Privacy

The promise

No data sales, no lists but the one you join, and no measurement you have not allowed. Nothing about you is sold, rented or scored for anybody else. The public pages of this site are measured by Google Analytics and Google Ads only if you allow it: the site asks on your first visit, and without your yes — before you answer, and after a no — Google’s tag runs with every cookie refused and sends Google only pings that carry no cookie and no identifier, from which it estimates the visits it cannot count. For a visit from Washington, nothing of Google’s runs on the page until you have said yes. Cookie preferences, at the foot of every page that is measured — this one among them — changes the answer at any time, and Do not sell or share my personal information, beside it, says no to advertising in one press. A browser that sends Global Privacy Control has said that no already, whatever the banner records, and nothing the store tells Google about a visit from it allows advertising. The store’s own tests of its words wait for the same yes to analytics before they set a cookie or count anything: see Cookies. Your account, and everything behind a sign-in, carries no analytics, no advertising and no third-party script at all. Card details never touch this site: you type them into Stripe, and Stripe keeps them.

What is held

An account. The email address you sign in with and when you first did. The six-digit code and the sign-in link are kept only as hashes and expire after ten minutes; whichever is used first retires the other. A signed-in browser carries one cookie, good for thirty days. Sign-in attempts are counted against a hash of the address and a hash of the network they came from — neither is stored as itself — and those counters are thrown away about an hour later.

Your language. Which of the languages this site is written in you read it in: the one you chose on your account page, or else the one of the page you signed in, bought or joined the list on. It decides the language of your own pages and of every email we send you, and nothing else.

Orders. What you bought, what you paid, the name and address it shipped to, the carrier and tracking number once it is on its way, and the Stripe identifiers that tie the order to the payment. Also a Stripe customer id, which is how Stripe knows you the next time — never a card number, never an expiry, never a security code; those go to Stripe and stay there.

Subscriptions. A mirror of what Stripe holds about a subscription you started: its state, its price, when it renews, when it was cancelled. Stripe is the record; this is the copy that lets your account page say so.

Support. The tickets you open on your account page and every message on them, and the mail that reaches support@humanruntimeformula.com or the store’s other addresses. Inbound mail is kept as it arrived, including its headers, so a reply can be threaded to the right conversation and a person can read what you actually sent.

The marketing list and its consent. If you give an email address to one of the forms on this site, we keep the address, which form it was, what was offered, the day, the language of the page, and the version of the words you ticked. Every marketing email carries a one-click unsubscribe, and an address that unsubscribes is not written to again. Your account page has the same switch.

What we sent you. A ledger of every email this site sent to your address — the confirmation, the shipping notice, a reply on a ticket — so your account page can show it and so nothing is sent twice.

Referrals. If your first order comes through a link one of our affiliates shared, your account is noted as theirs, and every order you place afterwards earns them a commission. They are shown what each order came to and when, and never your name, your address or anything else about you.

Affiliates’ own records. If you are one of our affiliates: your code, your rate, what each order earned you, what you cashed out, and the Stripe account it was paid into. Stripe confirms who you are and holds your bank and tax details; we hold none of them.

Measurement, if you allowed it. With analytics allowed, Google Analytics is told which public pages you read, where you came from, and — when you leave an address, open a checkout or buy — that you did, with the amount, under a random identifier it keeps in a cookie on your browser. With advertising allowed, Google Ads is told the same about the advertisement that brought you, and, when you leave an address or buy, a one-way hash of your email address, which lets Google match a sale to an advertisement without being told the address. With both allowed, the store builds audiences from what Google Analytics is told, and uses them in Google Ads to show its advertisements to people who have visited. So that a sale can be reported once Stripe confirms it, those identifiers ride on the checkout you open with Stripe, and this site keeps them, the amount and — with advertising allowed — the hash in a ledger for ninety days. A subscription keeps the analytics identifier for its renewals, which are reported to Google Analytics as the revenue they are and never to Google Ads.

Logs. The operational record of requests, kept for thirty days and then deleted. It never holds a sign-in code, an email address, a card detail or an order’s contents.

