Privacy

What we collect on bassclef.dev and docs.bassclef.dev, why we collect it, who sees it, and how to reach us.

Last updated: September 18, 2026.

bassclef is one person's project. This page tells you what happens when you visit bassclef.dev, read docs.bassclef.dev, or sign up for the mailing list. It is short on purpose. If something feels missing, email [email protected] and I will update the page.

What we collect

What you type

The mailing list form on bassclef.dev asks for a few fields. We store what you type.

Email (required) — where the confirmation and updates go
OS (required) — helps me spot install and hook bugs by platform
Role (optional) — tells me which persona you fit
GitHub handle (optional) — used only for a private-repo invite before v1.0
X handle (optional) — not used for anything today; kept in case a channel opens later

That's it for the form.

What we collect on the visit

First-touch attribution — if you land with UTM tags or a short k link, your browser stores that record in localStorage for later. Nothing about you goes to the server until you submit the form. On submit, the stored record joins your signup row.
IP address (transient) — the signup endpoint counts requests per IP for rate limiting. The counter lives about 15 minutes then discards. We do not store your IP with your signup row.
Anonymous page analytics — Cloudflare Web Analytics runs on both bassclef.dev and docs.bassclef.dev. It counts pageviews, referrers, and country. It does not set cookies, and it does not identify you. The dashboard shows only aggregates.

We do not fingerprint your browser. We do not run ad trackers. We do not sell data.

Why we use it

Send the confirmation email — after you sign up, an email lands with a one-click link. Clicking it moves your row from pending to confirmed.
Send weekly updates — one note per week when there is something worth telling you. Unsubscribe link is in every email.
Attribute traffic sources — the UTM record helps me tell which links or posts drove signups. Aggregate only; no per-person profiling.
Rate-limit abuse — the IP counter blocks bursts from one address so the endpoint stays up for everyone.
Diagnose install bugs — the OS field helps me route a bug report to the right code path when you email me later.

Everything runs on Cloudflare. When you submit the form, Cloudflare handles the request, stores your row in a KV namespace, and calls the Cloudflare Email API to send your confirmation.

Cloudflare — processor for Pages, KV, Turnstile (the "prove you're not a bot" check on the form), Web Analytics, and Email Sending. Cloudflare's own privacy terms cover their handling. Data centers are global; the KV row and rate-limit counter live in Cloudflare's edge network.
Google (Gmail) — every confirmation email carries a BCC to [email protected] so I can see delivery. Google sees the recipient address and the message body on both send and BCC.
Substack — some links in the mailing list emails point to sunjaypandey.substack.com. Substack sees a referrer when you click through. We do not share your email with Substack.

We do not share your data with advertisers, analytics vendors beyond Cloudflare, or any third party not named here.

How long we keep it

Signup rows — until launch. When bassclef ships v1.0, we will migrate the list to a production mailing system with the same policy or delete rows on request. Ask any time.
Rate-limit counters — about 15 minutes, then Cloudflare discards them.
First-touch record in localStorage — lives in your browser until you clear site data. Nothing about it reaches us until you submit the form.
Cloudflare Web Analytics — aggregate stats per Cloudflare's retention. We do not control this window; the dashboard shows a rolling one-month view.

Cookies

We do not set cookies on either surface.

Cloudflare Turnstile (the "not a bot" widget on the signup form) may set a short-lived cookie on challenges.cloudflare.com while you complete the challenge. That cookie is Cloudflare's, not ours. It expires within minutes.

Your choices

Unsubscribe from the mailing list — click the unsubscribe link in any email you receive, or reply with "unsubscribe" and I will remove you within a day.
Delete your signup row — email [email protected] and I will remove it within 30 days. You will get a confirmation reply.
Ask what we have on you — same email address. I will send back the row we hold for your email.
Correct anything — reply to any email or send a note to the same address.

Cross-border transfers

Cloudflare's edge network is global. Your signup row may live in a data center near you or in another region. If you are in the EU or the UK, Cloudflare's own compliance terms apply; they publish their subprocessor list and processing terms at cloudflare.com/privacypolicy.

We do not add processors beyond the ones named above without updating this page first.

Security

The signup endpoint runs over HTTPS. Cloudflare handles TLS and the edge network. Signup rows sit in Cloudflare KV, which is encrypted at rest per Cloudflare's own security posture. The confirmation-email BCC is the operator's Gmail address, which uses Google's standard security controls.

We hold no passwords, no billing data, no health data. If something worse than a spam email lands in your inbox because of a bassclef breach, that would be a shocking surprise given the surface.