Constle Privacy
Privacy. What the release list keeps.
This page covers constle.dev, docs.constle.dev and the release-email form on the home page: what is collected, why, who handles it, how long it is kept, and how to have it removed.
01The short version
One address, one purpose.
- The form asks for one thing: your email address. It is used for the release email and nothing else.
- No confirmation email is sent when you sign up.
- About 30 days after the release email has gone out, every address is deleted. Only a keyed hash of the addresses that unsubscribed is kept, so that they are never emailed again.
- The list is not sold or rented, and it is not used for advertising. It goes only to the two service providers in section 04, and to our own computer while we import and send it.
- The sites run no analytics scripts and set no cookies themselves. What Cloudflare, which hosts them, does is in section 08.
- To stop the email, use the unsubscribe link in it. To have your address deleted, write to privacy@constle.dev at any time.
02What the form collects
Your address, and a little about it.
When you submit the form, this is what is kept:
| What | Why | How long |
|---|---|---|
| Your email address, trimmed and lower-cased | To send you the release email | Section 05 |
| Whether you are subscribed or unsubscribed; when the entry was added; when it last changed; when you unsubscribed, if you did, and when its hash was stored | To show that you asked for the email, and to keep an unsubscribe in force | As long as the address |
| Where the entry came from: this form, or the earlier sign-up form | The same record of how you signed up | As long as the address |
| At release: a one-way hash (SHA-256) of the code in your personal unsubscribe link, with the name of the send and the time the link was made | So that your unsubscribe link works. The link itself is not kept in the database. | As long as the address |
| If you unsubscribe: a keyed one-way hash of your address (an HMAC-SHA-256 made with a secret key that only the form's server holds) | So that you are never emailed again, even after the list is deleted | No end date; see section 06 |
| A keyed hash (an HMAC, made with a secret key) of your IP address, with a count of attempts | To limit repeated attempts: 5 every 10 minutes from one IP address | Deleted by an hourly clean-up, normally within about 67 minutes of the attempt |
Your IP address itself is not stored, and nothing else about you is kept with your address: no name, no browser details, no location. A separate counter limits sign-ups per hour overall; it holds nothing about you.
The form gives the same answer whether your address is new, already on the list or unsubscribed, so its answer doesn't show who has signed up.
The bot check
When you focus or point at the form, it loads Cloudflare Turnstile, which checks that a person is using it. For this check Cloudflare processes signals from your browser, which its Turnstile privacy addendum lists as your IP address, TLS fingerprint and user agent, and the form's site key and web address. When you submit, the form's server sends Cloudflare the check's one-time token and your IP address, and gets back a pass or a fail. The form's server doesn't read or keep the other signals.
Logs
The form's server writes short log lines: what happened (for example "subscribed" or "rate limited"), the type of any error and, when someone unsubscribes, a shortened one-way hash of that entry's internal ID. They never contain email addresses, IP addresses or unsubscribe links. Per-request logging is switched off.
03Why, and on what basis
Consent, and a form that stays safe.
- The list and the release email rest on your consent, which you give by submitting the form. You can withdraw it at any time (section 06). Withdrawing doesn't undo an email that was already sent.
- The IP hash, the bot check and the logs rest on our legitimate interest in keeping the form working and free of bots and floods. They are kept only as long as section 05 says (the bot check's signals: under Cloudflare's Turnstile addendum), and you can object to them (section 07).
- The keyed hash of an address that unsubscribed rests on our legitimate interest in keeping the promise it stands for: that the address is never emailed again.
Giving your address is up to you, and no law requires it. Without it you won't get the release email; nothing else changes.
04Who handles it, and where
Two service providers for the list.
- Cloudflare, Inc. runs the form's server (Workers), stores the list in a database (D1), runs the bot check (Turnstile) and forwards mail sent to privacy@constle.dev to us (Email Routing). The database is kept in Cloudflare's European Union jurisdiction. Cloudflare handles this data for us under its data processing addendum. For the bot check it also uses the signals to improve its bot detection, for its own purposes, as its Turnstile addendum explains.
- Resend (Plus Five Five, Inc.) sends the release email. It receives your address, with your unsubscribe link, only when that email is sent to you, keeps its own sending records, and stores its records in the United States. See its data processing agreement and privacy policy.
