Privacy policy

You can read every page without an account.

Production pages on the public site load Google Analytics, which records a page view. Google may set its own cookies for that. Analytics does not load when the site is running locally, or on a preview deploy.

A demo on a project page does not contact YouTube or X until you start it. YouTube then plays from youtube-nocookie.com.

The site is not directed at children, and I do not knowingly collect their information.

Subscribe sits at the right of the header. It is optional. Google's sign-in script loads only after you click Subscribe. A visit that never clicks it sends nothing to Google for sign-in.

Sign-in uses a Google ID token. From that token the site reads your name, your email address, and your profile picture. When Google includes them, the site also reads your given name and your family name.

The email must already be verified by Google. The site stores the address in lowercase.

No access token is requested or stored. No refresh token is requested or stored.

Google runs the sign-in screen under its own privacy policy.

After you sign in, the site sets one session cookie.

__Host-rsj-session

The cookie is encrypted and httpOnly, so scripts on the page cannot read it or edit it. It is Secure, SameSite=Lax, and host-only. The browser sends it only to the host you signed in on. Subdomains of rexstjohn.com do not receive it.

The cookie lasts 30 days. Loading a page while you are signed in starts that 30 days over.

The cookie holds your Google account id, email, and name. It also holds your given name, family name, and profile picture address when Google sent them. It holds a short cache of whether you are on the writing list, including the date Resend recorded the contact. The cache is reused for ten minutes, then Resend is asked again.

This site keeps no account database. Sign out clears the cookie.

While you are signed in, the account menu shows your name and email, and the header loads your profile picture from Google.

Choosing Subscribe stores your email in Resend as a contact on the rexstjohn.com writing list. When Google sent a given name or a family name, those are stored on the contact too. Resend does not receive your profile picture or your Google account id.

You are added to the list only when you choose Subscribe after signing in.

I use the list only to send updates about my writing and this blog.

I do not sell the list. I do not share it with advertisers or with other companies for their own mail. Resend stores the contact and sends the mail.

The same Resend account can hold other lists I send. Joining this list does not add you to those other lists.

Each email is an update about a new piece of writing: the title, a short summary, and a link to the post.

Every email includes an unsubscribe link and a postal address. The link is Resend's. It marks the contact unsubscribed, which stops these writing updates. That mark can also stop other mail I send to the same address from this Resend account.

If you subscribe again later, the site clears that unsubscribed mark on the contact and puts you back on this list. Other mail from this Resend account that the mark had stopped can resume.

The account menu has Unsubscribe. That removes you from the rexstjohn.com writing list and leaves you signed in. The Resend contact stays. Any other list stays as it was.

The account menu has Delete my data. After you confirm, the site removes you from the writing list, deletes the Resend contact, and signs you out.

If that email is still on another list in this Resend account, the contact stays for that list and only this subscription is removed. The session cookie is cleared either way.

Sign out clears the session cookie and leaves the Resend contact in place.

I do not sell your information. I do not share the writing list.

Three services process data to run the site. Google handles sign-in. Resend stores the contact and sends the mail. Vercel hosts the site and sees ordinary request data, including an IP address.

Write to rex@verafy.ai if you want a copy of what the writing list holds, or if you want it deleted. Delete my data in the account menu does that deletion itself.

The terms for using the site are on the terms page.

If this policy changes, the date at the top changes with it.