Privacy notice

Attention Is Limited is written and published by Al Brown. It is an independent publication: there is no company behind it and no editorial team beyond the editor. This notice describes what happens to personal data when you subscribe to the newsletter.

What we collect

When you subscribe you give us an email address. We also record:

• Consent history. When you asked to subscribe and when you confirmed. This is an append-only log kept as evidence of consent.
• Confirmation-token metadata. When a confirmation link was created, when it expires, and how many times it was sent. Tokens are stored only as hashes, are single-use, and expire 72 hours after creation.
• Turnstile verification data. The signup form is protected by Cloudflare Turnstile. Turnstile data is processed by Cloudflare and is not stored by this publication.
• Delivery and subscription state in Resend. Resend keeps the contact record, your subscription state, and delivery events such as bounces and complaints. We use those signals to stop sending when the mailbox rejects the mail or the recipient unsubscribes.

We do not collect names, billing details, or anything else you do not provide. We do not sell personal data or share it beyond the processors described below.

Why we process it

• To send the newsletter you confirmed. This is the consent you give when you confirm your subscription.
• To avoid mailing addresses that unsubscribed, bounced, or complained. We keep a suppression record for those addresses so a later signup cannot add the same address back. This is a legitimate interest in running a mailing list properly and protecting sender reputation.
• To meet legal obligations around marketing email. This includes honouring unsubscribes and stopping delivery to bounced or complained addresses.

Where it is processed

Two providers handle subscription data:

• Cloudflare runs the signup and confirmation service: the D1 database, the Turnstile check, and the Worker that answers requests. Cloudflare is a US-based processor.
• Resend sends the confirmation email, stores the contact record, Segment, and opt-in Topic, and delivers the newsletter Broadcast. Resend is also US-based; depending on its infrastructure, data may be processed in the US or in the EU.

Data is processed only for the purposes described in this notice.

Retention

• Your email address and consent history are kept while you are subscribed and for as long as the legal basis requires.
• Confirmation tokens are deleted after 72 hours.
• Suppression records — addresses that bounced, complained, or unsubscribed — are kept after a deletion request so we can honour non-delivery obligations. We do not send to those addresses.
• Unsubscribing is immediate: one click in the email or on the hosted preference page. Deletion is a separate request and is processed within one month.

Your rights

You can ask us at any time to:

• access the personal data we hold about you;
• correct it;
• export it in a machine-readable form (JSON or CSV);
• delete it; or
• withdraw consent for the newsletter.

Email these requests to Al Brown at [email protected]. We will respond within one month. Withdrawing consent or requesting deletion does not affect the lawfulness of processing carried out before the request.

Tracking

The newsletter has no open or click tracking, and the signup form has no analytics. The public site is static: reading pages does not reveal you to us.

Changes

If this notice changes materially, the date above will be updated.