Privacy Policy.

Most privacy policies are written by template generators, copied unchanged from the last site the operator built, and read like legal furniture — technically present, substantively useless. This one is written to the actual stack this site runs on, in language you can actually use to check what I'm doing and challenge me when I'm wrong.

Everything below is a factual statement about what happens when you visit this site. If any of it becomes inaccurate — if I add a new service, change an analytics tool, launch a newsletter backend — this page is updated before the change goes live, and a changelog entry at the bottom explains what changed.

When you visit this site:

• A small amount of data about your visit is collected by Google Analytics 4, using cookies set only after you consent via the cookie banner
• Your IP address is processed briefly by Cloudflare to deliver the site to you quickly and to protect against abuse; it is not stored by this site
• If and when a real newsletter form is connected, your email is stored only if you explicitly subscribe; the current form does nothing

That is the complete list of data flows on this site as of the version date at the top of this page. There is no ad tech, no retargeting pixel, no session recording, no third-party analytics beyond GA4. The full detail is in the sections below.

This policy covers jeffsreviews.com and any subdomain operated by Jeff's Reviews. It applies to all visitors regardless of country of residence, and includes the additional protections required by the General Data Protection Regulation (GDPR, for EU and UK visitors) and the California Consumer Privacy Act (CCPA, as amended by the CPRA — for California residents).

If you are visiting from a jurisdiction with privacy protections beyond GDPR or CCPA and believe your local law requires disclosures this page doesn't make, email jeff@jeffsreviews.com and I will either add the disclosure or explain why it doesn't apply.

Data controller: Jeff's Reviews, Austin, Texas, USA. Contact: jeff@jeffsreviews.com.

The following data is or may be collected from your visit:

Data sources and collection categories:

The specific cookies set by Google Analytics and Cloudflare are listed in Section 7. The specific data stored by any future newsletter provider will be updated in this section when integrated; the form on the site performs no data collection at this time.

Affirmative disclosures, because absence of collection is itself material information:

• No advertising or retargeting pixels (Meta Pixel, TikTok Pixel, LinkedIn Insight, etc.) are installed on this site
• No session recording or heatmap tools (Hotjar, FullStory, Microsoft Clarity, etc.) are installed on this site
• No fingerprinting or device identification beyond what GA4 does by default with IP anonymization enabled
• No data is sold, rented, licensed, or otherwise made available to third-party data brokers, advertisers, or marketing partners for their own use
• No sensitive personal data (race, religion, health, sexual orientation, biometric data, etc.) is collected; if you voluntarily include such information in an email, it is handled with the same standard inbox retention as any other email and not processed for any other purpose

Under GDPR, any processing of personal data requires a specific legal basis. The bases this site relies on:

• Consent (Article 6(1)(a)): Used for Google Analytics 4 cookies. GA4 loads only after you accept the cookie banner on your first visit. If you decline or do not respond, GA4 does not load and no analytics cookies are set.
• Legitimate interests (Article 6(1)(f)): Used for Cloudflare's strictly-necessary cookies (delivery of the site, fraud and bot prevention). These cookies are exempt from consent requirements under ePrivacy Directive Article 5(3) because they are strictly necessary to deliver the service you requested.
• Performance of a contract (Article 6(1)(b)): Will apply to future newsletter subscriptions — your consent to subscribe is also the basis for processing your email to deliver the newsletter you signed up for.

Under CCPA/CPRA, California residents have the rights listed in Section 9 regardless of the legal basis for any specific processing activity.

• GA4 analytics data: 14 months (the shortest retention period GA4 offers). After 14 months, the data is automatically deleted from Google Analytics. Aggregated reports based on that data may persist, but they cannot be used to re-identify individual visits.
• Cloudflare security data: Varies by type. Bot-management cookies expire after 30 minutes (__cf_bm). Other Cloudflare cookies expire based on their specific purpose; none are retained longer than required for security and delivery.
• Newsletter data: When the newsletter is live, emails are retained for as long as you remain subscribed. Upon unsubscribe, your email is removed from the active list within 7 days. Backup records may persist for up to 90 days before full deletion.
• Email correspondence: Retained for as long as useful to maintain a record of the conversation and any resulting corrections. Correction-related emails may be retained permanently in connection with the public record at /corrections, in which case the email address itself is redacted.

A cookie is a small file stored by your browser when you visit a website. Cookies are used for functional purposes (remembering you're logged in, remembering your preferences), analytics, and advertising. This site uses cookies in the first two categories, never the third.

