Skip to content

Privacy Policy.

Last updated November 11, 2026

This site, steve-shead.com, is run by me, Steve Shead, from Portland, Oregon, USA. This page explains what I keep about you, why, and what you can do about it. If anything's unclear, email me at steve@steve-shead.com.

The short version: I keep only what the site needs to work. I don't sell your details or share them for advertising. Google Analytics only runs if you say yes.

What I keep, and why

  • If you buy something: your email address, the country (and US state) you choose for sales tax, what you bought and when, your IP address, and the order and payment references from PayPal. I need these to deliver your downloads, send your receipt, handle refunds, work out and report tax, and prevent fraud. You pay on PayPal's site: I never see or store your card or bank details.
  • When you download a file: the time and IP address of each download, to apply the download limits and spot links that have been shared.
  • If you ask for a free download: your email address and IP address, so I can send you the link and limit how many are sent.
  • If you create an account: your username, name and email address, a scrambled (hashed) form of your password that can't be read back, when you joined and last visited, and your IP address. Your orders, comments and reviews are linked to it.
  • If you subscribe to the newsletter: your email address, when you signed up and confirmed, and your IP address. Nothing is sent until you confirm by email, and every newsletter has an unsubscribe link.
  • If you comment or write a review: what you write, your username and your IP address. Comments and reviews are public, with your username.
  • If you use the contact form: your name, email address, message, IP address and browser, so I can reply. Messages are deleted after 30 days.
  • When you read posts: how many times each post is read, and an anonymous code made each day from your IP address and browser, so a reader is counted once a day. The code can't be turned back into your IP address, and a new one is used each day. I also count which websites send readers here, by the site's name only.
  • To keep the site secure: failed login attempts and an activity log of things like logins and changes, with IP addresses. Failed logins are cleared after a day, and the log after 30 days.

Cookies

Cookies are small files your browser keeps for a website. This site sets these:

  • xa_sessid keeps you logged in and remembers your cart while you're here. It's needed for the site to work, and ends when you log out or after a while of inactivity.
  • xa_valid is set only if you tick "Remember me" when you log in, and keeps you logged in for up to 7 days.
  • xa_liker is set only if you like a post. It holds a random code so the same person can't like a post twice, and lasts a year.
  • xa_consent remembers whether you accepted or declined Google Analytics, for a year.
  • Google Analytics cookies (named _ga and _ga_ followed by letters) are set only if you accept them.

Google Analytics

If you accept, Google Analytics records which pages you visit, roughly where you are, and what device and browser you use, so I can see what people read. Google handles that information under its own privacy policy. If you decline, nothing is loaded from Google. You can change your mind at any time with "Cookie settings" at the bottom of every page.

Who else handles your information

  • PayPal takes payments, under PayPal's privacy statement.
  • Bluehost hosts the site and its database, in the United States.
  • Google Workspace sends the site's emails, such as receipts, download links and the newsletter, and holds my email.
  • Google Analytics, only if you accept it.

I don't sell your personal information or share it for advertising. I'd only pass it to anyone else if the law required me to.

How long I keep it

  • Orders: as long as tax and accounting rules require, usually seven years.
  • Accounts: until you delete yours.
  • Newsletter: until you unsubscribe. After that I keep your address marked as unsubscribed, so you're never sent anything again by mistake. Ask, and I'll remove it completely.
  • Contact messages and the activity log: 30 days.
  • Backups: the site is backed up every day, and the last seven backups are kept.

Your choices and rights

  • Download a copy of your data, or delete your account, from your account page.
  • Unsubscribe from the newsletter with the link in any issue.
  • Email me to see, correct or delete anything else I hold about you. I'll reply within 30 days. I may need to keep order records that the law requires.

If you're in the European Union or the United Kingdom, you also have the right to restrict or object to how your information is used, to take it elsewhere, and to complain to your local data protection authority. I use your information to fulfil your orders and run your account (a contract with you), with your consent (the newsletter and Google Analytics), for legitimate interests (security, read counts and replying to messages), and to meet legal obligations (tax records). The site and its data are in the United States.

Children

The site isn't meant for children under 16, and I don't knowingly collect their information.

Changes

If I change this policy, I'll update it here and change the date at the top.