Privacy

Last updated: October 19, 2026

I practice data minimization on this website. I collect as little personal information as a task requires, keep it only as long as that task needs, and rely on secure, industry-standard third-party processors rather than storing sensitive data myself.

Newsletter

If you subscribe to the newsletter, your email address (and your name, if you give it) is stored by MailerLite, who sends the newsletter on my behalf using my email address. I use MailerLite's services to email you about my books and nothing else. I will never sell your email address or information. Every email has an unsubscribe link, and unsubscribing stops all newsletter emails right away. If you'd also like your details deleted completely, ask me through the contact form and I'll remove them.

If you subscribe from the European Union, the European Economic Area, or the United Kingdom, you will be asked to check a consent box to receive regular marketing emails, and a separate box for customized online advertising. If you leave the advertising box unchecked, your sign-up isn't reported to Meta. You can withdraw your consent at any time by unsubscribing.

Giveaways

Giveaways on this site are run through KingSumo, and the entry form on a giveaway's page is KingSumo's own. On browsers that can't show that form inside this site (such as those on iPhones and iPads, Safari on a Mac, and the browsers built into social media apps), the page shows a button that takes you to KingSumo's own giveaway page to enter instead. When you enter, KingSumo collects your email address (and anything else its form asks for) under its own privacy policy, and shares it with me so I can pick and contact the winner. To keep giveaways fair, entries are checked with automated fraud-detection tools that look at details such as IP addresses and entry patterns to spot duplicate or fake entries. Each giveaway's official rules, shown on its entry form, say what entering involves. Entering also adds you to my newsletter, as the entry form says. KingSumo emails you a link to confirm your entry, and confirming it also confirms your newsletter subscription: only then are your name and email address passed from KingSumo to MailerLite. If you never confirm, you aren't added, and if you've unsubscribed from my newsletter before, entering doesn't add you back. From then on, your email address is governed by everything in the Newsletter section above, including the newsletter-signup relay to Meta described under Analytics and advertising below.

KingSumo's entry form, and KingSumo's own giveaway pages, also carry my Meta Pixel, which tells Meta when the form is viewed and when someone enters. On this site the form follows the same rules as the Pixel: for visitors in the EU, EEA, or UK, anyone whose browser sends a Global Privacy Control signal, and anyone who has turned the Pixel off using the button at the top of this page, the form doesn't load until you choose to load it. Two things count as choosing: clicking the button that takes you to KingSumo's own giveaway page, and clicking the confirmation link in KingSumo's email, which loads the form so your confirmation can go through. KingSumo's own pages, such as a giveaway link shared on social media, are run by KingSumo and load the Pixel for every visitor.

Shipping and customer data

When you place a store order, Stripe collects your name, email address, and shipping address at checkout and shares that information with me so I can fulfill your order. I use PirateShip to generate and pay for shipping labels; PirateShip receives your shipping address and email to create the label, and will email you your tracking number directly once your order ships. This information is used to ship your order. The only other place any of it goes is the purchase report to Meta described under Analytics and advertising below, and that sends one-way hashes, not the details themselves. I retain it only as long as needed to fulfill the order, handle customer service requests, and comply with necessary legal, financial, and tax obligations.

Payments

Store payments are processed by Stripe. I do not see or store your card or payment details. Stripe handles them entirely under its own privacy and security policies.

Contact form

Messages sent through the contact form, or the "Want to chat about this post?" form at the end of each blog post, reach me by email, delivered by Resend. The form uses Cloudflare Turnstile to block spam bots, which checks your browser under Cloudflare's own privacy policy. I don't log or store your IP address. To help filter out unsolicited sales pitches, the form also notes how long it was open and whether the message was pasted in, and uses that only for this check.

Messages sent from a blog post also tell me which post you wrote from. If you check the box to also join the newsletter, your name and email address are added to my mailing list the same way as subscribing directly through the newsletter page, governed by everything in the Newsletter section above.

Cookies and local storage

This site uses your browser's local storage (not a traditional cookie, but a similar small piece of data saved on your device) to remember a few choices: whether you've already dismissed the newsletter pop-up, and whether you've turned off the Meta Pixel using the button at the top of this page. If the giveaway entry form waits for you to load it (see Giveaways above) and you choose to, that choice is kept in session storage too, so the form loads straight away for the rest of your visit. None of this is ever sent to me. Local storage also holds the Meta Pixel's random visitor code, described under Analytics and advertising below.

