Privacy & cookies
What we collect, and why.
Clarity is built privacy-first: the educational content is open and free, never walled, and asks nothing of you. Personal data is only involved if you choose to request a value asset or join updates.
You can read every page on Clarity without providing anything — no account, no email, no identified tracking. Personal data only enters the picture if you choose to request a value asset or accept the analytics cookie. The sections below describe exactly what is collected, why, who processes it, and how to opt out.
What we collect & why
- Name and email — only when you submit the form to request a value asset (e.g. the test-request checklist) or to receive occasional updates. Used solely to deliver what you requested and the updates you consented to.
- Aggregate, cookieless analytics (Cloudflare Web Analytics) — privacy-first traffic metrics (page views, referrers, Core Web Vitals) with no cookies and no cross-site tracking. This runs pre-consent because it does not identify you.
- Product analytics (PostHog) — behavioural events tied to a session, and to your email only if you have submitted it. This loads only after you opt in via the cookie/consent banner.
- Anti-spam data — on form submission we store a one-way hashed IP (never the raw address) and use a bot challenge, to rate-limit abuse.
Lawful basis & consent
The lawful basis for storing your name and email is your explicit consent, given via an unticked checkbox you choose to tick. Sign-up uses double opt-in: you must confirm via a link emailed to you before anything is stored as confirmed. Non-essential, identified analytics load only after you accept the consent banner; you can decline and still use the site fully.
How long we keep it
Email-list data is retained until you unsubscribe or ask for erasure, after which it is removed promptly. Unconfirmed sign-ups are discarded if not confirmed. Aggregate analytics are not tied to your identity.
Your choices
- Unsubscribe — every email has a one-click unsubscribe; it takes effect immediately.
- Erasure & access — you can ask us to delete or provide a copy of your data at any time, via hello@clarityskin.xyz.
- Analytics — decline the consent banner, or at any time, to stop identified analytics. The aggregate, cookieless metrics never identify you and run regardless.
Processors
We share the minimum necessary with vetted processors under data processing agreements:
- Cloudflare — hosting, content delivery, and cookieless Web Analytics (aggregate only, no identification).
- Supabase — secure storage of subscriber records.
- Email provider — double opt-in confirmation and update emails.
- PostHog — product analytics (EU hosting), loaded only post-consent.
We never sell your data and never wall the educational content behind it.
Contact
Questions, access, or erasure requests: hello@clarityskin.xyz.