What I collect, and what I do with it

Rich Vaughan, a sole trader in the United Kingdom, trading as The Rich Stack. I am the data controller, which means the decisions on this page are mine and complaints about them come to me first. Contact me at rich@therichstack.com. A postal address is available on request.

Abaxar is sold through Polar, which acts as the merchant of record. That means Polar is the seller on the transaction and handles the payment, the tax treatment and the receipt. Polar collects your name, your email address, the country or region needed to work out tax, and your payment details. I never receive or store your card number.

What reaches me is the order itself: your email address, what you bought, when, and the amount. Access to the product is granted by connecting a GitHub account to your Polar customer record, so I also see the GitHub username that access is granted to. I need all of that to give you what you paid for, to support you afterwards, and to keep the business records HMRC requires, which is why it is kept for the six full financial years those rules ask for even if you later ask for deletion.

Abaxar itself runs on your own computer. Your store data, your API keys and your reporting never touch a server of mine, because there is no server of mine in that path. Nothing in the product sends your commercial figures anywhere.

The form collects your name, your email address, your store URL, the platforms you tick, and whatever you write in the message. It reaches me as an email, sent through Resend, and I read and answer it myself. I use it to reply to you and to scope the work. You are not added to any list by enquiring, and I will not follow up unrelated things at you later.

If the enquiry turns into an engagement, that correspondence becomes part of the project record and stays in my mailbox and accounts for as long as the business records rules require. If it does not turn into anything, tell me and I will delete the thread.

I use it to send you the thing you asked for, and occasionally to tell you what I have built or published since. That is consent, which you can withdraw at any time using the unsubscribe link on every email or by replying and asking. Withdrawing it removes you from the list rather than hiding you on it. The list is held with Resend and is not shared with anyone.

Analytics is off until you say otherwise. Until you accept the banner no analytics runs, and nothing about what you do here is sent to anyone. Two things are kept either way. One is your answer itself, including a no, so that you are not asked on every page. The others only apply on the hosted demo, which counts the pages you open so it knows when to ask for an email, and remembers how you left it arranged; those are described in full below.

Your answer is kept under the name trs_analytics_consent_v1, in your browser's local storage and, where your browser allows it, also as a cookie scoped to therichstack.com and its subdomains. The cookie is there so that any part of this site running on a subdomain can honour the same answer instead of asking you twice. Unlike the local storage copy, a cookie is sent with each request, so it can appear in ordinary server logs. It holds one word, accepted or declined, and nothing else. A no is honoured wherever it is found. A yes travels the same way, but analytics is only switched on where you actually gave it. The local storage copy is kept until you change it or your browser clears it, and you can change it on this page at any time; the cookie lasts six months, and is written again on your next visit if it has lapsed.

If you do accept, I use PostHog to count page views and see which route brought you here, which is how I tell whether a video is doing any work. That sets PostHog's own cookies to recognise you as a returning visitor and records the pages you view and what you click on. Alongside it, a single entry in your browser's local storage keeps where you first arrived from and where you most recently arrived from: the source, the campaign, the video, the page you landed on. That is what connects a purchase back to a video, and it is stored on your device rather than being followed around the internet.

Consented analytics can also include advertising and measurement tools, such as a Meta, Google or TikTok pixel, used to reach more people like the ones already here. Whatever runs, it runs only after you accept the banner. Nothing on the site needs any of it to work, including buying, so declining costs you nothing.

Turn analytics on or off here, at any time, without emailing anyone:

The password prompt you may have seen while this site is in pre-launch uses standard HTTP authentication and sets no cookie of its own, which is why it never appears in the banner.

The demo at demo.therichstack.com is the real dashboard running on invented data for a shop that does not exist. Nothing you do there changes any of that data, and there is no account to make.

It lets you open three pages and then asks for an email address to carry on. To count those three it keeps one cookie, and once you have given an address it keeps a second so you are not asked again. Neither of them is analytics and neither needs the banner, because counting the pages is the only way the demo can do the thing you came for.

