Privacy policy

What we collect and why

Our guiding principle is to collect only what we need. Here's what that means in practice:

Identity and access

When you subscribe to the wire, Stripe's checkout asks for your email address. That's so we can send you the wire. It is the only identifying information the wire needs, and the only place it goes is our mailing list, held at Resend. We'll never sell your personal information to third parties, and we won't use your name or company in marketing statements without your permission either.

Billing information

If you subscribe to the wire, you provide your payment information and billing address to Stripe, the merchant of record for the subscription. Your card details are submitted directly to Stripe and never touch our servers. Stripe keeps a record of the transactions for invoicing, taxes, and billing support; what we can see is the subscription's status and the email address attached to it.

Website interactions

We collect information about your browsing activity for analytics and statistical purposes. This includes your browser and operating system versions, your IP address, which pages you visited and how long they took to load, and which website referred you to us. We use PostHog for this; the data is processed and stored on PostHog's US cloud. This applies to every visitor, subscriber or not.

Cookies

This site sets no cookies. Our analytics run in PostHog's cookieless mode: nothing is stored in your browser (no cookies, no local storage), and unique visitors are counted with a privacy-preserving hash computed on PostHog's servers, which rotates daily. That is why there is no cookie banner: there is nothing to consent to.

Voluntary correspondence

When you email us with a question or to ask for help, we keep that correspondence, including your email address, so that we have a history of past correspondence to reference if you reach out in the future.

When we access or disclose your information

To provide the Services. Three processors run the operational side of Frontmatter, and your data goes no further: Stripe (checkout, billing, merchant of record), Resend (the mailing list and email delivery), and PostHog (site analytics).

Aggregated and de-identified data. We may aggregate and/or de-identify information collected through the Services and use it for any purpose, such as counting subscribers or reporting which pages are most read.

When required under applicable law. We are a US company and all data infrastructure is located in the US. Our policy is to not respond to government requests for data unless we are compelled by legal process, and to notify affected subscribers before we disclose data unless we are legally prohibited from doing so.

Finally, if Frontmatter is acquired by or merges with another company (we don't plan on that, but if it happens), we'll notify you well before any of your personal information is transferred or becomes subject to a different privacy policy.

Your rights with respect to your information

We strive to apply the same data rights to everyone, regardless of location. Some of these rights include:

• Right to Know. You have the right to know what personal information is collected, used, shared or sold. This policy is that outline.
• Right of Access. You have the right to access the personal information we hold about you.
• Right to Correction. You have the right to request correction of your personal information.
• Right to Erasure. You have the right to request that your personal information be erased from our possession and, by extension, from our processors. Because your email address is the subscription, erasing it ends the subscription.
• Right to Restrict Processing and to Object. You have the right to request restriction of how and why your personal information is used or processed, including opting out of any sale of your personal information. (Again: we never have and never will sell your personal data.)
• Right to Complain. You have the right to make a complaint regarding our handling of your personal information with the appropriate supervisory authority.
• Right to Non-Discrimination. We do not and will not degrade the Services, charge you differently, or lower our level of service because you have exercised your data privacy rights.

Every wire email carries an unsubscribe link, and billing can be cancelled any time from the billing portal. For everything else, email [email protected]. We may need to verify your identity (at minimum, that you are writing from the subscribed address) before acting on a request.

How we secure your data

All data is encrypted via SSL/TLS when transmitted between the Services and your browser. We store no subscriber data on our own servers; it rests with Stripe, Resend, and PostHog, each of which publishes its own security practices and encrypts data at rest.

Data retention

We keep your information for the time necessary for the purposes for which it is processed. Concretely: when your subscription ends, whether cancelled or lapsed, your email address is removed from the mailing list automatically at the next sync, which happens before every send. Stripe retains transaction records as required for tax and accounting purposes. Analytics data is retained in PostHog for statistical use.

Location of site and data

The Services are operated in the United States. If you are located in the European Union, UK, or elsewhere outside of the United States, please be aware that any information you provide to us will be transferred to and stored in the United States. By using the Services and/or providing us with your personal information, you consent to this transfer.

Changes and questions

We may update this policy as needed to comply with relevant regulations and reflect any new practices. Whenever we make a significant change, we will refresh the date at the top of this page. Have any questions, comments, or concerns about this policy, your data, or your rights? Get in touch at [email protected] and we'll be happy to try to answer them!