- Our own computer, during the import and the send. Importing the earlier list and sending the release email put the addresses, and the unsubscribe links, in working files on our computer. They are deleted when the list is deleted, about 30 days after the last email, at the latest.
- Mail you send us. Cloudflare forwards mail sent to privacy@constle.dev to our own mailbox, which an email provider holds for us.
- Nobody else gets the list. Inside Cloudflare, only someone who can sign in to our account can read it, and that is us.
Outside your country
Cloudflare and Resend are US companies, and Cloudflare runs the form's server in data centers around the world, close to each visitor. Both state in their data processing terms that they comply with the EU-U.S. Data Privacy Framework, and both terms include the European Commission's Standard Contractual Clauses, with the UK Addendum for UK data. Write to privacy@constle.dev for a copy of these safeguards.
05How long it is kept
What is deleted, and when.
- Your address and its entry: kept until about 30 days after the last release email has gone out, and never less than 30 days, so that the unsubscribe links keep working at least that long. Then the address is deleted, together with its entry and the hash of its unsubscribe-link code.
- The keyed hash of an address that unsubscribed: kept with no end date, because its only job is to make sure that address is never emailed again (section 06).
- IP hashes: deleted by an hourly clean-up, normally within about 67 minutes of your attempt (later only if a clean-up run fails).
- Log lines: kept by Cloudflare for 3 days.
- Backups: Cloudflare keeps automatic backups of the database for 7 days, so anything deleted from it stays in those backups for up to 7 more days.
- Resend's sending records: kept by Resend under its own terms. Its published plans list 30 days of data retention.
- Working files on our computer: deleted when the list is deleted, about 30 days after the last email, at the latest.
06Unsubscribing and removal
Stop the email, or have your address deleted.
- Before the release there is no email and so no link. Write to privacy@constle.dev from the address you signed up with, and within 7 days we take it off the list, the same way as an unsubscribe.
- After the release the email carries a personal unsubscribe link, and mail apps that support it show a one-click Unsubscribe button. Either one takes effect at once.
- What unsubscribing does: your address is marked unsubscribed at once, and a keyed one-way hash of it goes on a suppression list. When the list is deleted after the release, that hash is all that remains, and it keeps your address from ever being emailed or added again, by the form or by an import.
- An address that has unsubscribed stays unsubscribed, even if it is entered in the form again.
- To have your address deleted from the list, with everything linked to it, the hash included, write to privacy@constle.dev from that address, and we do it within 7 days. Cloudflare's backups still hold it for up to 7 more days, and Resend's sending records follow Resend's terms (section 05). After that nothing blocks your address, so signing up again would put it back on the list.
07Your rights
Ask, correct, delete, object.
Depending on where you live, you can ask us:
- what we hold about you, and for a copy of it;
- to correct it;
- to delete it;
- to restrict how we use it, or to hand it to you in a form you can take elsewhere.
You can object at any time to the processing we do for our legitimate interest, and you can withdraw your consent at any time by unsubscribing or by writing to us. Write to privacy@constle.dev. We answer within one month, and we may ask you to confirm the request from the address it is about.
You also have the right to complain to the data protection authority where you live, or where you work, or where you think the problem happened.
08The rest of the site
No analytics scripts, no cookies of our own.
- What the pages run. constle.dev and docs.constle.dev run no analytics scripts and set no cookies themselves. Their pages load scripts, fonts and images only from their own site. The one exception is the bot check on the release form: when you focus or point at the form, it loads its script and a frame from challenges.cloudflare.com, under Cloudflare's Turnstile addendum.
- Your theme choice. If you pick Light or Dark in the footer, your browser remembers it in its local storage under one key, constle-theme. It never leaves your browser. Choosing System removes it.
- Hosting. Both sites are served by Cloudflare, which processes your IP address and the details of each request to deliver the pages and protect the sites from abuse, under its own privacy policy. Cloudflare shows us only totals, such as request counts and countries.
- Cloudflare's security checks. If Cloudflare's own protection decides to challenge a visitor, it can set its own short-lived security cookie, under its own policy. We don't set or read it.
09Who is responsible
Who "we" is, and how to reach us.
The release list and these sites are run by Constle ("we").
Privacy questions and requests: privacy@constle.dev.
The earlier sign-up form
If you signed up through an earlier version of this form, that earlier list has been deleted. Anything kept now is kept as this page describes.
Changes to this page
This page may be updated to stay accurate. We won't use your address for anything else.