use advertising or cross-site tracking, and we do not sell your data. Like any website, the services below receive your IP address and browser details when your browser connects to them.
1. Who is responsible
Signal 01 is published under the name Consciously Lost. Consciously Lost is a brand name. PENDING (D1, D2): The person or organisation legally responsible for your personal data (the “controller”), and its postal address, will be named here before this policy is final.
You can contact us about anything in this policy at hello@consciouslylost.com.
2. Your reflection answers
The names, speeches and sentence you write in Signal 01 are saved only in your browser’s local storage on your device, under the key cl.signal01.birthday.v1, together with the step you reached. This lets you leave and come back. Local storage belongs to the exact web address (origin) you used, so answers saved at one address, for example a preview address, do not appear at another.
- Your answers are not sent to us, to Umami, to Tally, to Netlify or to anyone else.
- Copy Signal Log, Download .txt and Print / Save PDF all happen on your device.
- Anyone who uses the same browser profile may be able to see your answers. Start over erases them. Clearing this site’s data in your browser also removes them.
- Please do not type your answers into the notification form.
3. Analytics (Umami Cloud)
If you allow it, we use Umami Cloud, provided by Umami Software, Inc. (United States), to understand in aggregate whether Signal 01 works: how many people visit, start, finish, write something, and open the follow-up links. Umami processes this data on our behalf. Analytics is optional and off by default: until you choose Allow analytics, the page does not load the Umami script, sends nothing to Umami and creates no analytics entries in your browser. Choosing Essential only, or making no choice, does not limit anything else on the page, including the notification form.
What is sent
If you have allowed analytics, then when the page loads, and when one of the events below happens, your browser sends Umami: the page address (including campaign parameters such as utm_source), page title, hostname, referring page, screen size and browser language. Umami derives browser and operating system from the user agent, device type from the operating system and screen size, and approximate location (country, region and city) from an IP geolocation database or location headers. UTM parameters are taken from the page address and stored with each event.
Umami receives your IP address with each request. It uses it to work out approximate location and a visitor identifier without cookies: a hash of the website ID, IP address, browser user agent and a salt that changes monthly. Umami says this identifier groups activity but is not a guarantee of anonymity. Umami states that IP addresses are not stored as a field in analytics records, but that Umami and its infrastructure providers may record IP addresses in separate operational and security logs.
The six events
Only the event name is sent, and only after you have allowed analytics. Events that happen before you allow it are not counted later. No answers, names, email addresses or other details are attached, and your analytics choice itself is not sent as an event.
| Event name | When it is sent |
|---|---|
signal_start | You begin the reflection. |
signal_complete | You reach your Signal Log, even if every answer is blank. |
signal_complete_with_answer | You reach your Signal Log and at least one field is not empty. Only this yes/no fact is sent, never the text. |
pdf_click | You click the link to the PDF edition. |
interactive_interest_click | You open the Interactive Edition notification form. |
interest_submitted | The form tells the page it was submitted. The page only checks that a submission happened; it does not save your email or send it to Umami. |
Event flags in your browser
Only after you allow analytics, and so that each event is counted at most once per browser, the page saves two small entries in local storage: cl.signal01.counted.v1 (which event names have been counted) and cl.signal01.pending.v3 (event names waiting to be sent). They contain event names only. They are not created while analytics is off. If you choose Essential only, or if the page finds these entries without a recorded permission (for example from an earlier test version), it deletes them without sending them. Start over erases your answers but does not change your analytics choice.
Your choice and how to change it
The first time you open Signal 01, a small panel asks whether to allow analytics, with two equal buttons: Allow analytics and Essential only. Nothing is pre-selected and the reflection works without answering. Your choice is saved in your browser’s local storage under cl.signal01.analytics-consent.v1: a version number, the scope (umami-analytics), the choice and the time it was made. It is not sent to us or to Umami. It stays until you change it or clear this site’s data.
You can change your choice at any time with Analytics choices, at the bottom of the Signal 01 page. If you withdraw permission, Umami receives nothing further from the page, and the two event entries are deleted from your browser. Withdrawing does not affect analytics already sent with your permission. Because Umami data does not include your name or email, we usually cannot find and delete the records already sent by one browser.
Cookies and Do Not Track
Umami states that its web tracker does not use cookies. Not using cookies does not remove the need for your permission: the tracker reads details from your browser and the page stores event entries on your device, so we ask first. When analytics is allowed, the Umami script is also configured with its Do Not Track option (data-do-not-track="true"): if your browser reports an enabled Do Not Track preference, Umami does not send analytics. Do Not Track is a deprecated browser feature with limited support and is not our consent mechanism. Many content blockers also block Umami.
Legal basis
Your consent, given with Allow analytics. This covers both reading and storing information on your device for analytics and the processing of the data sent to Umami. You can withdraw it at any time with Analytics choices; it is as easy as giving it.
Where it is stored
Our Umami Cloud account uses Umami’s EU data region (Frankfurt, Germany), as shown in our account settings. Umami says that CDN routing, security, support and operational logging may involve services outside the chosen region.
4. Interactive Edition notification (Tally)
Using the notification form is optional. If you use it, the email field and the confirmation checkbox are both required. The form is provided by Tally BV (Ghent, Belgium) and only loads after you select Notify me about the Interactive Edition. Until then, your browser does not connect to Tally. The form works the same whatever you chose for analytics, and using it does not turn analytics on.
What we collect
- Your email address (required).
- A required checkbox, unticked at the start, confirming that you ask Consciously Lost to email you about the Interactive Edition. It covers only this product notification. It is not consent to a newsletter, to a Substack subscription or to general marketing.
