Privacy Policy

Last updated: October 9, 2026

Tale Spinning is operated by The Mighty Dutch LLC, doing business as Tale Spinning — which in practice means me, Thijs Bazelmans, in California, USA. This page describes what information the site collects, what it’s used for, who else touches it, and how to see or delete it. The short version: I collect the minimum needed to run a course platform and a newsletter, I use two analytics tools to see which pages get read, I show no ads, and I never sell your data or pass it to anyone beyond the service providers listed below.

What I collect, and why

Your account. When you enroll in a course, buy one, or log in, an account is created keyed to your email address. If you sign in with Google, Google also shares your name. That’s the entire profile: an email address, possibly a name.

Reading progress. Which chapters you’ve marked read, so you can pick up where you left off on any device you sign in on.

Worksheet answers. What you type into a course worksheet is saved to your account, so it follows you from device to device.

Purchases and enrollments. Which courses your account has access to, and for purchases, the payment records Stripe shares with me: your email, what you bought, and the payment status. Your card number never touches this site — payment happens entirely on Stripe’s hosted checkout page.

Newsletter subscription. Your email address, if you sign up. Every email includes an unsubscribe link that works immediately.

Login security. Login links are single-use and expire after an hour. The site stores only cryptographic hashes (SHA-256) of login tokens and session identifiers — never the tokens themselves.

Abuse protection. When you request a login link or sign up for the newsletter, the site keeps a scrambled (SHA-256) version of your IP address for about a day, so one sender can’t flood the forms. It is not a visitor log.

Analytics

I want to know which essays get read and whether the course pages make sense to people, so the site runs two analytics tools on every page.

Google Analytics records which pages you view, the site you came from, your approximate location (country and city, derived from your IP address), your browser and device type, and four events: a newsletter signup, a free enrollment, a checkout started, and a purchase. To tell one visit from the next it sets two cookies, listed below. Google explains what it does with this data here.

Cloudflare Web Analytics counts page views, referrers and page load times. It sets no cookies and doesn’t recognise you between visits.

Neither tool gets your name or email address from me. I don’t run ads, and my Analytics account isn’t linked to any advertising product.

To opt out of Google Analytics, install Google’s opt-out add-on, or use a browser or extension that blocks trackers. The site works the same either way. It doesn’t currently respond to Do Not Track or Global Privacy Control signals.

Cookies and local storage

The site sets up to four cookies:

  • ts_session: an essential, HttpOnly cookie that keeps you signed in for up to 180 days. Set only when you log in.
  • ts_oauth: a ten-minute cookie that secures the hand-off when you sign in with Google. Deleted as soon as you’re back.
  • _ga and _ga_01NV8D7TBY: Google Analytics cookies that tell one browser from another and hold a visit together. They last up to two years.

There are no advertising cookies. There is no cookie banner either, which means the analytics cookies are set without asking first. The opt-out above is how you turn them off.

Your browser’s local storage holds a convenience copy of your reading progress, your worksheet answers and your signed-in state. Logging out clears the progress and the signed-in state. Worksheet answers stay on that device until you clear the site’s data in your browser.

Who processes data on my behalf

  • Cloudflare (USA): hosts the site, stores the account database, sends transactional email (login links, purchase confirmations), runs Cloudflare Web Analytics, and provides the Turnstile bot-check on forms, which processes connection data like your IP address to tell humans from bots.
  • Stripe (USA): processes payments on their hosted checkout page, under Stripe’s privacy policy.
  • MailerLite (EU): stores the newsletter list and sends the newsletter, under MailerLite’s privacy policy. MailerLite also records whether a newsletter was opened and which links were clicked.
  • Google (USA): Google Analytics on every page, as described above, and Google sign-in if you choose “continue with Google”, both under Google’s privacy policy. Login and receipt emails also load their typefaces from Google Fonts when your mail app shows remote content.

That’s the complete list. No data broker ever sees your information, and nothing is sold, rented, or traded.

How long data is kept

Your account and its data are kept for as long as the account exists. Sessions expire after 180 days. If you unsubscribe from the newsletter, you stop receiving it immediately. Stripe retains payment records as required by financial regulations.

Your rights

Email [email protected] from your account address and I will, without drama:

  • tell you exactly what data is stored about you,
  • correct anything that’s wrong,
  • delete your account and everything attached to it — enrollments, progress, sessions, the lot.

Note that deleting your account also deletes your access to any purchased courses, so say so if that’s really what you want. If you’re in the EU/EEA or UK, these are your GDPR rights (access, rectification, erasure, portability, objection) and this is how you exercise them. California residents: same address for CCPA requests. I don’t sell personal information. To keep your visits out of Google Analytics, use the opt-out above.

Children

The site is not directed at children under 16, and I don’t knowingly collect their data.

Changes

If this policy changes, the new version appears here with an updated date. Material changes to how your data is handled would be announced by email.

Questions about any of this: [email protected].