Privacy policy · the whole thing, no small print
What we know about you
Very little, on purpose. Here is all of it, with how long we keep it, because a website this pointless has no excuse for being vague.
The short version
- No adverts, no analytics, no tracking pixels, no fingerprinting. Nothing is sold, partly on principle and partly because nobody would buy it.
- We store only what a feature needs to work: your email if you want emails, your webhook if you want webhooks, your initials if you want glory.
- IP addresses are never stored. Where we need to tell people apart, we keep a salted hash (see below).
- Visitors get no cookies. The admin gets two.
- Nothing about the baby is stored, shown or wanted. The baby's privacy policy is very short: there is no data.
What is stored, and for how long
Everything lives in one Cloudflare D1 database (and one Durable Object for the live counters). The schema is public in the repository, if you'd like to check our working.
| Thing | What we keep | For how long | Public? |
|---|---|---|---|
| Email updates | Your email address, whether you want big news only or the daily "still no" too, a random token for the links in your emails, and when you signed up, confirmed and unsubscribed. | Until you unsubscribe. Sign-ups never confirmed are deleted after 7 days; unsubscribed addresses 30 days after you leave (so "resubscribe" still works in the meantime). | Never |
| Push notifications | The endpoint your browser's push service gives us (a long URL at Google, Mozilla, Apple or Microsoft), the two encryption keys that come with it, and a count of failed deliveries. | Until you turn notifications off, which deletes it. If the push service says the subscription has died, it is switched off and never used again. | Never |
| Webhooks | The URL you pasted, its type (Discord, Slack or generic), how often it wants news, a random management token, and the status code and time of the last delivery. | Until you delete it from its management page. | Never |
| Delivery log | Which update went to which subscriber, push subscription or webhook, by row number, and whether it worked. No addresses or URLs, just numbers. | Kept with the update, so a retry never sends anything twice. | Never |
| Check counts | How many times people checked the answer, added up per day, per hour of the day, per country and per Cloudflare datacentre. Nothing per visitor: you are a +1, nothing more. | Forever. It is the only vanity metric we have. | Yes, as totals on /stats |
| Baby pool guesses | The name you type and the moment you guess (both public), whether it came by web or email, a hashed connection identifier (or, by email, the hashed sender address) to enforce 3 guesses each, and when you guessed. | Until the admin hides or deletes it, or you ask. | Name and guess: straight away |
| Congratulations wall | Your name and message, a hashed connection identifier, and when you wrote it. | Until the admin rejects or deletes it, or you ask. | Name and message: once approved |
| Name suggestions | The suggested name, the optional "suggested by", a hashed connection identifier, the vote count, and one hashed identifier per vote so everyone votes once. | Until the admin rejects or deletes it, or you ask. | Name and "suggested by": once approved |
| Catch the Stork scores | Your three initials and score (both public), a hashed connection identifier to enforce 5 scores a day, the game's id so it only counts once, and when you scored. | Until the admin deletes it, or you ask. | Initials and score: straight away |
| Email to ask@iszacka.dad | What kind of email it was (a question, a pool guess, or ignored), the sender address hashed, and when it arrived. The message is read to write the reply and never goes in the database; a guess goes into the pool as above. | The hashed record: kept, to cap replies per sender. The Cloudflare Workflow that handles each email keeps its working copy (sender included) for 1 day, a little longer if handling it failed, then discards it. | Never (a guess: as above) |
| Email housekeeping | How many emails went out each day (a number, for the quota), and the ids of Resend's webhook deliveries, so none is handled twice. | Daily counts: kept. Delivery ids: 30 days. | Never |
| Good vibes | A tally per emoji of the good-vibes buttons on the homepage. Counts only. | Forever, for morale. | Yes, as totals |
| Pigeon, smoke signal and fax | Nothing. What you type into those forms is not read, stored or logged. The pigeon is working from memory. | Not applicable, gloriously. | There is nothing to see |
The rest of the database is the site's own business: the answer, when it changed, the due date, the updates, the Dad Ledger, the readiness checklist, and a few randomly generated keys and salts.
Hashed connection identifiers
Some features need to tell one person from another without knowing who anyone is: 3 pool guesses each, 5 stork scores a day, one vote per name. For those, we take your IP address (for IPv6, just the first half, the /64 your whole household shares), add a random salt that only this database knows, run it through SHA-256 and keep the first 32 characters. The IP itself is never written down.
A hash is a pseudonym, not a disguise: someone with both the database and the salt could check whether a particular IP made a particular entry. Nobody but the site has either. Email senders to ask@iszacka.dad are hashed the same way.
Rate limits (10 form posts a minute per connection, for example) are counted by Cloudflare in memory for a minute and leave no record with us. Pages with a form use Cloudflare Turnstile to check you are human, which sees your IP address while it does so.
Cookies and your device
Cookies: visitors get none, so there is no banner to dismiss. The admin's browser gets two: a session cookie that keeps the admin signed in (30 days, HttpOnly, SameSite=Strict, only ever set by logging in at /admin) and a one-minute cookie that carries a "done" message from one admin page to the next.
Local storage: the site remembers a few things in your own browser, under keys starting iszackadad:. They never leave your device and we never see them:
- how many times you've checked the answer from the homepage (you may not want to know);
- whether you've already had the YES celebration, so it only ambushes you once;
- achievements you've unlocked, and what counts towards them: which of the site's pages you've read, which days you've visited and how many good vibes you've sent;
- Catch the Stork: your personal best, your last initials, and whether you turned the sound on.
One more lives in session storage, which forgets it when you close the tab: when the page last reloaded itself after a site update, so it can never get stuck reloading.
Clear them any time by clearing this site's data in your browser. Installing the site as an app also stores a copy of the offline page on your device, and turning on push stores the subscription in your browser as well as with us.
Who else is involved
That's the list. No analytics provider, no advertising network, no data broker, no AI. The site's Content-Security-Policy wouldn't let anyone else's scripts run, Turnstile's apart, even if we tried.
Getting your data deleted
- Email updates: every email has an unsubscribe link (one click, no "are you sure"). The address is deleted 30 days later.
- Push notifications: press "turn off" in the push section on the device concerned. The subscription is deleted on the spot.
- Webhooks: open the management link you were given when you added it (/webhooks/…) and press delete.
- Everything else (a pool guess, a wall message, a name suggestion, a stork score): open an issue on GitHub saying what to remove. Issues are public, so describe the entry (for example "the pool guess for Alex at 14 Nov 15:30"), and please don't post your email address or anything else personal there.
Under UK data protection law you can also ask what we hold about you, have it corrected, or object to it being kept, by the same route. If you think we've got it wrong, you can complain to the Information Commissioner's Office, who will be surprised to hear from you about this website.
Changes
This policy lives in a public repository, so every change is a commit with a date on it. The policy is run by Jess & Zack, who would rather be choosing a pram.