Legal

Privacy policy

Short version: we ask for an email address, we use it to send what you asked for, and you can have it deleted by writing to us. There is no password and no tracking script of our own. Where the site needs an identity — a mailbox request — signing in goes through Google or X.

Last updated: 13 November 2026 Applies to: copedal.net and the Copedal mailing list

Who we are

Copedal is a website run by one person, published at copedal.net. For the purposes of the GDPR we are the data controller for the information described below. You can reach us at [email protected] or through the contact page. There is no company behind the site in the sense of a staffed office; one person reads the mail.

What we collect

  • Your email address, when you submit any form on this site. It is the only thing required to send you something.
  • A tag for the quiz result (drive space, messy files, deletions, silent stalls, reply style), stored next to your subscription so the note you get matches the problem you picked. It is one of five fixed words, not free text.
  • Waitlist answers, if you join a product waitlist: which product, which agent you use, whether you are on Windows or macOS, and an optional one-line description of what you lost. The last field is optional, and whatever you type there is treated as confidential.
  • Sign-in details, if you sign in to request a mailbox: the provider's user id, the display name it returns, and for Google the email address. X does not return an address.
  • A mailbox request, if you ask for an address on this domain: the address you want, one or two sentences about what it is for, and the address we should reply to.
  • Survey answers, if you answer the survey: the options you pick, tagged with a random id your browser generates. That id is not your account, not your email address and not a fingerprint — clear your browser storage and the link is gone.
  • A quiz result, if you finish the quiz: which of the five problems you picked, plus the same random id and the language you were reading in. Nothing else is sent.
  • A suggestion, if you use the feedback form: the category, what you wrote, the page you were on, and an email address only if you choose to type one.
  • A hashed IP address, for the survey, the quiz and the feedback form: a one-way hash with a secret salt, used to rate-limit submissions so one script cannot fill the box. The address itself is not stored and the hash cannot be turned back into an address.
  • What your browser sends automatically: pages requested, time of the request, IP address and browser type, kept by our hosting provider in ordinary server logs. We use these only to keep the site up and to see whether a page is failing. We do not join them with your email address, and we do not build profiles from them.

We do not ask for your name, company, phone number or payment details. There is no password to create and none is stored, because signing in goes through Google or X and we never see their credentials.

Why we use it

  • To send the file, checklist or quiz result you asked for — the legal basis is the request you made.
  • To send occasional notes when a new step or a tool goes live. Every one of those emails has a one-click unsubscribe link, and unsubscribing works at any time — the legal basis is your consent, given when you confirmed the subscription.
  • To decide which tool to build first, by counting waitlist entries. The counts are aggregate.
  • To answer you if you write back.
  • To decide a mailbox request, and to keep the address working if it is approved — the legal basis is the request you made.
  • To decide what to build or explain next, from what the survey answers and suggestions say in aggregate — the legal basis is our legitimate interest in building something useful. No answer is published with an id or an address attached.
  • To keep the site working and to stop abuse — the legal basis is our legitimate interest in running the service.

We do not sell your address, and we do not hand it to anyone for their own marketing.

Cookies, local storage and what is in them

Four things are worth separating, because they are treated differently by law.

1. Our own storage — strictly necessary

The site stores one preference in your browser: the language you last picked (copedal.lang), plus a one-time flag that stops the site bouncing you between the two language versions. These live in your own browser's local storage. They are not sent to us, they carry no identifier, and they expire when you clear them.

If you answer the survey or take the quiz, one more value is kept locally: copedal.visitor, a random string made in your browser. It is what lets the survey skip questions you already answered. It contains no personal data, it is not shared across sites, and it disappears when you clear your browser storage.

If you sign in, one first-party cookie is set: copedal_session, an opaque random key that tells the server which session is yours. It lasts 30 days, it is HttpOnly and SameSite=Lax, it holds no name, address or provider token, and signing out deletes it on our side as well. Nothing else is set by us.

2. Fonts

Typefaces load from Google Fonts. That request tells Google your IP address and which page you were reading. We also set preconnect hints for the font host, which has the same effect. No cookie is set by this, but it is a third-party request and we would rather name it than hide it.

3. Advertising

Ads on this site are served by Google AdSense. Google and other third-party vendors use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your visits to this site and other sites on the internet. These cookies may include the DoubleClick cookie.

