Privacy Policy

What we collect, and why

We collect as little as possible. In practice, that means:

• Analytics. We use Umami, a privacy-focused analytics tool we host ourselves. It records aggregate page views: which pages were visited, the referring site, browser and device type, and approximate country. It does not use cookies, does not collect your name or email address, and does not track you across other websites.
• Emails you give us. If you subscribe through a form on papacasper.com or shop.papacasper.com, email us at a @papacasper.com address, or place an order, we keep your email address to send what you asked for, deliver your order, or reply to you. The newsletter is covered in detail below.
• Orders. Shop checkouts run through Polar, which acts as the merchant of record and processes your payment. We receive the order details needed for fulfillment: your email address, the product bought, and, for website audits, the website address you submit for auditing. Payment card details never touch our servers.
• Toolbelt usage. The MCP Toolbelt is pay-per-call. We keep aggregate usage counts (which tools were called, how often) for billing and statistics. No account is required, and payment is handled through the x402 payment facilitator, not by us directly.
• Affiliate clicks. Links on affiliate.papacasper.com take you to Amazon. Amazon may set its own cookies and collect data under Amazon's own privacy policy. We may earn a commission if you buy something; we do not receive your Amazon account information.
• DNS. The test page on dns.papacasper.com runs its checks in your browser. DNS queries sent to our public DNS-over-HTTPS endpoint are processed solely to return DNS answers. We do not sell DNS query data and do not use it for advertising.
• Server logs. Like almost every website, our servers keep standard logs for a limited time for security and troubleshooting: IP address, browser type, and pages requested. These logs are not used to build profiles about you.

We do not sell your personal data, and we do not share it for advertising.

Newsletter

• What we store. Your email address, the date and time you signed up and confirmed, your subscription status, and a one-time confirmation token. Nothing else: no name, no tracking profile.
• Double opt-in. After you enter your email we send one confirmation email. You are only added to the list after you click the confirm link, which expires after 48 hours. Until then you get no newsletters.
• Retention. Sign-ups that are never confirmed are deleted after 7 days. Confirmed subscribers are kept until they unsubscribe. When you unsubscribe we keep only a minimal record that the address opted out, so we never email it again; ask us and we will delete that too.
• Unsubscribe any time. Every newsletter has a one-click unsubscribe link (and supports the unsubscribe button in Gmail and other mail apps). You can also email [email protected].
• Who sends it. Newsletters are sent from our own mail server. Your address is not shared with or sold to anyone.
• Legal basis. Your consent, which you can withdraw at any time by unsubscribing.

Analytics (Umami)

We measure visits with Umami, which we host ourselves at analytics.papacasper.com, so the data never goes to a third-party analytics company. Umami sets no cookies and stores nothing on your device. It counts page views, the referring site, browser, device type and approximate country, and it does not store your full IP address or follow you across other websites. Because it is cookieless and anonymous, it does not need a cookie banner. Our legal basis is our legitimate interest in understanding, in aggregate, which pages are useful.

Payments (Polar)

Purchases from shop.papacasper.com, including website audits and paid plans, are processed by Polar, which acts as merchant of record and handles payment, tax and receipts under its own privacy policy. We never see or store your card details. We receive your email address, what you bought, and (for website audits) the website address you want audited, and we keep order records as long as tax and accounting law requires.

MCP Toolbelt API plan

When you subscribe through Polar we receive and store your email address and your Polar customer and subscription IDs. We also keep a one-way hash of your API key (never the key itself), your plan, and monthly usage counts. We don't log the contents of tool calls against your key. Payment data is handled by Polar, our merchant of record. When a subscription ends the key is disabled, and the record is deleted 30 days later. To ask for earlier deletion or a replacement key, email [email protected].

Fonts and third-party content

Our link pages (papacasper.com and papacasper.com/spooky) use fonts already on your device and do not load fonts, scripts or embeds from Google or other third parties. If we add a video embed (for example YouTube or TikTok), that provider may collect data when the video loads, under its own policy.

Cookies

Our own sites do not set first-party tracking cookies. That is why you will not see a cookie banner here: there is nothing non-essential of ours to consent to. Two exceptions sit outside our control: Cloudflare, which fronts papacasper.com for security and performance, may set security cookies; and third parties you interact with, such as Polar or Stripe at checkout and Amazon after you click an affiliate link, may set their own cookies under their own policies.

Legal bases (GDPR)

Where the EU General Data Protection Regulation applies, we process personal data on these bases: your consent (newsletter subscriptions), performance of a contract (delivering an order or audit you bought), and our legitimate interests (keeping the sites secure and measuring aggregate, cookieless analytics). You may withdraw consent at any time by unsubscribing or contacting us.

Your rights

Under GDPR and US state privacy laws such as California's CCPA/CPRA, you may ask us to show you, correct, or delete the personal data we hold about you, to send you a copy of it, to restrict or object to processing, to withdraw consent, and to opt out of any sale of it (we do not sell personal data, so there is nothing to opt out of). Email your request to [email protected]and we aim to respond within 30 days. We will not treat you differently for exercising these rights. If you are in the EU or UK you may also complain to your local data protection authority.

Affiliate disclosure

As an Amazon Associate, PapaCasper earns from qualifying purchases made through links on affiliate.papacasper.com. Some links elsewhere on our sites are referral or affiliate links, for example the NordVPN link on our homepage, and may earn us a commission at no extra cost to you. They are labelled "Affiliate link". The company you visit may set its own cookies under its own privacy policy.

Children

Our sites are not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.

International transfers

Our servers are located in the United States. If you visit from outside the US, including from the European Union, your data may be processed in the US when you interact with our sites.

Changes to this policy

If we change how we handle data, we will update this page and change the effective date above. Significant changes will also be noted on the affected site.