Privacy
This page explains what data Clayworks collects through clayboicardi.com and the Clayworks bundle, why it's collected, and what your rights are. I'm Clay Haworth, the operator of Clayworks; contact details are at the bottom.
What I collect
- Email address. Collected when you join the bundle waitlist (via Tally) or purchase the bundle (via Lemon Squeezy). Used to deliver your purchase, send launch-window updates, and respond to support requests.
- Transaction record. When you buy the bundle, Lemon Squeezy (the Merchant of Record) processes the payment and sends me an order record: email, purchase tier, amount, transaction ID, and an optional GitHub username field for repository access.
- Aggregate analytics. Cloudflare Web Analytics measures page views, referrer, and approximate location at city-or-region granularity. The beacon is cookie-free and stores no personally identifying information. No advertising or cross-site tracking identifiers are set.
What I don't collect
No browser fingerprints, no advertising-network identifiers, no behavioral tracking across sites, no email open-tracking pixels on messages I send.
Who I share data with
Clayworks uses a small number of third-party services, each with its own privacy practices:
- Lemon Squeezy processes payment and sends me the order record. See lemonsqueezy.com/privacy.
- Cloudflare serves clayboicardi.com and runs the analytics beacon. See cloudflare.com/privacypolicy/.
- Tally hosts the waitlist form. See tally.so/help/privacy-policy.
I do not sell your data. I do not share it with advertisers. I do not share it with anyone outside the processors above.
Retention
- Waitlist signups are retained until you ask me to delete them or the launch window closes, whichever comes first.
- Purchase records are retained for five (5) years from the date of purchase to satisfy legal record-keeping obligations (tax, accounting) and the v1.x update window. After five years, records are deleted unless a longer retention period is required by law for the specific transaction.
- Analytics is aggregate-only by design; no per-visitor retention.
Your rights (California Consumer Privacy Act)
If you're a California resident, you have the right to:
- Know what personal information Clayworks has collected about you.
- Delete the personal information I hold about you, subject to legitimate retention obligations (tax records, fraud prevention).
- Opt out of the sale or sharing of personal information for cross-context behavioral advertising. Clayworks does not sell or share for advertising purposes, so this right is automatic.
- Correct inaccurate personal information held about you.
- Non-discrimination for exercising any of these rights. Exercising them does not affect your purchase or support entitlements in any way.
- Designate an authorized agent to make requests on your behalf. Include the agent's name and your written authorization in the request.
Two further CCPA rights apply only when relevant to a business's practices: the right to limit use of sensitive personal information, and the right not to be subject to automated decision-making. Neither applies to Clayworks because Clayworks does not collect sensitive personal information (Social Security numbers, health data, biometrics, or precise geolocation) and does not use automated profiling or algorithmic decisions about consumers. Both rights are noted here for completeness; if Clayworks' practices change in either direction, this page will be updated.
To exercise any of the applicable rights, email me at the contact address below. I respond to verified requests within forty-five (45) days as required by California law.
Your rights (EU / UK residents — GDPR)
Lemon Squeezy processes orders globally as Merchant of Record, so EU and UK residents may buy the bundle. Under the GDPR and UK GDPR, you additionally have the right to: object to processing, restrict processing in certain circumstances, receive your data in a portable format (JSON or CSV), and lodge a complaint with your local supervisory authority. Email me at the contact address below to exercise these rights.
The legal basis for processing your data under GDPR Article 6 is performance of a contract (your purchase or waitlist signup), legitimate interest (responding to your inquiries, sending update notifications about software you bought), and consent (where applicable).
Children
Clayworks is not directed at children under thirteen. I don't knowingly collect data from children. If you believe a child's data has been inadvertently collected, email me and I will delete it.
Data breach notification
If I discover a security incident that compromises personal information I hold, I commit to:
- Notifying affected individuals by email within seventy-two (72) hours of confirming the incident, in accordance with the urgency standards of California Civil Code §1798.82 and GDPR Article 33.
- Including in the notice: the type of information affected, the date or estimated date range of the incident, a description of what happened, what I am doing to address it, and what you can do to protect yourself.
- If the incident affects more than 500 California residents, also notifying the California Attorney General as required by §1798.82(f).
- Cooperating with affected third-party processors (Lemon Squeezy, Tally, Cloudflare, Proton) to ensure parallel notifications where their systems are involved.
The compact scope of Clayworks (one operator, four named processors, no advertising stack) means the realistic surface for a breach is narrow. The commitment above applies regardless.
Changes to this policy
Material changes are noted at the top of this page via the "Last updated" date and announced in the bundle CHANGELOG. Continued use of clayboicardi.com or the bundle after a change date constitutes acceptance of the updated policy.
Contact
For any privacy question, opt-out request, deletion request, or correction request:
Related: Purchase Terms · License.