Privacy

PLAIN LANGUAGE · SHORT ON PURPOSE · LAST UPDATED 2 AUGUST 2026

This site is run by Gautam Khosla ("I", "me"). If you only watch the videos and read the pages, I collect nothing about you. The rest of this page explains the one case where I do.

What I collect, and only if you choose

• Your email address, only if you type it into the Climb Log form and tick the consent box.
• Your three Hub answers: which of four descriptions fits you, what you want from this year, and whether you prefer short or detailed. These are multiple choice; there is no free-text field anywhere on this site.
• A consent timestamp: the moment you ticked the box, and the moment you confirmed by email. Canadian anti-spam law requires me to be able to prove consent.

What I never collect

• No advertising trackers, no analytics pixels, no third-party scripts that watch you.
• No name, age, location, phone number, or payment details.
• No raw IP addresses. Rate limiting uses a salted one-way hash of your IP, which cannot be reversed into an address.
• No profiles built from your browsing anywhere else.

Where your data lives

Emails are stored in a Cloudflare D1 database that I control, encrypted at rest, reachable only with credentials I hold. Nothing is stored on the website itself.

Your Hub answers are also saved in your own browser's local storage so the Hub remembers you without a login. That copy never leaves your device unless you also sign up, and you can erase it any time by clearing this site's data or clicking "retune my hub".

Who else touches it

Two service providers, each doing one job:

• Cloudflare hosts the database, the signup worker, and the bot check (Turnstile).
• Resend sends the confirmation email and the newsletter.

Neither is permitted to use your address for their own purposes. I do not sell, rent, trade, or share your email with anyone, ever. Fonts are served by Google Fonts.

Double opt-in, and why

After signing up you get exactly one confirmation email. If you never click the link, you are never emailed again and the unconfirmed record is deleted during routine cleanup. This protects you from someone else entering your address, and it satisfies Canada's Anti-Spam Legislation (CASL), which requires express consent.

How long it is kept

• Confirmed subscribers: kept until you unsubscribe, then deleted immediately.
• Unconfirmed signups: removed within 30 days.
• Rate-limit hashes: automatically expire within 6 hours.

Your rights

You can ask me to show you what I hold, correct it, or delete it. Under Canadian law (PIPEDA), the GDPR if you are in the EU or UK, and similar laws elsewhere, these rights apply regardless of where you live, and exercising them costs you nothing and changes nothing about how you are treated.

• Unsubscribe: one click in any email. Your record is deleted, not just flagged.
• Access, correction, or deletion: email collabwith.gt@gmail.com and I will action it within 30 days, usually the same week.
• Complaint: if I get it wrong, you can complain to the Office of the Privacy Commissioner of Canada, or your local data protection authority.

Children

This site is not directed at children under 13, and I do not knowingly collect their data. If you believe a child has signed up, email me and I will remove the record immediately.

Security

Signup traffic is validated, rate limited, and bot-checked before it reaches the database. Secrets are stored in an encrypted key store and never in the site's public source code. The site enforces HTTPS and a strict Content Security Policy. No system is perfect; if you find a weakness, please tell me at the address above rather than exploiting it, and you will get a fast reply and credit if you want it.

Changes

If this policy changes materially, the date at the top changes and, if you are a subscriber, I will tell you in the newsletter rather than quietly editing the page.

Contact

Anything on this page: collabwith.gt@gmail.com. See also the contact page.