The short version: we collect what we need to run your site and nothing more. No advertising, no cross-site tracking, no selling or sharing data for marketing — not now, not later. This policy explains exactly what we do collect and why.
1. Who we are
The professional homepage service at academic.page and its sister domains ("the platform") is operated by Pequod ("we," "us"). For the personal data of account holders and their site visitors described here, we are the data controller. Contact: [email protected].
2. What we collect from account holders
- Account details: your name and email address, plus your sign-in credential — a hashed password, and/or the public half of a passkey (we never see or store the private half).
- Your content: whatever you write and upload to publish your site. It's stored so we can serve it; publishing it makes it public by design.
- Billing: payments are processed by Stripe. We store your subscription status and invoice history; we never see or store your card number.
- Support: emails you send us.
3. What we collect about visitors to sites on the platform
Our site analytics are aggregate-only, by design:
- We count daily totals — page views by path, referrer, and country. The country comes from a header supplied by our CDN; we do not store visitors' IP addresses in analytics, assign visitor identifiers, or set analytics cookies.
- There are no third-party analytics or advertising scripts on the platform or on sites we host.
- IP addresses appear transiently in server logs and rate-limiting, as with any web server, and age out routinely.
4. Cookies
We use only the cookies required to run the service: a session cookie (so you stay signed in) and a CSRF token (security). No tracking cookies, no third-party cookies.
5. Where your data lives
We use a small number of infrastructure providers to run the platform:
| Provider | Purpose |
|---|---|
| Hetzner (USA) | Servers that run the platform and database |
| Cloudflare | DNS, CDN, TLS certificates, and file/media storage (R2) |
| Backblaze | Off-site backups — database backups are encrypted before they leave our servers |
| Stripe | Payment processing |
| Amazon Web Services (SES) | Transactional email (receipts, alerts, notifications) |
These providers process data only to provide their service to us. We do not share personal data with anyone for advertising or marketing, and we do not sell it.
6. How long we keep things
- While your account is active: for as long as you keep it.
- If your paid subscription ends: everything is kept for at least 12 months, and your written content is never deleted automatically. The full policy is in section 6 of our Terms of Service.
- If you delete your account: your sites and content are removed from our production systems. Copies may persist in encrypted disaster-recovery backups, which age out on a fixed schedule (database backups within 15 months), are not accessible in normal operation, and are never used to restore deleted accounts.
- Aggregate analytics contain no personal data and may be kept indefinitely.
7. Your rights
You can access and edit your information from your account at any time, export your content on any plan, and delete your account yourself. If you want a copy of the personal data we hold about you, want something corrected, or want it deleted, email [email protected] and we will handle it — regardless of where you live, we extend the same rights to everyone.
8. Security
All traffic is encrypted with TLS. Passwords are hashed; passkeys and two-factor authentication are available and encouraged. Database backups are encrypted before leaving our servers, with the decryption key held separately from production.
9. Children
The platform is not directed to children and may not be used by anyone under 16.
10. Changes to this policy
If we make material changes, we will email account holders before they take effect. We will never change the fundamentals quietly: no ads, no trackers, no selling data.