Privacy Policy

The short version

I collect as little about you as I possibly can. No selling your information, no creepy follow-you-around ads. If you never sign up for anything and never write to me, I never get your name or your email. The one thing that does watch visits is Google Analytics, which uses cookies (in Europe, only if you say yes), and I spell that out below. The rest is just me laying out the details.

This is a plain-language policy for a small solo blog, kept current as the setup changes. Effective November 2026.

What I actually collect

Three things, and that's it:

• Your email address, but only if you type it in to join the list. I also save the page you signed up from.
• Your name, email, and message, but only if you write to me through the contact form.
• Visit statistics from Google Analytics: which pages get read, on what kind of device and browser, and roughly where in the world. It uses cookies to tell one visitor from another, and if you're in Europe, only after you accept them.

No phone number, no home address, no payment details. If you just read and never sign up or write, the only thing about you I can see is those visit statistics.

Why I have it and how I use it

Your email does three small jobs: it delivers the freebie you asked for, it lets me send the occasional update when there's something worth your inbox, and it's how I write you back if you message me. The page you signed up from helps me send you things that match what you were reading. The visit statistics tell me which pages people actually read, so I can make more of what helps and quietly retire what doesn't. That's the whole list. I don't use your data for anything you didn't come here for.

Your email, if you give it

I keep your email, and the page you signed up from, with Resend, the service I use to send the list and the freebies. I don't sell it. I don't share it. I don't trade it. And you can leave whenever you want. Every email has an unsubscribe link at the bottom, one click, no hard feelings.

If you write to me

The contact form sends your name, your email, and your message to my inbox as an email, delivered by Resend. Your reply goes straight back to the address you gave. The site itself doesn't keep a copy of what you write. I only use what you send to answer you.

To keep robots out of my inbox and off the list, the contact form and the sign-up form both run Cloudflare Turnstile, a quick check that you're a person. It only loads when you click into one of those forms, and Cloudflare receives some technical details from your browser to do the check.

Analytics, the honest version

I use Google Analytics to see which pages people actually read. It sets cookies in your browser, and Google receives the visit statistics I described above. What I look at are lumped-together reports, like "the playdough post had a good week." I never see who you are, and I don't connect these statistics to your email or to anything you write to me.

It also notes when someone signs up for the list or sends me a message, along with the page it happened on. It never gets the email address, the name, or the message itself.

If you're in Europe (the EU, the rest of the European Economic Area, the United Kingdom, or Switzerland), Google Analytics only starts after you press Accept on the cookie banner. Press Decline and it never loads, and any cookies it had already set are removed. You can change your mind whenever you like with the "Cookie settings" link at the bottom of every page. Everywhere else, it runs without a banner.

To know whether to show the banner, the site asks my host, Cloudflare, which country you're visiting from. The answer is used on the spot and I don't keep it. Your browser remembers it for about a month so the question isn't asked on every page. If the country can't be worked out, I treat you as if you were in Europe.

Google Analytics only runs on rosyandhush.com. If you'd rather not be counted anywhere, you can block its cookies in your browser, or install Google's opt-out browser add-on.

The companies that help me run this

Running a blog takes a few outside services. Here's everyone who touches any of it, and why:

• Resend stores your email, and the page you signed up from, and sends the list and the freebies. It also delivers the messages you send through the contact form.
• Google Analytics counts visits, with cookies, as described above.
• Cloudflare hosts and serves the pages, runs Turnstile on the sign-up and contact forms, and keeps standard server logs, the ordinary plumbing every website runs on.
• Amazon only when you click one of my affiliate links. From there you're on their site under their rules, and they handle the purchase. I earn a small commission if you buy, and I only see sales reports, not who you are.
• Etsy only when you click through to my shop. From there you're on their site under their rules, and they handle any purchase.

How long I keep it

Your email sticks around as long as you're on the list, then it's gone soon after you unsubscribe or ask me to delete it. A message you send through the contact form stays in my inbox only as long as I need it to answer you. Google Analytics keeps its visit statistics for a limited time, and I only ever look at the lumped-together reports. I don't keep what I don't need.

Cookies

Google Analytics sets cookies in your browser, with names that start with "_ga", so it can tell one visitor from another. If you're in Europe, that only happens after you accept. I don't set any advertising cookies.

The other things that get saved in your browser are whether you picked light or dark mode, your answer to the cookie banner, and the country answer described above. They live in your browser's localStorage, on your device, so the site remembers them next time. I never see them and they never leave your machine.

Free tools

The free tools on this site, like the visual timer, run entirely in your browser. What you set (the timer length, the next-step picture and word, colors and sounds) is saved in your browser's localStorage so the tool opens the way you left it. It stays on your device and is never sent to me or anyone else. Each tool has a "Clear saved settings" button that wipes it.

The sounds are made by your browser on the spot, and a spoken heads-up only uses a voice that lives on your device. If Google Analytics is on for you (see above), it counts when a tool is started, when it finishes, and when a product link in the tool is clicked, never what you typed into it.

No ad tracking

Apart from Google Analytics, there's no Pinterest tag, no Facebook pixel, no ad network hiding in the code. I'm not building a profile on you to sell to anyone. Pinky promise, and the page source backs me up.

About kids

This whole site is written for the grown-ups: parents, caregivers, teachers, the tired and the hopeful. It is not directed to children under 13, and I don't knowingly collect anything from them. If you think a child sent me their info by mistake, email me and I'll delete it.

When you click away

Some links here send you off to Amazon, Etsy, Pinterest, or another site. Once you land there, you're playing by their privacy rules, not mine. Worth a peek at their policies if it matters to you.

Your choices

Your data, your call. You can unsubscribe from any email in one click, or you can ask me to delete your email from my list entirely. Either way, email me at [email protected] and I'll take care of it.

If you're in the EU or UK

Under the GDPR, you get a clear set of rights, and I'm happy to honor them. A couple of quick basics first, then the rights.

The person responsible for your data (the controller, in legal terms) is Nora, who runs this site. There's no big company behind it and no data protection officer, because it's just me. You can reach me any time at [email protected].

What lets me hold your data in the first place is called a legal basis. For marketing email, it's your consent, given when you sign up and withdrawn the moment you unsubscribe. For Google Analytics, it's your consent too: it only starts after you accept, and you can withdraw it from the "Cookie settings" link. For answering a message you send me, it's that you asked me something and I'm replying.

Your rights under the GDPR include the right to:

• ask what data I hold about you and get a copy (access);
• fix anything that's wrong (rectification);
• have your data deleted (erasure);
• get your data in a portable form to take elsewhere (portability);
• object to a particular use of your data;
• withdraw your consent for marketing email or analytics cookies whenever you like.

One note on where your data sits: Resend is a United States company, and Google and Cloudflare run servers there too, so signing up or visiting means your data may cross borders. I pick services that handle international transfers with the proper safeguards in place. To use any right above, just email me and I'll sort it.

If you're in California

The CCPA and CPRA give California residents their own set of rights, and the headline one is the simplest to state.

Do Not Sell or Share My Personal Information. I do not sell or share your personal information, full stop. There's no opt-out form to hunt for, because there's nothing to opt out of.

The personal information I collect is the email address you hand over (plus the name and message, if you write through the contact form) and the visit statistics from Google Analytics. As a California resident you have the right to know what I collect, to ask me to delete it, to correct it, and to opt out of any sale or sharing (already covered, since I do neither). Email me to use any of these.

If this changes

If I ever change how any of this works, I'll update this page and bump the date up top so you can see it's fresh. Anything big, and I'll say so in an email too.

Questions about any of it? The contact page is right there, and there's more plain talk about money over on the disclosure page.