Cookies

Two of the store’s own, both necessary, and only once you sign in: one that says a sign-in is under way, and one that says you are signed in. Both are signed, sent only over HTTPS, and unreadable by script. A third, hrf_consent, remembers the answer you gave about measurement for six months; it is the one cookie a public page sets before you have answered, and it carries nothing but the answer. If you allow analytics and then leave an address or open a checkout, the store gives this browser the same random number a test of the site’s words keeps in __Host-hrf-visitor (below), or reads the one it already holds, and notes what you did under it. When you sign in from this browser, what you did here before — an address left, a checkout opened — is filed under your account, and when you sign out, what this browser does afterwards is filed under nobody until somebody signs in here again; on its own the number proves nothing about who you are, shows nobody anything and is sent to nobody. A browser that sends Global Privacy Control or Do Not Track is never given it. If you allow analytics, Google Analytics sets its own _ga cookies, for up to two years; if you allow advertising, Google Ads sets _gcl cookies, for ninety days. Saying no, or taking a yes back, removes them.

A link one of our affiliates shared. Following one sets a cookie of the store’s own, __Host-hrf-ref, on the way to the page it names. It holds their code — nothing about you — for thirty days, so that an order you place is credited to them. Nothing you do here needs it, and the site works the same without it. It is signed, sent only over HTTPS, and unreadable by script.

A test of the site’s words. Sometimes the store tries other words on part of its visitors — another headline, another title — to learn which say it better. If you allow analytics, then while a test is running a page it changes sets one more cookie of the store’s own, __Host-hrf-visitor, so you read the same version on every page and every visit. It holds a random number and which version you were shown, nothing else; it is signed, sent only over HTTPS and unreadable by script, and it lasts ninety days. If you leave an address, open a checkout or buy while you hold it, that is counted once toward the version you were shown, and the counts are kept by version, never by person; the note that keeps you from being counted twice names a scrambled form of the random number, never your address, and is deleted after ninety days. A checkout you open carries the same scrambled number and the versions through Stripe, so the purchase is counted too. Without a yes to analytics — and for the people who run the store, and a browser that sends Global Privacy Control or Do Not Track — there is no such cookie: you read the words as written and are counted nowhere. Taking the yes back removes it on the next page you read.

Stripe’s checkout page is Stripe’s own site, with Stripe’s cookies, and you leave it the moment you have paid.

Who sees it

The people who run Human Runtime Formula see the records their roles reach: whoever handles orders sees orders, whoever answers support sees tickets, and nobody sees a card.

Stripe processes the payment. It sees your card, your email, the shipping address you type into its page and the amount, under Stripe’s own privacy policy. Its customer portal is where a subscription is changed or cancelled. It also pays our affiliates, into accounts they set up with Stripe themselves.

Supliful packs and ships the bottle. It is given your name, the shipping address and what to send, and it hands back a tracking number. It is not given your email address for its own use, and it is not given your card.

Amazon Web Services hosts it, in the United States: the records in a database table, the mail in a private bucket with no public address of its own. Email is sent and received by Amazon SES from addresses of ours.

Google receives what you allowed: through Google Analytics, the public pages you read and the visits that left an address, opened a checkout or bought, with the amounts; through Google Ads, which advertisement brought you and the same three acts, with a one-way hash of your email address. Without your yes, it receives only the pings said above, which carry no cookie and no identifier. Google is never told your name, your shipping address, your email address itself or anything you wrote to support, and nothing behind a sign-in is measured at all. What Google does with what it receives is under Google’s own privacy policy. Beyond these, Human Runtime Formula discloses what it holds to nobody, or where the law leaves no choice.

How long

Sign-in codes and links last ten minutes; a session lasts thirty days; the counters behind the rate limits last about an hour; the cookie that keeps a test steady, and the note that you were counted in one, last ninety days; logs are deleted after thirty days. Orders are the store’s books and are kept for as long as books must be, and so are the referral program’s: whose referral a customer came through, what each order earned and what was paid. An address on the marketing list that never bought anything is redacted after two years. The words of an email we sent you come off the ledger after two years; that it was sent stays. A ticket and its mail are kept while the account stands, or until you ask. A row of the measurement ledger is deleted ninety days after the visit it records; Google keeps what it was sent for as long as the store’s Google Analytics and Google Ads accounts are set to.

Asking

To see what Human Runtime Formula holds about you, to have a copy of it, to correct it, or to have it deleted, write to support@humanruntimeformula.com. Say enough to find it — the email address you ordered with, an order number — and a person will answer. Deleting an account does not delete the books an order is written in; it does delete everything else.

Human Runtime Formula LLC, 1259 El Camino Real, Menlo Park, CA 94025.
(415) 779-0767. support@humanruntimeformula.com