Privacy Policy

Last updated: July 19, 2026

Tale Spinning is operated by The Mighty Dutch LLC, doing business as Tale Spinning — which in practice means me, Thijs Bazelmans, in California, USA. This page describes what information the site collects, what it’s used for, who else touches it, and how to see or delete it. The short version: I collect the minimum needed to run a course platform and a newsletter, I run no analytics or advertising trackers, and I never sell or share your data beyond the service providers listed below.

What I collect, and why

Your account. When you enroll in a course, buy one, or log in, an account is created keyed to your email address. If you sign in with Google, Google also shares your name. That’s the entire profile: an email address, possibly a name.

Reading progress. Which chapters you’ve marked read, so you can pick up where you left off on any device you sign in on.

Purchases and enrollments. Which courses your account has access to, and for purchases, the payment records Stripe shares with me: your email, what you bought, and the payment status. Your card number never touches this site — payment happens entirely on Stripe’s hosted checkout page.

Newsletter subscription. Your email address, if you sign up. Every email includes an unsubscribe link that works immediately.

Login security. Login links are single-use and expire after 20 minutes. The site stores only cryptographic hashes (SHA-256) of login tokens and session identifiers — never the tokens themselves.

Cookies and local storage

The site sets one cookie: an essential, HttpOnly session cookie that keeps you signed in for up to 180 days. There are no analytics cookies, no advertising cookies, and no third-party trackers — which is why there is no cookie banner.

Your browser’s local storage is used as a convenience cache for your reading progress and signed-in state. It stays on your device and is cleared when you log out.

Who processes data on my behalf

  • Cloudflare (USA) — hosts the site, stores the account database, sends transactional email (login links, purchase confirmations), and provides the Turnstile bot-check on forms, which processes connection data like your IP address to tell humans from bots.
  • Stripe (USA) — processes payments on their hosted checkout page, under Stripe’s privacy policy.
  • MailerLite (EU) — stores the newsletter list and sends the newsletter, under MailerLite’s privacy policy.
  • Google (USA) — only if you choose “continue with Google” to sign in, under Google’s privacy policy.

That’s the complete list. No data broker ever sees your information, and nothing is sold, rented, or traded.

How long data is kept

Your account and its data are kept for as long as the account exists. Sessions expire after 180 days. If you unsubscribe from the newsletter, you stop receiving it immediately. Stripe retains payment records as required by financial regulations.

Your rights

Email [email protected] from your account address and I will, without drama:

  • tell you exactly what data is stored about you,
  • correct anything that’s wrong,
  • delete your account and everything attached to it — enrollments, progress, sessions, the lot.

Note that deleting your account also deletes your access to any purchased courses, so say so if that’s really what you want. If you’re in the EU/EEA or UK, these are your GDPR rights (access, rectification, erasure, portability, objection) and this is how you exercise them. California residents: same address for CCPA requests; since I don’t sell personal information, there’s nothing to opt out of on that front.

Children

The site is not directed at children under 16, and I don’t knowingly collect their data.

Changes

If this policy changes, the new version appears here with an updated date. Material changes to how your data is handled would be announced by email.

Questions about any of this: [email protected].