- Like any website, Tally receives technical data such as your IP address and browser information when the form loads and when you submit it.
How we use it
We use your email address only to contact you about the Interactive Edition, for example when it becomes available. This is not a newsletter, it is not a Substack subscription, and we do not use it for other marketing. There is no payment and no obligation to buy.
How it reaches us
Tally stores your submission on our behalf, and we see it only in our Tally account. Email notifications of new submissions are switched off in our Tally account, so Tally does not email us a copy, and no confirmation email is sent to you. If we switch notifications on, we will update this policy first. Tally states that form data is encrypted in transit and at rest and stored in Europe. Tally’s website states that it does not use cookie tracking; this policy makes no further claim about what the Tally form stores in your browser. When the form loads, your browser also connects to services Tally uses, such as its error-monitoring provider; Tally lists these subprocessors on its GDPR page.
Legal basis
Your consent, given with the required checkbox. You can withdraw it at any time by emailing hello@consciouslylost.com. Withdrawing does not affect anything done before.
5. Hosting (Netlify)
Signal 01 is hosted and delivered by Netlify, Inc. (United States) through its global network. When you open the page, your browser sends standard request data, such as your IP address, browser user agent, the page requested and the time. Netlify processes this on our behalf to deliver the page and keep the service secure.
Netlify’s Data Processing Agreement (its technical and organisational measures) states, as a general service term, that logs for the components supporting its services are kept online for 90 days and offline for one year. This is not a description of logging we have inspected for this site. We have not inspected or measured what Netlify logs for Signal 01, and we do not use such logs to identify visitors.
Where the GDPR applies, the legal basis is our legitimate interest in delivering this page to you and keeping it secure. Netlify does not need to store anything on your device to deliver the page.
Netlify adds a small “Powered by Netlify” badge to this page because the project is on Netlify’s free plan; the badge is not part of this site’s code. On this plan our project settings do not allow the badge to be hidden. The badge script checks your browser’s local storage for an entry (nl-hud:public:v1) that Netlify uses to remember a hidden badge; on this project it does not create that entry. Netlify’s badge documentation states that the badge script makes no network requests and collects no data.
6. Links to other sites
The PDF edition link opens Gumroad. The link is set not to pass this page’s address as the referrer, and this page sends Gumroad none of your answers or analytics data. Opening the link connects your browser to Gumroad, as with any website. We only count that the link was clicked (pdf_click). Anything you do on Gumroad is covered by Gumroad’s privacy policy.
7. Service providers and transfers
| Provider | Role | Location | More information |
|---|---|---|---|
| Umami Software, Inc. | Analytics, only if you allow it | United States company; analytics stored in Umami’s EU region (Frankfurt, Germany) | Privacy, DPA, subprocessors |
| Tally BV | Notification form | Belgium; form data stored in Europe | GDPR page and subprocessors, DPA |
| Netlify, Inc. | Hosting and delivery | United States, global network | Privacy, DPA, subprocessors |
| Hostinger (the Hostinger group entity named in Hostinger’s Terms of Service) | Email inbox for hello@consciouslylost.com (only emails you send us) | Hostinger states that it processes data in the United Kingdom, the Netherlands, Lithuania or Cyprus and in other jurisdictions where needed, with some servers outside the EEA | Privacy, DPA |
Some of these providers, and the subprocessors they use, are in the United States or other countries outside the European Economic Area. For such transfers, Umami’s terms rely on the EU Standard Contractual Clauses, and Netlify’s terms rely on the EU-U.S. Data Privacy Framework, with the Standard Contractual Clauses as a fallback. Tally’s terms allow transfers outside the EEA only with Standard Contractual Clauses or another lawful mechanism. Hostinger states that it uses Standard Contractual Clauses or another GDPR transfer mechanism for transfers outside the EEA.
8. How long data is kept
- Reflection answers: in your browser until you use Start over or clear this site’s data.
- Analytics choice: in your browser until you change it or clear this site’s data.
- Event entries (only if you allow analytics): in your browser until you choose Essential only or clear this site’s data.
- Your email address (notification form): for no longer than 12 months from the date you submit the form, or until you withdraw your consent or ask us to delete it, if that is sooner. Our Tally plan does not delete responses automatically, so we delete them by hand in our Tally account. Tally states that responses deleted from an account are removed from its backups within 90 days.
- Emails you send to hello@consciouslylost.com: for no longer than 12 months from receipt, or sooner once your request has been resolved and there is no further need to keep the correspondence.
- Analytics (only if you allow it): our Umami Cloud account is on Umami’s Hobby plan, for which Umami states a data retention period of 6 months. This is the period Umami states for the plan; we have not independently verified when Umami deletes older data. Copies may remain in Umami’s backups for its normal backup cycle.
- Hosting logs: as set by Netlify under its general service terms; see section 5.
9. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy;
- have it corrected or deleted;
- restrict or object to how we use it;
- receive it in a portable format;
- withdraw your consent at any time: for analytics with Analytics choices, and for the notification by emailing us;
- complain to a data protection authority, for example where you live, where you work or where you think the problem happened.
To use these rights, email hello@consciouslylost.com. We may need to confirm that a request comes from you. Our Umami data does not include your name or email address, so we usually cannot match analytics records to a specific person.
10. Children, security and changes
Signal 01 is written for adults and is not directed at children.
The page is served over HTTPS. No method of storage or transmission is completely secure.
If we change this policy, we will update it here and change the date at the top.
11. Contact
Questions or requests: hello@consciouslylost.com. PENDING (D2): A postal address will be added here.