Last updated: 16 August 2026.
Who I am
Charlie Rowat is the data controller for this website and newsletter. You can contact me at hello@charlierowat.com.
The newsletter
When you subscribe I store your email address, the time you subscribed and confirmed, the page you signed up from, your IP address and browser user-agent at the time (as evidence of consent), and the version of this notice you agreed to. I use this only to send you new posts by email. The lawful basis is your consent (UK GDPR Art. 6(1)(a) and PECR reg. 22). You can withdraw consent at any time using the unsubscribe link in every email — it takes effect immediately.
When you unsubscribe I keep a minimal record so that I don't email you again. If an email to you bounces or is reported as spam I record that too and stop sending.
How long I keep it
Subscriber records are kept for as long as you're subscribed. Sign-ups that are never confirmed are deleted after 30 days. Delivery records (whether a message reached you, bounced, or was reported) are kept for 90 days. If you unsubscribe, I keep only a one-way hash of your address indefinitely, so that you are never accidentally added back. Ask me to erase your data and I'll remove everything except that hash.
Who processes the data
- Supabase (database, EU London region)
- Amazon Web Services — Simple Email Service (sending email, EU London region)
- Vercel (hosting)
- Cloudflare (images and audio files)
Some providers may access data from outside the UK; where they do, transfers rely on the UK Extension to the EU-US Data Privacy Framework or the ICO's International Data Transfer Addendum.
The website
The site sets no tracking cookies at all. Visits are counted by the site itself: for each page opened it records the path, where the link came from, how long the page was actually in view and how far it was scrolled. That record holds no cookie, no device storage, no IP address and no identifier of any kind, so one visit cannot be linked to another or to you — which is why there is nothing here to consent to. Google Analytics and its consent prompt have been retired. The hosting provider's cookieless analytics (Vercel Web Analytics) also counts page views and referrers in aggregate, setting no cookies and identifying no one. You can keep any browser out of both by visiting /analytics-off. You can change your mind by clearing this site's data in your browser. The ideas page may also reorder itself around what you've read — that history is stored only in your browser and never sent anywhere. Emails contain no open or click tracking. Server logs are kept briefly by the hosting provider for security.
Your rights
You can ask for a copy of your data, ask me to correct or delete it, or object to processing by emailing me. You also have the right to complain to the Information Commissioner's Office (ico.org.uk). If you'd like to complain to me first, email the address above and I'll acknowledge within 30 days.