Privacy Policy

Last updated: May 19, 2026

This page explains, in plain language, what personal information we collect when you visit bonnieip.com, join our email list, or subscribe to Market Trends, and what we do with it.

What we collect

When you submit your email address on this site, we store:

Your email address.
Your IP address and browser user-agent string at the moment of signup. This is used only to detect abuse (bots, repeated submissions) and is never shared.
The form you submitted from (e.g., the hero capture or the bottom CTA), so we can learn which parts of the site convert best.
The timestamp of your signup.

We do not use cookies, analytics scripts, advertising trackers, or session identifiers. There is no behavior tracking on this site.

Why we collect it

To send you the launch announcement when the Etsy shop opens, plus a small number of pre-launch emails (a "1 week to go" note, a "3 days — first look" preview, a "tomorrow at 9am" reminder, and the launch email itself). After launch, you may receive occasional notes when a new piece is added — never more than monthly. You can stop receiving any of these at any time using the unsubscribe link in every email.

Who we share it with

Two third-party services process this data on our behalf:

Cloudflare — hosts this site and stores the subscriber list (Cloudflare D1). See Cloudflare's privacy policy.
Resend — delivers the emails we send to you. See Resend's privacy policy.

We do not sell, rent, or share your email address with anyone else, ever.

Market Trends subscription (paid)

If you subscribe to Market Trends via /pricing, additional data flows are involved. This section covers them.

What we collect for paid subscribers:

Your email address and Stripe customer ID (so we can identify your subscription).
Subscription status (active, canceled, past due) and plan (monthly or annual).
The current billing period end date.
A short-lived magic-link token (a one-time random string) when you ask us to email you a sign-in link. This token is deleted from our database as soon as you click the link.
Your last sign-in timestamp.

We do not see or store your credit card details. All payment information is collected and processed directly by Stripe.

How sign-in works: we use passwordless magic-link authentication. When you request a sign-in link at /login, we email you a URL containing a one-time token. Clicking it sets an HTTP-only, HMAC-signed session cookie (bonnieip_session) in your browser. The cookie expires after 30 days. We do not use any third-party analytics, advertising trackers, or behavioral tracking cookies on the site.

Additional third-party processors for paid subscribers:

Stripe — processes your payment, stores your card details, and manages your subscription. See Stripe's privacy policy. Stripe is a US-based company; if you are in the EU/UK, Stripe relies on Standard Contractual Clauses for cross-border transfers.
Resend — also handles the magic-link sign-in emails, in addition to the marketing emails described above.
Cloudflare — also stores your subscription record (Cloudflare D1) and the signed session cookie's signing secret (Cloudflare Pages env).

Data retention: we keep your subscription record for as long as your account is active, plus 12 months after cancellation for billing-record purposes. After that we delete the record. Magic-link tokens are deleted within 24 hours of issue (or immediately on use). Research-session data (the trends themselves) is retained for 90 days unless pinned by the site owner.

Cancellation: you can cancel at any time via the Account page, which opens the Stripe Billing Portal. Cancellation takes effect at the end of the current billing period (you keep access for the time you've already paid for). To delete your account entirely, email us at [email protected].

Your rights

You have the right to:

Unsubscribe — click the unsubscribe link at the bottom of any email we send you, and we will stop emailing you immediately.
See what we have on file about you — email [email protected] and we'll send back the row we have for your address.
Have your data deleted — email [email protected] and we'll permanently delete the row, usually within 24 hours.

If you are in California (CCPA) or the European Union / United Kingdom (GDPR), the same rights apply to you under those laws. We will respond to a verified deletion or access request without charging you and without requiring you to create an account.

Children

This site is not directed at children under 13, and we do not knowingly collect information from anyone we believe to be under 13. If you become aware that a child has submitted their email, please email us and we will remove it.

Changes to this policy

If we change this policy in any meaningful way, we will email everyone on the list with a summary before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision.

Contact

Questions about this policy? Email [email protected]. We aim to reply within two business days.

← back home