Blog posts, giveaway pages, and the 404 page show a view count. To keep refreshing the page from inflating it, the site saves a scrambled code (a one-way hash) made from your IP address, your browser's name, the page, and the date, without setting a cookie on your device. The code can't be turned back into your IP address, isn't used for anything else, and is deleted the next day. Giveaway pages also count, the same way, how many visitors arrive through each share link I post (for example, the one in my newsletter or on Instagram); only the total for each link is kept. Visitors to my Links page are counted the same way, by where they came from (such as Instagram or YouTube, worked out from the site or app that sent them), along with whether they go on to click through to Amazon, send a newsletter sign-up form, or start a store checkout. Where you came from is kept in session storage until you close the tab, and only daily totals for each are kept.

If you land on the 404 page, its URL and, if available, the page you came from are also sent to me so I can find and fix broken links. This isn't stored anywhere. It only appears briefly in Cloudflare's function logs, and doesn't include your IP address.

Bonus scenes and chapters are for newsletter subscribers. When you unlock them, the email you enter is checked against my MailerLite subscriber list and isn't stored by the site. Bonus links in my emails include your email address so they can unlock automatically; it's checked the same way and removed from the page address right away. If you're subscribed, the site sets a cookie (bonus_access) that only says this browser has been unlocked; it doesn't contain your email, is only sent with bonus pages, and lasts about a year from your last visit to them. When you subscribe on this site, a second cookie (bonus_pending) holds your email address for up to 14 days so the bonus content can unlock by itself once you confirm your subscription; it's deleted as soon as that happens.

Third-party tools embedded on this site, like MailerLite, Meta, KingSumo, and Amazon, described below, may set their own cookies under their own policies, which I do not control. Cloudflare, which hosts the site, may also set short-lived security cookies to tell people from bots and protect the forms from spam.

Analytics and advertising

This site uses the Meta Pixel, which records when a page is viewed and when certain buttons or links are used. For example: viewing a book's page, clicking a link that takes you to Amazon or Goodreads, moving on to the next book in the series, starting a store checkout, seeing the newsletter pop-up, or using a blog post's share buttons. While the Pixel is running, the site also saves a random code in your browser's local storage (metaVisitorId) and sends it with these events, so Meta can tell that visits on different days came from the same browser. It's not made from anything about you, and clearing your browser's site data removes it. I use this to understand which books and pages generate interest, and to show relevant ads to past visitors on Meta's platforms (Facebook and Instagram). Meta collects, stores, and processes this data according to its own privacy policy. I do not have access to any user data collected in this manner.

The Pixel does not load at all for visitors in the European Union, the European Economic Area, or the United Kingdom, or for anyone whose browser sends a Global Privacy Control signal. The site detects your country from the connection (Cloudflare provides it; your IP address isn't stored) and sets a small cookie (skip_pixel) that keeps the Pixel off.

Separately, if you subscribe to the newsletter (including by entering a giveaway), a one-way cryptographic hash of your email address (not the email address itself), plus a hash of your first and last name if you gave them (for example, when entering a giveaway), is sent to Meta's Conversions API so I can measure how newsletter signups from ads are performing. It isn't sent if, when you sign up on this site, your browser sends a Global Privacy Control signal or you've turned off the Meta Pixel using the button at the top of this page, or if you sign up from the EU, EEA, or UK without checking the customized online advertising box. Giveaway entries are collected by KingSumo rather than this site, so those signals don't reach me; for a giveaway entry, unsubscribing is the way to stop it. When you opt out this way, I keep a one-way hash of your email address so the choice sticks if you sign up again later. Meta may compare it against email addresses Meta already has on file to match the event to an existing Meta account. Unsubscribing from the newsletter stops any further hashes of your email from being sent this way.

When you place a store order, the order is also reported to Meta's Conversions API so I can measure how sales from ads are performing. The report includes the order total, what you bought, and one-way cryptographic hashes (not the details themselves) of your email address, name, phone number if given, city, state, ZIP code, and country. Meta may compare these hashes against information it already has to match the purchase to an existing Meta account. If the Meta Pixel was running when you clicked Buy now, the report also includes the Pixel's browser identifiers, your IP address, and your browser's name and version, which the site saves for up to three days to link your checkout to your order. None of this is sent if you turned off the Meta Pixel using the button at the top of this page, or your browser sends a Global Privacy Control signal, before clicking Buy now.