What the counting cookie actually holds is a short fingerprint of each page you have opened, rather than a number, so that going back to a page you have already seen or changing a date range costs you nothing. It carries no readable list of where you have been and nothing about you, though I will not claim the fingerprints are irreversible: they are short, and the set of pages they could stand for is small. It lasts thirty days. The second cookie records only that you gave an address, and lasts ninety days. Both are signed, so the demo rejects one that has been altered, and neither is sent anywhere except back to the demo.

The demo also remembers whether you collapsed the sidebar, in a cookie that lasts a week, and two of its pages remember how you left a table arranged, in your browser's own storage. Those are layout preferences, they are not signed because nothing turns on them, and they never leave your device except for the sidebar cookie travelling back to the demo with each request.

The address itself goes onto my mailing list, held with Resend, and is used the way the section above describes. You can unsubscribe from any email it sends, and asking me to delete it takes you off the list.

One case where that is not the whole story, because it would be easy to leave out. If the handover to Resend fails, or the demo is running without a mailing list configured, your address is written to the demo's own server log instead — otherwise it would simply be lost, having asked you for it. That copy sits in the host's logs rather than on a list, so unsubscribing does not reach it. Ask me and I will delete it. When the handover works normally, no address is written to the log at all.

If you arrived from a video, the campaign tags on that link are read from the address bar at the moment you submit, so I can tell which video is working. They are kept with your address on the mailing list, and which of the two demo forms you used is kept alongside them. That is the whole of it: a source, a campaign, and which form. Nothing about what you looked at.

They are read from the page you are already on rather than stored on your device, which is why they need no consent and work identically if you declined. It also means they are often simply absent, because moving between pages drops them from the address bar, and I would rather tell you that than imply I know more about where you came from than I do.

While the demo is deciding whether to accept a submission it holds your IP address in memory for up to an hour, so that one person cannot use the form to send mail to a stranger repeatedly. It is not written to disk and is not tied to your address.

There is no analytics on the demo at all today, whatever you answered here. If that changes it will honour the answer you gave on this site rather than asking you twice, and this page will say so before it does.

I keep the list of companies involved as short as I can manage. Each one is a processor acting on my instructions, other than Polar, which is a controller in its own right for the payment because it is the seller of record.

• PolarPayments, tax, receipts and granting product access.
• ResendSending the enquiry emails and the mailing list.
• PostHogSite analytics.
• NetlifyHosting. Its servers log the usual request details, including IP addresses, to serve the site and absorb abuse.
• RailwayHosting for the demo only. Its servers log the same sort of request details, including IP addresses.
• GoogleMy own email and files, which is where your correspondence with me actually lives once it arrives.
• GitHubProduct delivery and support issues, if you buy.

Several of these are US companies, so your data may be processed outside the UK. Each of them commits to the transfer safeguards UK and EU law requires for that, and I rely on those commitments rather than making my own arrangements.

Purchase and invoice records: six full financial years, because tax law requires it. Enquiries that went nowhere: deleted when you ask, or when I clear out old correspondence. Mailing list: until you unsubscribe. Analytics: as long as PostHog holds it under my plan, which is not tied to you by name because I never send it your name.

The demo's server logs, which hold an address only when the handover to the mailing list failed, and otherwise hold campaign tags with no address: as long as the host retains them, which is weeks rather than years, or until you ask me to delete yours.

You can ask me for a copy of what I hold on you, ask me to correct it, ask me to delete it, ask me to stop using it for something, or ask for it in a portable form. One email does all of those and I do not need a formal request or a reason. I will answer within a month, and in practice within a couple of days, because there is not much to look through.

The one thing I cannot delete on request is a purchase record inside the retention period above, because keeping it is a legal obligation rather than a choice of mine. I will tell you if that applies.

If I get this wrong you can complain to the Information Commissioner's Office at ico.org.uk, and you are entitled to do that without telling me first. I would rather you gave me the chance to fix it.

This is a business tool sold to businesses. It is not intended for anyone under 18 and I do not knowingly collect anything from them.

When what I collect changes, this page changes in the same breath, and the date at the top moves. If a change is significant and you are on the mailing list, you will hear about it there rather than having to notice a date.