Privacy policy

Short answer: We collect little: standard web traffic data, the emails you send us, and (if you buy) order records held with our payment processor. We use Cloudflare Web Analytics, and Google Analytics 4 only if you say yes. We do not sell your data and there are no ads.

Last updated: [TODO date at publish].

Who we are

Trailfinch (trailfinch.com) is a versioned field manual for people who run software with AI coding agents, with a free layer and a paid edition. Questions about this policy and requests about your data go to privacy@trailfinch.com. [TODO counsel: add the legal entity name and a postal contact only if the law or the payment processor requires it, and place it where counsel advises.]

What we collect, and why

• Browsing data (pages viewed, referrer, country, device type, approximate location from IP at the network edge): processed by Cloudflare to deliver and secure the site, and by the analytics tools below.
• Messages you send us (email to hello@, support@, privacy@ or corrections@): your email address and what you write. We use it to reply. Email is handled by Proton.
• Purchase data (if you buy): our payment processor [TODO name the merchant of record or processor] takes your payment details and acts as seller of record. We do not see or store your full card number. We receive an order reference, a license key, and the minimum information needed to deliver your purchase and handle refunds and support. [TODO confirm exactly what the processor shares with us]
• Access and download records (if you buy): to protect paid content we keep order ID, a hash of the license key, and a download log (timestamp, file, coarse country). No passwords, no names. [TODO confirm against the final delivery design. If sign-in with GitHub or Google is added, update this section and name the auth provider.]
• Waitlist or newsletter (only if offered): your email address and, if you answer it, a price-intent question. [TODO remove if no waitlist at launch, or name the email service]
• Contact or spam-protection forms (only if offered): Cloudflare Turnstile may check that you are not a bot. [TODO remove if unused]

Analytics

We measure traffic with two tools.

Cloudflare Web Analytics (always on). It reports page views, referrers, countries, device types and page-speed metrics. It is designed to be privacy-focused. It does not use cookies or local storage for tracking and does not build profiles of individual visitors. [TODO confirm against Cloudflare’s current documentation at launch]

Google Analytics 4 (only if you consent). GA4 sets cookies (_ga and a property cookie) and collects page views and basic interaction events. Google Tag Manager loads on every page and sets no cookies; GA4 measurement and its cookies start only after you opt in through the consent banner.

• Consent Mode v2: consent defaults to denied (analytics storage, ad storage, ad user data and ad personalization). GA4 measurement turns on only after you choose “accept”; if you decline, it stays off. [TODO confirm the container is set to require analytics storage consent for every Google tag, see docs/DEPLOY_PLAN.md; this is an implementation note, not a legal conclusion]
• No Google signals, no advertising features, no User-ID. We do not link GA4 to advertising products, do not enable Google signals, and do not send names, email addresses or order numbers to Google.
• Reporting identity: device-based.
• Retention: event-level data is kept for [TODO 14 months, the maximum for standard properties; confirm in the GA4 admin] and then deleted automatically.
• IP addresses: GA4 does not log or store full IP addresses. [UNSURE re-verify wording]
• Your choice: you can change or withdraw consent at any time using [TODO link or button to reopen the consent banner]. You can also block analytics cookies in your browser.
• Google acts as our service provider for GA4. Data may be processed in the United States and other countries. [TODO counsel: confirm transfer mechanism wording]

We use analytics to learn which pages help readers and to fix problems. We do not use it for advertising.

Who receives data (service providers)

• Cloudflare: hosting, DNS, security and Web Analytics for this site.
• Google: GA4, only with your consent.
• Proton: email service for the addresses at trailfinch.com.
• Payment processor / merchant of record: [TODO name]. Handles checkout, tax and payment data under its own privacy policy.
• Email or waitlist service: [TODO name or remove].
• Sign-in provider: [TODO name if sign-in is added, or remove].

We do not sell your personal information and we do not share it for cross-context behavioral advertising. There is no advertising on this site. [TODO confirm this stays true at launch; if it changes, update this page first]

How long we keep data

• Web Analytics: aggregated by Cloudflare under its own retention. GA4: [TODO 14 months] if you consented.
• Support email: [TODO e.g. 24 months], then deleted.
• Order and license records: as long as needed to provide the purchase, handle refunds and meet tax and legal obligations. [TODO counsel: retention period]
• Download logs: [TODO e.g. 12 months].

Cookies

Cloudflare Web Analytics sets no tracking cookies. Google Analytics 4 sets analytics cookies only after you consent. Our own site uses no advertising cookies. If purchase sign-in or checkout sets cookies of its own, they are strictly for providing that service and are listed here. [TODO list at launch]

Your rights

Depending on where you live (for example the EU, UK or California), you may have the right to access, correct, delete or export your personal data, to object to or restrict some uses, to withdraw consent, and to complain to a regulator. To make a request, email privacy@trailfinch.com from the address you want us to look up. We may need to confirm your identity first. [TODO counsel: response timeframe and wording per jurisdiction]

Children

This site is not directed to children under 16, and we do not knowingly collect their data. [TODO counsel confirm age]

Security

We use HTTPS everywhere, security headers, and restricted access to our systems. No system is perfectly secure.

Changes to this policy

We will update the date above when this policy changes. For material changes we will also add a dated note to the page. [TODO confirm change-log convention]

Contact

privacy@trailfinch.com for privacy requests. hello@trailfinch.com for anything else.