I also use Cloudflare Web Analytics, which counts page visits and which site sent visitors here, without cookies or storing your IP address.

ARC and street team applications

If you apply to join the ARC team or street team, I collect which team you'd like to join, your name, email address, a link to your Goodreads profile and/or social media profiles, your answer to whether you've read the series so far, and anything else you choose to add. This is sent to me by email (via Resend, the same service the contact form uses) and saved in the website's private storage (Cloudflare) so I can review it personally. Links you include may be checked against Google's Web Risk list of known unsafe websites before I open them; only the link is sent, not your name or email address. When I've decided, I send you an email through Resend either way. If I decline your application, it's deleted automatically 30 days later. If you tick the box for the secret prologue, you're added to my newsletter right away, whatever happens with your application. If you join a team, I keep your application while you're on the team, and your name and email address are added to my newsletter (if you aren't on it already) and a team group in MailerLite (the service that sends my newsletter) so I can email you about upcoming releases. Every email includes an unsubscribe link; unsubscribing takes you off the newsletter and the team emails, and deletes your application. You can ask me to delete yours at any time through the contact form.

When you apply, a one-way cryptographic hash of your email address (not the email address itself) is also sent to Meta's Conversions API, the same way described under Analytics and advertising above, so I can build advertising audiences from genuine, qualified applicants. This isn't sent if your browser sends a Global Privacy Control signal or you've turned off the Meta Pixel using the button at the top of this page.

Hosting

This site is hosted by Cloudflare, which necessarily processes your IP address and basic request details to deliver pages and protect the site from abuse, under Cloudflare's own privacy policy. I don't store those details myself.

The site has a security policy that tells your browser which outside services a page may load. If your browser blocks something because of it, it sends me a short report naming the page and the blocked address, with no personal details, so I can fix anything that broke. Reports are deleted after 30 days.

If something goes wrong while the site is handling one of your forms or orders (for example, a service it relies on is down), it saves a short note about the problem so I can fix it, which may include your email address. These notes are deleted within 8 days.

Links to other sites

This site links to other websites, including Amazon, Goodreads, Podium Entertainment, narrators' websites, and social media. Once you follow a link off this site, that site's own privacy policy applies, not this one.

Amazon Associates

As an Amazon Associate I earn from qualifying purchases. Links to Amazon on this site may carry a tracking tag that credits me for qualifying purchases, at no extra cost to you. The links on the page my ads send readers to never carry one.

Links to Amazon go through Geniuslink, a link service that sends you to the Amazon store for your country and, on phones, tries to open the Amazon app so you don't have to sign in again. When you tap one, Geniuslink briefly processes basic details of that click, such as your approximate location from your IP address and the kind of device you're using, to send you to the right place, under its own privacy policy. I don't receive those details, only a count of clicks.

Your rights

You can ask what data I hold about you, ask me to correct or delete it, or withdraw consent you previously gave, at any time. This applies everywhere, and readers in the EU and UK have these rights under the GDPR specifically.

California residents

If you are a California resident, the CCPA/CPRA gives you the right to opt out of the "sale" or "sharing" of your personal information going forward. Four things on this site can qualify as "sharing" under this law: the Meta Pixel described above (including the Pixel in the giveaway entry form), the newsletter-signup relay described above, the store purchase report described above, and the ARC and street team application relay described above. You can opt out of the Pixel by clicking the button at the top of this page, which also keeps the giveaway entry form from loading until you choose to load it. The newsletter relay, the application relay, and the purchase report are skipped if you turn off the Pixel before signing up, applying, or checking out, or if your browser sends a Global Privacy Control signal. You can also stop the newsletter relay at any time by unsubscribing from the newsletter, which stops any further hashes of your email from being sent to Meta.

Children's privacy

This is a general-audience site. It isn't directed at children under 13, and I don't knowingly collect personal information from anyone under 13. If you're under 13, please don't subscribe to the newsletter, enter a giveaway, apply to be an ARC reader, place a store order, or send a message through the contact form. If you're a parent or guardian and believe your child under 13 has given me personal information, contact me through the contact form and I'll delete it.

Teen readers are welcome. If you're a teen, or the parent or guardian of one, you can use the toggle at the top of this page to turn off the Meta Pixel and the reports to Meta described above, and unsubscribing from the newsletter stops the newsletter relay. Both work immediately and don't require contacting me.

Questions

Have a question about your data or this policy? Use the contact form and pick "Something Else" from the dropdown, and I will answer.