Privacy

• The site collects very little: a log of requests, and one cookie once you enter your license key.
• The payment company that runs the checkout handles your payment, under its own privacy policy. I never see your card details.
• The site uses Google Analytics 4 to see which pages get read and where visitors came from. No ads, no Google signals. In the EEA, UK and Switzerland it doesn't set a cookie until you click Accept, and you can change your mind any time with the "Cookie settings" link at the bottom of every page.
• I don't sell your personal information.
• The app you build runs on your own computer and your own accounts. Nothing in it comes to me.

I am: Tim Haines, the person who sells Dorris. In privacy law I'm the "controller" of what this site collects. Write to me on the contact page about anything on this page.

Every visit

The server that runs this site writes a line to its log for every request: the time, the page asked for (without the part of the address after a question mark), the IP address the request came from, whether it worked and how long it took. The logs keep the site working and secure. They show, for example, someone trying key after key. I use them for nothing else.

The site also limits how often a key can be tried from one IP address, which makes guessing keys pointless.

Render, the company that hosts the site, handles all of this for me, and may keep records of its own about traffic to the site under its own privacy policy.

If you take the one-minute quiz, your answers are used to show your result and nothing else. They aren't stored, and the log leaves them out.

When you enter your license key

The site sends your key to the payment company to check that it's real and hasn't been refunded, and checks it again now and then while you use the paid pages. If the key is good, the site sets one cookie:

• Name: course_key
• What it holds: your license key and the time it was last checked, signed so that it can't be changed without the site noticing.
• Why: so the paid pages know you've bought without asking for your key on every visit.
• How long: up to 180 days at a time. Logging out deletes it straight away.

Scripts on the page can't read it, and your browser sends it only to this site. The paid pages can't work without it, so the site doesn't ask your permission first. It's the only cookie my own code sets. Where you've accepted Google Analytics, Google's script sets a couple of cookies of its own, see below.

What stays in your browser

Your browser's own storage, which isn't a cookie, remembers which checkpoints you've ticked, which part of the install page you were on and which kind of download you chose. It stays in your browser. The site never sends it to me, and I can't see it. Clearing this site's data in your browser wipes it.

When you buy

A payment company runs the checkout. It collects what it needs to take your payment and handle tax, such as your name, email address, billing address and payment details, under its own privacy policy. It and its card processor handle your card, and I never see your card number.

The payment company gives me what I need to deal with your order and any refund, such as your name, email address, country, what you bought and when.

The two questions after you buy

The page you land on after checkout asks two optional questions: the main reason you bought, and whether anything almost stopped you. If you answer, each answer is sent the moment you press the button to a private channel in my Slack workspace, together with the checkout's reference number. Your name and email address aren't sent, and the site doesn't keep a copy. I read the answers to work out what to make better. Skip them and nothing is sent.

When you write to me

If you use the contact page, I get your email address, your name if you give it, what it's about, whatever you write, and which page of this site you came from. The form hands them straight to the system my support runs in; this site doesn't keep a copy. Messages are read and answered by AI agents (built on Anthropic's Claude) that I run, and they bring me in for anything they can't settle, such as a refund they aren't allowed to give. Your message is sent to Anthropic to do that. I use it only to answer you, by email, and to deal with what you asked.

Analytics

The site uses Google Analytics 4 to understand how people use it: which pages they read and where they came from. That's all I use it for, not ads, not selling anything to you based on it.

Where it runs, Google Analytics sets its own cookies, separate from course_key:

• _ga and _ga_<container ID> tell new visitors from returning ones and keep one visit together as you move between pages. Both can last up to two years.

Google Analytics records the pages you view, the site that sent you (and, if you followed a marketing link, which one), your type of device and browser, and roughly where you are, which it works out from your IP address. I've turned off Google signals and ad personalization, so none of this feeds Google's advertising, and I never see your IP address or anything that identifies you by name. Google's own privacy policy explains what it does with what it collects.

