What we know about you, and what we do not.
Last checked 15 September 2026. What changed: the last section, which points at the terms and refunds page. Nothing about what we collect moved.
The short version
You give us one thing, and it is your email address. We do not sell it, rent it or hand it to anyone for advertising. This site sets no cookie and carries no third-party tracker. We write to you for fourteen mornings, then at most once a week, and one tap ends that for good. Ask us to delete you and we do, without asking why.
What you type
Your email address, in the one field on the front page. Nothing else is asked for anywhere: no name, no password, no birthday, no phone number.
If you buy something, the checkout page belongs to our payment provider and collects what it needs to charge the card, plus a postal address if a parcel has to reach you. Card numbers never touch our side. We see that an order was paid, the address to send it to, and nothing more.
What we record without asking
The country your request came from, read from the network and kept on your row. Never a city, never a street, never a map.
Which card you opened, and when. Your page has to know which card comes next, and once a night we count how many people opened one with no message from us in the day before. That count is the only thing we measure ourselves by. Nothing about it is ever shown back to you: there is no score, no total, no record of the mornings you missed, because none is kept.
A short code, if you arrived through a link someone shared, so we know which link brought you.
One number a day: how many times the front page was read. It names nobody and belongs to no one person.
Your IP address
It is touched once, in the second you send us your email address, so that one address cannot submit a thousand times. It is mixed with your email into a one-way hash that cannot be turned back, and the result is thrown away within the hour. We never store your IP address and we never use it to measure anything.
Cookies and trackers
There are none. Our pages set no cookie of any kind, first or third party, and load no advertising pixel, no social pixel and no analytics product. You are not asked to accept anything, because there is nothing to accept.
That is a statement about the code we write and the bytes we publish, and we check it against the live site rather than trusting it. Our host serves those bytes, and if that ever stops being true we will say so here.
When we are allowed to email you
Not until you tap the link in the message headed “confirm it’s you”. Two honest exceptions: that confirmation itself, which has to be sent before you can confirm anything, and the receipt and delivery notes if you buy something, which go to the address that paid.
After that it is fourteen mornings, then at most one note a week. The foot of every message ends it in one tap, honoured at once and for good, with no confirmation step and no offer to stay. Leaving ends the email only: your card page keeps working, and your cards stay yours. There is no reminder mail, no cart mail, no win-back and no review request. Nothing here replies automatically, ever.
Links in our mail
Our messages are plain text. No images, no open pixel, nothing that reports back when you read one. To say it plainly: we do not record whether you opened an email. There is no field for it anywhere on our side, so there is no answer to give and nobody to give it to.
The service that carries the mail rewrites some links so it can count a tap, and one of those is in the footer it adds below our signature. Nothing it counts reaches your row here. The links we write are the ones we send you. We would rather that rewriting did not happen and we are working on it, so it is written here rather than left for you to find.
If you write to us
A person reads it, and a person answers. Your message is passed on in full to the founder’s own mailbox, so that a promise of a human reply has a human behind it.
Who else touches any of this
Vercel hosts the site. Neon holds the database, on Amazon Web Services in the United States. NanoCorp, whose legal name is Phospho Inc. of Wilmington, Delaware, sends our mail and runs the checkout page; Resend carries the mail and Stripe processes the card.
That is the whole list. There is no advertising network, no data broker and no analytics company on it. Your data is stored in the United States, and if you are writing from elsewhere, that is where it goes.
How long we keep it
Your address stays until you leave or ask for it to go. Unsubscribing ends the mail and keeps your page. Deletion removes your row and the record of which cards you opened, and it cannot be undone.
Orders are the one thing we keep after that, without the mailing list: a receipt has to stay true, and the law that governs a sale says how long the record lives.
What you can ask for
Write to positivity@nanocorp.app and ask for a copy of what we hold, a correction to it, deletion of all of it, or simply to be left alone. Nobody is asked why. Write from the address you signed up with if you can, since it is the only name we have for you.
If you are in the European Union or the United Kingdom, those rights are yours by law and this is how you use them. If you are anywhere else, they are yours here anyway.
Children
This was not built for children, and we do not knowingly keep an address belonging to anyone under sixteen. Tell us and it is gone the day we read your message.
When this changes
The date at the top moves and the change is described here. We will not quietly widen what we collect: if this page ever says we take more than it does today, it will say what and why.
The other half of this
What is for sale, what it costs, and how a refund works are on the terms and refunds page. A refund is granted on request and nobody is asked why.