Privacy Policy
Last updated:
CheatsheetKit is the data controller for the personal data described in this policy. We collect as little as the job allows: we run no advertising trackers, we do not sell data, and we never receive your card number.
Three companies handle data for us, all of them doing one specific job: our payment processor, our email processor, and our host. This site loads nothing from anyone else. When we reviewed it we found a fourth: the webfonts used to be fetched from a Google CDN, which handed Google every reader's IP address on every page view. The fonts now ship from our own server, so the list below is the whole list.
What we collect
- Your email address, when you sign up for the free pack or buy something. We use it to deliver your download, to send the occasional new-pack update, and, for purchases, to watermark your PDF so it is traceable to your order.
- Your name and billing country, only where our payment processor returns them on a transaction. We use these for tax and accounting obligations.
- Payment details, handled entirely by Dodo Payments. We never receive or store your card number, and it never reaches our servers or our storage.
- Order records: what you bought, when, the amount, and the delivery outcome. Kept so we can support you, reissue a link, and meet accounting and tax rules.
- Basic technical data: the contents of an email unsubscribe request, and the order and delivery records above.
- Web analytics: if you read a page, we record the path of that page, the site that referred you, and coarse facts about your device and location — country, operating system, browser and device type. No email address, no order, and nothing you type into a form. The next section explains exactly what that does and does not include.
We do not collect special-category data, and we ask you not to put any into an email to us.
Web analytics
We count page views with Vercel Web Analytics so we know which packs people actually open and where the site is losing them. That is the whole purpose of it: it tells us what to write next. It is a counter, not a profiler, and it is worth being precise about the difference.
- It sets no cookies. There is nothing stored on your device for us to read back, and no identifier that follows you around.
- It cannot follow you across sites, or across days. A visitor is identified by a hash derived from the request instead of a persistent identifier, and that hash is reset every 24 hours. The same person arriving tomorrow counts as a different visitor.
- It cannot be joined to your order. A hash that resets daily cannot be matched to an email address or an order id, so reading a page tells us nothing about what you bought and buying something reveals nothing about what you read.
- Automated traffic is excluded. Requests recognised as bots are filtered out before counting, so the figures describe people rather than crawlers.
The tracker is served from this domain by our host, so turning it on added no fourth company, no external connection, and no relaxation of the content security policy described above. It sits under the same agreement as the rest of "Who processes it".
Why we use it, and the legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Delivering your pack and reissuing a download link | Email, order record | Performance of a contract |
| Watermarking so a leaked copy is traceable | Email, order id | Our legitimate interest in protecting our content, balanced against your interests |
| Taking payment, refunds, tax and accounting | Order record, name, country | Performance of a contract; legal obligation |
| Answering a support or refund request | Email, order record, message content | Performance of a contract; legitimate interest |
| Sending occasional product updates | Consent, withdrawn by unsubscribing | |
| Counting page views so we can write more of what people actually read | Page path, referrer, country, operating system, browser, device type | Legitimate interest in improving the site, balanced against your interests |
| Defending a claim about misuse of the packs | Order record, IP in server logs | Legitimate interest in enforcing our terms and defending legal claims |
Where our basis is legitimate interest, you have the right to object to that processing, and section "Your rights" below explains how.
Watermarking
Every purchased PDF is stamped with the buyer's email address and the id of their order. This is an anti-piracy measure and means a redistributed copy can be traced to the account that bought it. It is also what lets us reissue your link. We do not put anything in the watermark beyond those two facts, and we do not use it for advertising.
Who processes it
Three processors handle data on our behalf, each only for the purpose it serves, and each under a contract that limits it to that purpose:
- Dodo Payments takes your payment details, confirms your order, and processes refunds and chargebacks.
- Resend sends the email you ask for and holds the mailing list.
- Vercel hosts the site and stores the watermarked PDFs and their signed download links.
Our host also keeps its own server request logs for security and operations. Those are held under the host's retention policy, we do not copy or export them, and we use them only if we need to establish what happened after an incident.
These processors act outside your country. Where that means your data leaves the UK or the EEA, we rely on the transfer mechanisms those processors provide, which are an adequacy decision or Standard Contractual Clauses with a transfer-risk assessment behind them. You can ask us for the name of the mechanism for any processor.
Our site loads its fonts, scripts, styles and images only from our own domain. There is no third-party font service, no advertising network, no social media widget and no embedded video player, because each of those would contact a third party with your IP address as you read.
How long we keep it
| Data | Kept for | Then |
|---|---|---|
| Mailing-list entry | Until you unsubscribe | Deleted from the list on request or on unsubscribe |
| Order record and watermarked PDF | 24 months after purchase | Deleted. 24 months is the window in which we support, reissue and trace watermark claims, and it covers our accounting obligations |
| Card details | Not applicable | We never hold them |
| Server request logs | Held by our host for security and operations | Released under the host's own retention policy. We do not copy or export them |
| Support correspondence | 24 months | Deleted, unless needed to defend a claim |
| Web analytics | Held by our host as dashboard statistics | The per-visitor hash is discarded automatically within 24 hours, so page views cannot be traced to a person after that. The aggregates are not personal data once the hash is gone |
Download links expire on their own, so a link copied out of your email stops working without us having to do anything.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop using it, or object to processing based on our legitimate interest. Where you gave consent, you can withdraw it at any time, and we will stop the activity it covered without affecting anything done before you withdrew it.
Unsubscribe from emails using the link at the foot of any of them. For anything else, write to hello@cheatsheetkit.store from the address you bought with, so we can find your records without asking you to prove who you are twice.
If you are in the EEA, the UK or Switzerland, the GDPR and the UK GDPR give you the same rights plus the right to complain to your supervisory authority, and the right to data portability for data you gave us. We respond to a rights request within 30 days, and we do not charge for it.
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
Security
We use HTTPS on every page. Admin and API secrets are held in the host's encrypted environment and never in code, never in a page, and never in a font or image file. Download links are signed and expire, and the paid content itself is stored encrypted and is served only to the buyer who paid for it. If you think your data has been exposed, write to us straight away and we will investigate and tell you what we find, as our law requires.
Children
These packs are for people in employment or looking for it, and this policy is not directed at children. We do not knowingly collect data from anyone under 16. If you believe we have, write to hello@cheatsheetkit.store and we will delete it.
Changes
When this policy changes materially we update the date at the top of this page and, if the change affects how we use data you have already given us, we will email you before it takes effect. Continuing to use the site after that means the updated policy applies.
Contact
Write to hello@cheatsheetkit.store. If you need our registered name or address for a formal request, a court matter or an invoice, ask and we will provide them in writing.