  • You can opt out of personalised advertising at Google Ads Settings.
  • You can opt out of third-party vendor cookies at aboutads.info/choices and, in Europe, at youronlinechoices.com.
  • If you are in the EEA, the UK or Switzerland, a consent message is shown before any advertising cookie is set. You can accept, refuse, or choose per-vendor purposes, and you can reopen the message later to change your mind.
  • If you refuse, you still see ads; they are not based on your previous browsing.

This site runs no analytics of its own — no Google Analytics, no pixel, no session recorder. If that ever changes, this section changes first.

Selling and sharing

We do not sell personal information for money, and we do not have a business that trades in it. Under the California Consumer Privacy Act, personalised advertising can count as "sharing" even when no money changes hands. If you want to opt out of that, use the Google Ads Settings link above, or send a Global Privacy Control signal — we honour GPC where the ad vendor supports it, and we do not use your email address for advertising in any case. We do not knowingly sell or share the personal information of anyone under 16.

Who processes it for us

  • Cloudflare — serves the site and runs the small function that handles sign-in and mailbox requests. It sees IP addresses as part of serving pages.
  • Zoho Mail — hosts the mailboxes on @copedal.net. Mail you send to an address on this domain is stored by Zoho and read by one person; mail sent from it leaves through Zoho's servers, which is also where the signing keys live.
  • Our email service provider — stores the addresses, tags and waitlist answers, and sends the emails you asked for. It is a processor acting on our instructions and does not use your address for its own purposes. The provider's identity is named on the contact page if you ask; we do not publish it as a standing list because it changes.
  • Google and X — sign-in, fonts and advertising, as described above. Signing in tells the provider that you used this site; that is unavoidable, and it is why the button says so before you click it.

These providers store data in the United States. Where a transfer out of the EEA or UK is involved, it rests on the standard contractual clauses those providers publish, or on their own adequacy arrangements.

How long we keep it

  • Email address and tags: until you unsubscribe, and 30 days after that while the removal propagates through backups. Ask us to delete instead of unsubscribing and we delete the record itself.
  • Waitlist answers: until the waitlist closes or you ask us to remove you, whichever comes first.
  • Sign-in record: the session key expires 30 days after it is issued, or immediately when you sign out. The provider id is kept only as long as there is a mailbox request attached to it.
  • Mailbox requests: kept until the request is decided, then deleted 90 days after the decision. Approved mailboxes keep their own mail under the retention below.
  • Mail in a copedal.net mailbox: whatever the account holder keeps there. Ask for the mailbox to be removed and the mail goes with it.
  • Survey answers, quiz results and the random id behind them: 180 days, then deleted by a scheduled job. Nothing is kept per person, so there is no archive to grow.
  • Suggestions: 365 days after they arrive, unless they are still unread — an unread suggestion is never deleted by the cleanup job.
  • Server logs: only as long as the hosting provider keeps them by default. We do not export or archive them.

Your rights

Wherever you are, write to [email protected] and you can ask us to:

  • tell you what we hold about you, and give you a copy in a portable format;
  • correct it;
  • delete it;
  • stop using it for anything beyond the delivery you asked for, including stopping marketing email while keeping the delivery;
  • opt you out of advertising-related sharing, as described above.

We answer within 30 days and we will not charge you for it. If you are in the EU or UK, you also have the right to complain to your local data protection authority; if you are in California, we will not treat you differently for exercising any of these rights. We may need to verify that the address you write from is the one on the list before deleting anything — that is the one check that protects you from someone else deleting your record.

Security

The site is served over HTTPS with a valid certificate. Access to the mailing list is limited to the one person who runs the site, and the list is not stored in this website's files. We never ask for passwords, API keys or payment details, including in the waitlist form — if someone claiming to be Copedal asks you for them, they are not us.

Children

This site is written for people running AI agents at work or on their own machines. It is not directed at children. We do not knowingly collect data from anyone under 13, or under 16 in the EEA and the UK. If you believe a child has sent us an address, write to us and we will delete it.

Changes to this policy

When this policy changes, the date at the top changes with it, and the change is what the new date refers to. If the change is about what we do with email addresses, we will say so in an email rather than only here. If you keep using the site or stay subscribed after a change, that counts as accepting the updated policy; you can always unsubscribe instead.

Contact

Questions about this policy, an access request, or a deletion request: [email protected]. Mail to that address reaches a person, not a ticket queue.

← Back to the site