Privacy Policy

Effective 2026-10-14. Last updated 2026-10-14.

This policy covers your.blog, the blogs we host at subdomains of your.blog, onthepage.blog, writersroom.blog, openpage.blog, plainpage.blog, writeups.tech and buildlogs.tech, and the emails we send. The business responsible (the "controller") is ResilientMind AI, a sole proprietorship of Joseph C. McGinty Jr., 48 North Grove Street, Scottdale, PA 15683, United States. Questions and requests: admin@resilientmindai.com.

In short: no advertising, no tracking cookies, no data sales. We keep what we need to host your blog and bill you, and we delete it on a schedule you can read below.

If you are a customer

What we collect. Your email address; your blog name, title, theme, posts, drafts and settings; your Autopilot brief; your Stripe customer id and a mirror of your subscription status (plan, interval, renewal date, trial end); the approve, edit or reject decisions you make on drafts; and anything you send to support. Card numbers go to Stripe, never to us. Stripe also collects your name and billing address for sales tax.

Why. To provide the blog you paid for, bill you, log you in, generate Autopilot drafts you asked for, answer you, enforce our terms and keep records the law requires. For readers in the EU and UK: the legal bases are performance of our contract with you, our legitimate interest in running and protecting the service, and legal obligation for tax and accounting records.

Logging in. There are no passwords. We email you a signed link; opening it sets one session cookie on your.blog only (never on blogs), which lasts 30 days and is needed for the dashboard to work. We set no other cookies. "Log out everywhere" ends every session.

Abuse controls. Your IP address is used briefly to limit how often login links, checkouts and abuse reports can be requested. Those counters are deleted within a day. Our hosting provider keeps short-lived request logs that include IP addresses; our own application logs never record IP addresses, user agents or post content.

If you read a blog hosted here

Blogs here set no cookies and load no third-party scripts, fonts or analytics. For each page view we record the page path, the referring site's domain (never the full URL), the country, the time, whether it was an RSS fetch, and a visitor hash. The hash is computed from a secret that changes every day, the blog name, your IP address and your browser's user agent; the IP address and user agent themselves are never stored, the hash cannot be reversed, and it cannot be linked across days or across blogs. Raw page-view records are summarised into daily totals and deleted within 48 hours; the daily totals contain no per-visitor data and are shown only to that blog's owner. Visitor counts are therefore estimates. No third party collects information about readers' activity over time or across other websites through blogs hosted here, and we do not respond to "Do Not Track" or Global Privacy Control signals because there is no cross-site tracking to switch off.

If you send an abuse or copyright report we keep the report, the URL, your email address if you gave it, and what we did about it. Copyright notices are passed to the blog owner, as the law requires.

Who else processes data

We use a small number of service providers, each under its own privacy and security terms. We share only what each one needs. We never sell or rent personal information, and we do not share it for advertising.

• Stripe (United States): checkout, cards, subscriptions, invoices, sales tax and the billing portal. Stripe is an independent controller for its own fraud prevention and legal duties; see stripe.com/privacy.
• Netlify (United States): hosts the site and every blog, runs our code at the edge, stores all application data (posts, settings, KPIs) in its US data store, and keeps short-lived server logs. Netlify runs on Amazon Web Services and Google Cloud.
• Resend (United States): delivers our transactional email (login links, trial and billing notices, draft approvals). Resend keeps the messages and their delivery logs for 30 days.
• Anthropic (United States): on Autopilot plans we send your brief, your blog name, your recent post titles and the assignment to the Anthropic Claude API, which returns the draft. Under Anthropic's commercial terms, API inputs and outputs are not used to train its models and are deleted within 30 days (longer only if flagged for a safety review). We never send reader data to any AI provider.
• Our own hardware: as a fallback, drafts may be generated by a model running on equipment we operate ourselves. Nothing leaves our systems in that case.

We may also disclose information when the law requires it, to enforce our terms, or to protect someone's safety, and to a successor if the service changes hands (we would email you first).

Emails we send

Login links, trial and billing notices, failed-payment and cancellation notices, abuse and copyright notices, and draft-approval emails on Autopilot plans. These are part of the service and cannot be switched off while you have a blog. We do not send marketing email.

How long we keep things

• Raw page-view records: deleted within 48 hours. Daily totals: for the life of the blog.
• Posts, drafts, brief and settings: for the life of the blog, then exportable for 30 days after a subscription ends and deleted after that. Drafts from a trial that never started a plan are deleted at least 7 days after the trial ends.
• The blog name and your email on its record: 90 days after a subscription ends, so the name can be held for you, then released.
• Login, checkout and abuse-report rate-limit counters: within a day. Webhook de-duplication markers: 30 days.
• Abuse and copyright reports: as long as needed to handle them and to document repeat infringement.
• Billing records at Stripe: as long as tax and accounting law requires, independently of your blog.

Your choices and rights

Export every post, the brief and your KPIs from the dashboard at any time. Change your email or billing details in the Stripe portal. To delete your blog and its data, cancel your subscription; everything above is deleted on the schedule shown. You can also email us to access, correct or delete the personal information we hold about you, or to object to how we use it; we verify requests by sending a login link to the address on the record and answer within 30 days. We do not sell personal information and we do not discriminate against anyone for exercising a privacy right. If you are in the EU, the UK, California or another place with a privacy law, you have these rights by law; elsewhere we honour them anyway. EU and UK residents can also complain to their data protection authority.

Where data lives

We are in the United States and all of our providers process data there. If you use the service or read a blog from outside the United States, your data is transferred to and stored in the United States, where privacy law may differ from your country's. We do not market the service outside the United States.

Children

The service is for adults. We do not knowingly collect information from children under 13. If you believe a child has given us information, email us and we will delete it.

Security

Login links and sessions are signed, single-purpose and short-lived; cookies are HttpOnly and Secure; every webhook and internal request is signature-checked; traffic is encrypted in transit; card data is handled only by Stripe. No system is perfectly secure, and we will tell you if a breach affects you.

Changes

We will email customers about material changes at least 14 days before they take effect and update the dates at the top of this page.