Privacy

Reading The Alchemist Papers is free and anonymous, and it always will be. You don’t need an account to read anything here. This page covers what happens when you do more than read: make an account, get a library card, leave a tip, join the newsletter or leave a comment.

Who I am

The Alchemist Papers is run by me, a sole proprietor in Texas, USA, under the registered business name (DBA) The Alchemist Papers. I’m the one responsible for your data (the “controller,” in European terms). You can reach me about anything on this page at chad@thealchemistpapers.com.

↑ Contents

What I collect, and why

If you only read Nothing that identifies you. The site counts page views and measures loading speed with Vercel Web Analytics and Speed Insights, which don’t use cookies and don’t track you across sites or visits. My hosting provider keeps short-lived server logs (including IP addresses) to keep the site running and secure.

If you make an account

• Your email address, and your name and profile photo if you add them or sign in with Google or Apple. This is what your account is.
• What you do in My Practice: your bookmarks, collections and bookshelf, what you’ve read and when, and the sun, moon and rising signs you choose to add. With a library card, also your almanac notebook entries, the materia you mark as in your cupboard and any notes you add to them, and your borrower number. I use these to show you your own practice. Nothing more.
• I never ask for your birth date, time or place. If you want your signs, the site points you to a free calculator elsewhere, and only the signs themselves come back here.

If you comment What you write, when, and the name and photo on your account. Comments are public, so anyone reading the edition sees them next to your name and photo. If you report a comment, I keep a record that you reported it, and any note you add, so I can review it.

If you get a library card or leave a tip Payments are handled by Gumroad (see below), not by me. I never see or store your payment details. I keep a record of each payment: the amount, fees, tax, date, and whether it was a library card or a tip and for which edition. Library card payments are linked to your account. Tips are anonymous. Even if you’re signed in when you leave one, it’s never attached to your account.

The ledger The ledger at /ledger is public. It shows only this year’s totals: what came in, what the site cost to run, and what went to The Exchange. It never shows who paid, or how much any one person gave. If you’re signed in with a library card, you also see your own total for the year, and only you see it.

If you join the newsletter Your email address and whether you’ve opted in. The newsletter is sent through beehiiv.

If you email me Whatever you choose to write, kept in my email.

What’s required You don’t have to give me anything to read the site. An account needs an email address, and paying needs the details Gumroad asks for. Without them I can’t provide that feature. Everything else is optional.

↑ Contents

Why I’m allowed to use it

For readers in the EU, UK and other places that ask for a legal basis:

• To provide what you asked for (contract). Your account, My Practice, comments, your library card and tips.
• Because you agreed (consent). The newsletter. You can unsubscribe from any email, or turn it off in your account.
• Legitimate interests. Keeping the site secure, stopping abuse and moderating comments, anonymous page-view counts, loading images and book covers (which means those services see your IP address), and keeping payment records to meet my US tax obligations. None of these override your own interests. You can object, and I’ll listen.

↑ Contents

Who else handles your data

I use a small number of services to run the site. Each one only gets what it needs, and each is bound by its own privacy and security terms.

• Clerk handles sign-in and accounts. It sees your email, name, photo and sign-in activity.
• Supabase is the database. It holds your account data and My Practice.
• Vercel hosts the site and runs the anonymous analytics. It sees server logs, including IP addresses.
• Gumroad takes payments as merchant of record. It sees your payment details, email and billing address.
• beehiiv sends the newsletter and hosts the images in newsletter issues shown here. It sees your email address if you subscribe, and your IP address when an issue’s images load.
• Cloudinary stores and serves the site’s images. It sees your IP address when an image loads.
• Book covers load from Open Library, Google Books or Bookshop.org, which see your IP address when a cover loads.

About Gumroad When you pay, you’re buying from Gumroad, Inc., which acts as the merchant of record: it’s the seller on the receipt, it handles tax, and it runs the card payment through its own payment processor. Gumroad is responsible for the payment data it collects, under its own privacy policy. What comes back to me is the payment record described above, plus the Gumroad subscription id that links your library card to your account.

I don’t sell your data or share it for advertising. Not to data brokers, not to ad networks, not to anyone. I don’t use it to make automated decisions about you.

I will disclose data if the law requires it, for example a valid court order. I’ll tell you about it unless I’m legally prevented from doing so.

↑ Contents

Where your data is stored

I’m based in the US, and so are the services I use, so your data is stored and processed there. US law may not protect it the same way as the law where you live, and US authorities can lawfully access it in some cases. Where a provider offers extra safeguards, such as the EU–US Data Privacy Framework, I use them.

↑ Contents

Cookies

The site only uses what it needs to work:

• sign-in cookies from Clerk that keep you logged in
• a few values saved in your browser for the current visit only, so the site remembers your place on the editions shelf and which page to return you to after Account. They clear when you close the tab.

There are no advertising or tracking cookies, and analytics are cookieless. That’s why you won’t see a cookie banner here.

↑ Contents

How long I keep it

• Your account and My Practice: until you delete your account. If your library card ends, everything you saved stays until you come back or delete it yourself. Nothing is thrown away just because you stopped paying.
• Comments: until you delete them or your account. When you delete your account, your comments’ text is removed, and any replies from other people stay in place.
• Newsletter: until you unsubscribe or delete your account. Deleting your account removes you from beehiiv entirely, not just unsubscribes you.
• Payment records: as long as tax law requires, which is currently up to seven years. When you delete your account, your payment records stay only as amounts and dates, and are no longer linked to you. Gumroad keeps its own records under its own policy.
• Server logs: a few days at most, as set by Vercel.

↑ Contents

Your rights

Wherever you live, you can:

• See your data and take a copy. Use Export My Data in My Practice (it’s also on the My Practice page if your library card has ended), or email me.
• Correct it. Most of it you can edit yourself. For anything else, email me.
• Delete it. Delete your account from Account → Security. This erases your account and everything in My Practice, and removes you from the newsletter. It doesn’t cancel a library card on Gumroad, so cancel that first from Account → Library card.
• Withdraw consent to the newsletter at any time.
• Object to how I use your data, or ask me to limit it.

In the EU and UK you also have the right to data portability and to complain to your data protection authority. In the UK that’s the ICO. In the EU, it’s the authority in your country.

In Australia I follow the Australian Privacy Principles voluntarily. You can complain to the Office of the Australian Information Commissioner if you’re not satisfied with my response.

In California, Texas and other US states with privacy laws, you have the rights above. I don’t sell or share personal information, so there’s nothing to opt out of. I won’t treat you differently for using any of these rights.

Email chad@thealchemistpapers.com for anything you can’t do yourself. I’ll reply within 30 days, and it’s free. I may need to confirm it’s really you, usually by replying from the email on your account.

↑ Contents

Children

The Alchemist Papers is written for adults. Accounts are for people 16 and older, and I don’t knowingly collect data from anyone younger. If you think a child has made an account, tell me and I’ll delete it.

↑ Contents

Security

Your data is sent over encrypted connections and stored with providers that encrypt it at rest. Access is limited to me and the services listed above. No system is perfectly secure, but if something ever goes wrong in a way that affects you, I’ll tell you promptly, and I’ll tell the authorities where the law requires it.

↑ Contents

Changes

If I change this page in a way that matters, I’ll update the date at the top. If you have an account, I’ll email you before the change takes effect.