Privacy policy
We collect as little as we can. This policy describes what we store when you sign up or follow a story.
What we collect
- Email address, if you sign up or subscribe. We use it only to send a sign-in link, story alerts you asked for, and the newsletter if you opted in (off by default).
- Follows and alert preferences attached to your account.
- Sponsorship bookings, if you advertise with us: brand, contact name, destination URL, banner images, alt text, and the placements you book.
- A session cookie (
__Host-session), HttpOnly, Secure, SameSite=Lax, lasting 30 days, so you stay signed in on that device. - Technical logs such as IP address and user-agent, used for rate-limiting and abuse prevention, retained briefly.
- Analytics: Cloudflare Web Analytics (privacy-friendly, no advertising cookies) and, once set up, Google Analytics 4.
What we do not do
We do not sell your personal data. We do not use a password — sign-in is a one-time email link that expires in 15 minutes and works once. Entering someone else's email only sends a confirmation to that inbox; no account is created and no mail is sent to our list until the link is clicked.
Cookies
The session cookie is essential if you sign in. Theme and last-visit catch-up are stored on your device only (localStorage). Advertising cookies will only appear if and when AdSense is approved; we will update this policy then.
Your choices
You can log out, log out of all devices, change alert settings, unfollow stories, or delete your account (which removes your email, follows and sessions) from the account menu. Every email will have a one-click unsubscribe. For any request, email hello@breakingonxnow.com.
Retention and security
Unused sign-in requests are deleted after a day. The site is served over HTTPS on Cloudflare, with security headers, bot protection and a firewall on the API. We hash sign-in and session tokens; we never store the raw token.