The first time you visit, the site shows a banner asking whether you accept Google Analytics. In the EEA, the UK and Switzerland, it sets no cookie until you click Accept. Until then Google receives only a cookieless signal that a page was viewed, which it can't link to your other visits. Everywhere else, it runs by default, since it's never used for ads. Wherever you are, you can change your mind at any time with the "Cookie settings" link at the bottom of every page, or block it in your browser's settings or with a content blocker, the site works the same without it.

The site's own server also keeps a plain count of page views: which page was read, and the website that sent the visitor, if any. It's a running total, with no cookie, no IP address, no device details and nothing that could pick out one person, and it is sent every few minutes to the team that runs this site so we can see which pages get read.

Only the companies named on this page, each doing the job described here:

• Render hosts the site and keeps its logs.
• A payment company runs the checkout, takes payments and checks license keys.
• The company that hosts my email stores what you send me.
• Google runs the analytics, where you've accepted it.
• Slack holds the answers to the two optional questions after checkout, if you give them.

I don't sell your personal information, and I don't rent it or trade it. Beyond that list, I'd share it only if the law required me to, or to protect the site or someone's safety. If I move Dorris to a company of my own, or hand it on to someone else, the records go with it, under this policy.

• Server logs: up to 30 days, then deleted automatically, unless a particular log is needed to deal with abuse or a security problem.
• The cookie: up to 180 days at a time, or until you log out.
• Your browser's storage: until you clear it. Your cookie choice for Google Analytics lives here too, so clearing it means the banner asks you again.
• Purchase records: the payment company keeps its own under its policy. I keep mine for as long as tax and accounting rules require.
• Answers to the two questions after checkout: in my Slack workspace until I delete them. Ask and I will.
• Email: for as long as I need it to deal with what you asked, and as a record of refunds.
• Analytics: Google's own cookies (_ga and _ga_<container ID>) last up to two years, under the settings chosen for this site.

Wherever you live, you can ask me:

• what I hold about you, and for a copy of it;
• to correct it;
• to delete it;
• to stop using it for something, where the law gives you that right.

Ask on the contact page, giving the address you bought with if you can, so I can tell it's you. I'll answer within a month. Some things I have to keep, such as records of a sale that tax rules require, and I'll tell you if that applies. For what the payment company holds, you can also ask it directly.

You can also:

• log out, which deletes the cookie;
• clear this site's data in your browser, which deletes your ticks;
• refuse or block analytics, as described above.

If you're in the UK or the EU

UK and EU law asks me to say why I use your data. I use it:

• to give you what you bought: checking and remembering your key, and handling a refund (a contract with you);
• to keep the site secure and working, and to answer your emails (my legitimate interests, which I've weighed against yours);
• to keep the records tax law requires (a legal obligation);
• to learn from the two optional questions after checkout (my legitimate interests, and only if you choose to answer);
• for analytics, with your consent where the law requires it.

You have the rights listed above, plus the right to take your data elsewhere, to object to how I use it and to withdraw your consent at any time. You can complain to your data protection authority, which in the UK is the Information Commissioner's Office. I'd rather you told me first, so I can put it right.

I'm in the United States, and the companies named here may handle your data there and elsewhere, so it leaves the UK or the EU. Some of them rely on legal safeguards for that, such as the EU-US Data Privacy Framework or standard contractual clauses. Their own privacy policies say which.

The site is for adults who run businesses. It isn't meant for anyone under 16, and I don't knowingly collect anything from children. If you think a child has sent me something, tell me and I'll delete it.

The site runs over an encrypted connection, the cookie is signed and out of reach of scripts on the page, and guessing keys is slowed down. No system is perfectly secure, so treat your license key like a password.

This policy covers this site, not your app, because I never see your app. It runs on your own computer and later on a host of your own. The kit sends nothing to me, and it has no license check that phones home. Setting it up downloads open-source software from the places that publish it, the way any install does, and nothing about you comes to me. docs/where-your-data-goes.md, inside the kit, says exactly what the app sends where.

If your app holds your customers' data, you're responsible for it, and your own privacy policy may need to say so.

If I change this policy, the date at the top changes with it, and I'll say plainly here what changed. If a change means using data you've already given me in a new way, I'll ask you first where the law requires it.

The contact page, for questions about this policy, requests about your data, and anything else on this page.