Strictly necessary cookies (set without requiring consent):

Analytics cookies (set only after you consent):

How to control cookies:

• On your first visit, a cookie banner will ask for your consent. Decline and no analytics cookies are set.
• To change your response later, clear this site's cookies in your browser and revisit the site.
• To block all cookies, use your browser's privacy settings or a privacy-focused browser (Firefox, Brave, Safari with ITP enabled). Note: blocking strictly-necessary cookies may prevent parts of the site from loading correctly.

Change your current cookie preferences: [Open Cookie Preferences]

If you are visiting from outside the United States, some of your data is transferred to and processed in the United States. Specifically:

• Google Analytics processes data on servers operated by Google LLC in the United States. Google relies on the EU-US Data Privacy Framework for lawful transfers from the EU to the US, and on equivalent mechanisms for transfers from the UK and Switzerland.
• Cloudflare operates a global edge network; your connection to this site is handled by the Cloudflare data center geographically closest to you, which for EU and UK visitors is typically in the EU or UK. Aggregated security telemetry may be processed in the United States under equivalent transfer mechanisms.
• This site's operator is based in the United States. Any data you send via email is processed on US-based email servers.

If EU-US transfer mechanisms change (which they have done repeatedly), this section is updated to reflect the current legal basis.

Regardless of where you live, you have the following rights regarding data this site holds about you:

• Right to access: Request a copy of any data this site holds about you
• Right to correction: Request correction of inaccurate data
• Right to deletion: Request deletion of your data (subject to legal retention requirements, e.g., for records related to published corrections)
• Right to restriction: Request that processing be limited while a dispute is resolved
• Right to portability: Request your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent for analytics at any time via your browser cookie settings or by clearing cookies on this site

Additional rights for California residents (CCPA/CPRA):

• Right to know: What categories of personal information are collected, the sources, the business purpose, and the third parties with whom it is shared (all documented above)
• Right to delete: Request deletion of personal information
• Right to opt-out of sale or sharing: This site does not sell or share personal information for cross-context behavioral advertising. There is nothing to opt out of.
• Right to non-discrimination: Exercising any of these rights will not result in different treatment, different pricing, or any reduction in service quality

Additional rights for EU/UK residents (GDPR):

• Right to lodge a complaint: If you believe your data has been handled unlawfully, you may complain to your national data protection authority. A list is maintained at edpb.europa.eu (EU) or ico.org.uk (UK).

How to exercise any of these rights:

Email jeff@jeffsreviews.com with the subject line starting "Privacy Request:" and describe what you want. Response within 30 days as required by GDPR; most requests handled within 72 hours. No documentation, account, or authentication is required beyond demonstrating that you are the person whose data you are asking about — for email correspondence, that's inherently the email address you're writing from. For GA4 data, which is pseudonymous and not linked to individual identity, your request is forwarded to Google who handles GA4 data subject requests on their end.

This site is not directed at children under 13 (in the US) or under 16 (in the EU, under GDPR's default). No content on this site is designed to appeal to children, and this site does not knowingly collect personal information from children.

If you are a parent or guardian and you believe your child has provided personal information to this site — typically this would be through emailing jeff@jeffsreviews.com — contact that email address and the information will be deleted within 7 days of verification.

Personal data held by this site is protected by:

• HTTPS encryption for all site traffic (enforced via Cloudflare)
• Standard operational security practices for email correspondence
• Minimization — this site collects only the data it actually needs, making security incidents narrower by design

No system is perfectly secure. If a security incident affecting personal data does occur, affected users will be notified in accordance with applicable breach notification laws (GDPR Article 33, relevant US state laws). The notification will include what happened, what data was affected, and what you should do.

For reference, the third parties named in this policy and their own privacy policies:

• Google Analytics 4 (Measurement ID: G-Y5JS8VPDL2) — policies.google.com/privacy
• Cloudflare — cloudflare.com/privacypolicy
• [Future newsletter provider] — will be disclosed here when integrated

If you have concerns about how any of these services handle your data, you are encouraged to read their policies directly and contact them if needed.

Email: jeff@jeffsreviews.com
Subject line: start with "Privacy:" so it routes correctly

Jeff's Reviews is operated by one person; there is no separate Data Protection Officer. For GDPR-specific inquiries requiring a formal DPO channel, this same email address serves that function. Response within 30 days as required; most privacy requests handled within 72 hours.

A privacy policy is a contract with readers. If any part of this page is unclear, out of date, or doesn't match what actually happens when you visit the site — that's on me, and I want to hear about it.

jeff@jeffsreviews.com is the way.

— Jeff