Privacy Policy

Operator: the pen name Mr. Nooice, based in the Philippines, writing for a worldwide audience. No real name or street address is published. Contact: hello@mrnooice.com or the contact form.

This policy describes what this site actually does today. It is a working template, not a lawyer-signed document. Frameworks I aim to respect: the EU GDPR and UK GDPR, the California CCPA/CPRA, the Philippine Data Privacy Act of 2012 (RA 10173), the US CAN-SPAM Act, and the US FTC endorsement guides for affiliate content.

What this site is

A statically generated blog plus a first-party newsletter. Readers do not get user accounts. I do not sell personal data, and I do not run a paid membership on this domain.

What I collect

• Newsletter. Email, optional name, the page you signed up from, status (pending, active, unsubscribed, bounced), confirmation and unsubscribe timestamps, and a one-click unsubscribe token. Signup is double opt-in.
• Email events. When Resend is configured, webhooks record sent, delivered, opened, clicked, bounced, and complained events against each campaign send so I can keep the list clean and see what was useful. Open and click tracking is Resend’s, not a third-party ad pixel I added.
• Contact and data requests. Name, email, subject or request type, and your message, stored in the same Postgres database and visible in the private admin inbox.
• Abuse controls. IP address (from forwarding headers) and email are used as keys in a short-lived rate-limit table. Honeypot fields are ignored and not stored.
• Hosting logs. Vercel may log IP address and user agent for security and reliability. I do not currently use Vercel Analytics or other product-analytics scripts.

Where it is stored and who helps

• Application host: Vercel.
• Database: Postgres via Neon (Vercel Marketplace), in my own tables — not a hosted ESP list I do not control.
• Email delivery: Resend, when RESEND_API_KEY is set. If it is not set, messages are logged locally for development and not handed to Resend.

Those processors act on my instructions to provide hosting, database, and email. I do not sell the list.

Why (lawful bases)

• Consent — sending the newsletter after you confirm; optional analytics or marketing cookies if you ever enable them in the banner (none load today).
• Legitimate interests — running the site, preventing spam, keeping bounce and complaint records, and answering contact forms.
• Legal obligation — keeping a suppression record so I do not email someone who unsubscribed (CAN-SPAM and similar rules).

Cookies and similar storage

See the cookie policy. In short: a first-party consent cookie after you choose; an httpOnly admin session cookie only after I sign in at /admin; theme preference in localStorage. There are no advertising cookies today.

Retention

Active and unsubscribed subscriber rows stay so I honor opt-outs. Contact and data-request messages stay until I handle and archive them. Rate-limit rows are short-lived. You can ask for deletion at hello@mrnooice.com or via the data request form, except where I must keep a suppression record.

Your rights

Depending on where you live, you may have rights of access, correction, deletion, portability, objection, and withdrawal of consent (GDPR/UK GDPR), and rights to know, delete, and opt out of sale/sharing (CCPA/CPRA). I do not sell or share personal information as those terms are used in the CPRA. Philippine residents may also contact the National Privacy Commission. Use the GDPR page to make a request, or email hello@mrnooice.com.

Children

The site is not directed at children. I do not knowingly collect data from anyone under 16.

International transfers

Hosting, database, and email providers may process data in the United States or the EU. If you subscribe from the EEA or UK, you understand the newsletter is operated from the Philippines using those processors.

Contact

Mr. Nooice. Email: hello@mrnooice.com. Contact form.