Privacy
This page explains what data Clayworks collects through clayboicardi.com and the Clayworks bundle, why it's collected, and what your rights are. I'm Clay Haworth, the operator of Clayworks; contact details are at the bottom.
What I collect
- Email address. Collected when you join the bundle waitlist (via Tally) or purchase the bundle (via Lemon Squeezy). Used to deliver your purchase, send launch-window updates, and respond to support requests.
- Transaction record. When you buy the bundle, Lemon Squeezy (the Merchant of Record) processes the payment and sends me an order record: email, purchase tier, amount, transaction ID, and an optional GitHub username field for repository access.
- Aggregate page-view metrics. clayboicardi.com ships no analytics script and sets no cookies or other client-side storage. To understand which pages are useful, the site records one aggregate, privacy-preserving page-view event on the server (via Cloudflare's Analytics Engine) each time you open a page: the page's path, the country your request comes from (from Cloudflare's edge geolocation), the domain of the site that referred you (the referring link's path and any search terms are discarded — only the bare domain is kept), and a coarse "automated vs. human" flag inferred from your browser's user-agent (used only to tell crawler traffic apart from real visitors; the user-agent itself is not stored). No IP address is stored, no cookie is set, no cross-site or advertising identifier is used, and no per-visitor profile is built. Separately, Cloudflare processes standard request metadata (such as IP address and user agent) at its edge to deliver and protect the site; that data is aggregated and contains no personally identifying information for this site.
- Site audit tool (Lead-Path X-Ray). When you submit a website address to the audit tool at /studio/check/, that address and the public content of the page it points to are fetched and analyzed transiently to generate the findings shown back to you. Results are cached for up to 24 hours, keyed by the submitted page address, to avoid re-fetching. The page's load speed is measured via Google PageSpeed Insights, so the submitted address is shared with Google for that check. The page's public text content is also sent to Cloudflare's Workers AI (an on-network AI model) to generate the suggested improvements shown in the results; Cloudflare does not use Workers AI inputs to train its models, and those suggestions are cached with the rest of the result for up to 24 hours. The tool stores no account, sets no cookie, and keeps no per-visitor profile; the submitted address is not linked to your identity. A short-lived, per-IP rate-limit counter is kept only to prevent abuse and expires automatically.
What I don't collect
No browser fingerprints, no advertising-network identifiers, no behavioral tracking across sites, no email open-tracking pixels on messages I send.
Who I share data with
Clayworks uses a small number of third-party services, each with its own privacy practices:
- Lemon Squeezy processes payment and sends me the order record. See lemonsqueezy.com/privacy.
- Cloudflare serves and protects clayboicardi.com, and its Workers AI runs the on-network model that generates the audit tool's suggestions. See cloudflare.com/privacypolicy/.
- Tally hosts the waitlist form. See tally.so/help/privacy-policy.
- Google PageSpeed Insights measures the load speed of a page you submit to the site audit tool; the submitted address is sent to Google for that check. See policies.google.com/privacy.
I do not sell your data. I do not share it with advertisers. I do not share it with anyone outside the processors above.
Retention
- Waitlist signups are retained until you ask me to delete them or the launch window closes, whichever comes first.
- Purchase records are retained for five (5) years from the date of purchase to satisfy legal record-keeping obligations (tax, accounting) and the v1.x update window. After five years, records are deleted unless a longer retention period is required by law for the specific transaction.
- Aggregate page-view metrics are stored without any per-visitor identifier and are retained by Cloudflare's Analytics Engine for a limited rolling window, after which they age out; the site builds no per-visitor analytics or profiles.
Your rights (California Consumer Privacy Act)
If you're a California resident, you have the right to:
- Know what personal information Clayworks has collected about you.
- Delete the personal information I hold about you, subject to legitimate retention obligations (tax records, fraud prevention).
- Opt out of the sale or sharing of personal information for cross-context behavioral advertising. Clayworks does not sell or share for advertising purposes, so this right is automatic.
- Correct inaccurate personal information held about you.
- Non-discrimination for exercising any of these rights. Exercising them does not affect your purchase or support entitlements in any way.
- Designate an authorized agent to make requests on your behalf. Include the agent's name and your written authorization in the request.
Two further CCPA rights apply only when relevant to a business's practices: the right to limit use of sensitive personal information, and the right not to be subject to automated decision-making. Neither applies to Clayworks because Clayworks does not collect sensitive personal information (Social Security numbers, health data, biometrics, or precise geolocation) and does not use automated profiling or algorithmic decisions about consumers. Both rights are noted here for completeness; if Clayworks' practices change in either direction, this page will be updated.
To exercise any of the applicable rights, email me at the contact address below. I respond to verified requests within forty-five (45) days as required by California law.
Your rights (EU / UK residents — GDPR)
Lemon Squeezy processes orders globally as Merchant of Record, so EU and UK residents may buy the bundle. Under the GDPR and UK GDPR, you additionally have the right to: object to processing, restrict processing in certain circumstances, receive your data in a portable format (JSON or CSV), and lodge a complaint with your local supervisory authority. Email me at the contact address below to exercise these rights.
The legal basis for processing your data under GDPR Article 6 is performance of a contract (your purchase or waitlist signup), legitimate interest (responding to your inquiries, sending update notifications about software you bought), and consent (where applicable).
Children
Clayworks is not directed at children under thirteen. I don't knowingly collect data from children. If you believe a child's data has been inadvertently collected, email me and I will delete it.
Data breach notification
If I discover a security incident that compromises personal information I hold, I commit to:
- Notifying affected individuals by email within seventy-two (72) hours of confirming the incident, in accordance with the urgency standards of California Civil Code §1798.82 and GDPR Article 33.
- Including in the notice: the type of information affected, the date or estimated date range of the incident, a description of what happened, what I am doing to address it, and what you can do to protect yourself.
- If the incident affects more than 500 California residents, also notifying the California Attorney General as required by §1798.82(f).
- Cooperating with affected third-party processors (Lemon Squeezy, Tally, Cloudflare, Proton) to ensure parallel notifications where their systems are involved.
The compact scope of Clayworks (one operator, four named processors, no advertising stack) means the realistic surface for a breach is narrow. The commitment above applies regardless.
Changes to this policy
Material changes are noted at the top of this page via the "Last updated" date and announced in the bundle CHANGELOG. Continued use of clayboicardi.com or the bundle after a change date constitutes acceptance of the updated policy.
Contact
For any privacy question, opt-out request, deletion request, or correction request:
Related: Purchase Terms · License.