What I collect
Email addresses, when you subscribe to the newsletter. Stored in a Supabase Postgres database. You'll get a confirmation email (double opt-in) and only receive the letter after you confirm. The letter is delivered through Resend. That's the entire email story.
Poll votes. When you vote, my server takes a random UUID I set in a cookie, combines it with your IP address and your browser's user-agent, and hashes the whole thing into a single SHA-256 string. That hash is stored alongside your vote so the same browser can't cast the same vote twice. I never see your IP in plain text and there's no way to reverse the hash back to identifying information.
Anonymous visitor counts. So I know roughly how many people read the site, my own server — no third party — turns each visit into a single number. It takes your IP address and browser user-agent, mixes in a random secret that's regenerated every day and never written to disk, and hashes the whole thing with SHA-256. I store only that hash, and only to count one visit per browser per day. There's no cookie involved, the raw IP is never saved, the hash can't be reversed, and because the daily secret is thrown away each night the same hash can't be tied from one day to the next — or back to you. It's the same technique I use for poll votes, just for a headcount.
Server logs. Like every server on the internet, my host sees the URLs you request and the IP address that requested them. I don't aggregate or sell that. I look at it only when something breaks.
What I don't collect
- No third-party analytics — Google Analytics, Vercel Analytics, PostHog, Mixpanel, none of it. The only measurement is the cookieless daily visitor count described above, computed on my own server.
- No advertising or retargeting pixels — Facebook Pixel, Google Ads, none of it.
- No third-party tracking scripts.
- No session replay.
- No persistent identifier or profile that follows you across pages, days, or sites.
- No personal information beyond what's described above.
Cookies and local storage
One functional cookie: np_vid. Server-set, HTTP-only, SameSite=Lax, expires in one year. Holds a random UUID used to generate the vote hash above. Without it, polls can't prevent duplicate votes.
One localStorage entry per poll you vote on: np-voted-<slug>. Hides the vote form on devices that already voted. Stored in your browser. Never sent to me.
No third-party cookies. No advertising cookies. No analytics cookies.
How long things stick around
- Email: until you unsubscribe. Every newsletter has a one-click unsubscribe link.
- Vote hashes: indefinitely, until I delete the poll.
- Visitor-count hashes: kept as anonymous per-day rows. They're already impossible to tie to you once that day's secret is discarded, so they stay only as a historical headcount.
- Cookie: one year, or until you clear your browser data.
- Server logs: rotated per my host's policy (typically 30 days).
Who has access
Me. The data lives in Supabase (AWS) and, when configured, Resend (AWS). Neither sells your data to advertisers. Both have their own privacy practices, which they publish on their own sites.
Your rights
Email me at newsletter@neo-pioneer.com and I'll:
- Delete your email from the subscriber list.
- Confirm what's stored about your email if you ask.
- Delete poll-vote rows tied to a cookie UUID, if you can send me the value.
If you're in the EU/UK or a US state with a comprehensive privacy law (California, Virginia, Colorado, Connecticut, Utah, others), those are also your statutory rights — same process, same email.
Children
NeoPioneer isn't directed at anyone under 13. If you're under 13, please don't subscribe.
Changes to this policy
If this policy changes, the date below updates. Material changes get mentioned in the next newsletter.
Last updated: 2026-06-03 · newsletter@neo-pioneer.com