HEY MR. FACTSPrivacy Policy
Privacy Policy
Effective date: October 20, 2026 · Last updated: October 20, 2026
Plain-English policy, not legal advice. This policy was written for Hey Mr. Facts and has not yet been reviewed by an attorney.
This policy explains what information heymrfacts.com (the "Site"), operated by Hey Mr. Facts ("we", "us"), collects, why, who processes it and what choices you have. We are based in California, United States.
The short version
- We collect only what you choose to send through our two forms, plus the basic technical data any website receives.
- We do not sell or share personal information, we run no ads, and we use no advertising pixels or cross-site tracking.
- Visits are measured with Cloudflare Web Analytics, which is cookie-free.
- You can ask us to see, correct or delete your information at any time.
Information we collect and why
| What | Why | Legal basis (GDPR/UK GDPR) | How long we keep it |
|---|---|---|---|
| Newsletter signup: email address, signup time, which form you used | To send the monthly receipts recap | Your consent | Kept by Kit (our newsletter provider) until you unsubscribe or ask us to delete it; our separate intake copy in Cloudflare is deleted automatically within 30 days of signup |
| Send us a claim: claim text, optional link, optional email, submission time | To review and fact-check claims; if you add an email, to reply about your claim | Our legitimate interest in fact-checking; your consent for the optional email | Deleted automatically 24 months after submission (sooner on request) |
| Emails and social messages you send us (e.g. corrections) | To respond and fix errors | Legitimate interest | As long as needed to respond, and no longer than 24 months |
| Technical data: IP address, browser type, pages requested, referrer, time | To deliver the Site securely, block spam (Turnstile) and count visits (Web Analytics) | Legitimate interest in security and running the Site | Held by Cloudflare under its own retention policies; we do not store IP addresses with form submissions |
We do not use this information for advertising or profiling, and we do not make automated decisions about you.
Service providers (processors)
- Cloudflare, Inc. hosts the Site (Cloudflare Pages), stores form submissions (Cloudflare KV), provides spam protection (Cloudflare Turnstile) and cookie-free visit counts (Cloudflare Web Analytics). Cloudflare privacy policy.
- Kit (ConvertKit LLC) stores newsletter subscribers and sends the monthly recap. Kit privacy policy.
These providers process data on our behalf. We may also disclose information if required by law or to protect the Site and its users from fraud or abuse.
International transfers
We and our providers are in the United States, and data may be processed in the U.S. and other countries where they operate. If you are in the EU, EEA, UK or Switzerland, transfers rely on safeguards our providers offer, such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.
Cookies, Do Not Track and Global Privacy Control
The Site sets no cookies of its own and has no cookie banner because none is needed. Cloudflare Turnstile may process limited technical signals on the form pages to tell people from bots. We honor Global Privacy Control (GPC): since we never sell or share personal information, a GPC signal is treated as a confirmed opt-out. We treat every visitor the same whether or not a Do Not Track signal is sent.
Your rights
Wherever you live, you can ask us to:
- Access the information we hold about you, or get a copy;
- Correct it;
- Delete it;
- Withdraw consent / opt out: unsubscribe with the link in any newsletter email, or email us;
- Object to or restrict processing based on legitimate interest.
Email hello@heymrfacts.com. We may ask you to confirm you control the email address involved. We answer within 30 days (45 days where California law allows). If you are in the EU/EEA or UK, you may also complain to your local data protection authority.
California residents (CCPA/CPRA)
In the past 12 months we collected identifiers (email address, IP address via our host) and the content you submit, for the purposes above. We do not sell or share personal information (including for cross-context behavioral advertising), and we do not use or disclose sensitive personal information. You have the rights to know, delete, correct and opt out, and we will not discriminate against you for using them. An authorized agent may make a request for you with your written permission. Under CalOPPA, see the GPC section above for how we respond to browser signals.
Children
The Site is not directed to children under 13, and we do not knowingly collect personal information from them (COPPA). If you believe a child has sent us information, email us and we will delete it.
Security
The Site is served over HTTPS. Forms are protected by Turnstile and stored with access limited to the site owner; API keys are kept as encrypted secrets. We have no visitor accounts or passwords. No system is perfectly secure, but we keep only the minimum data needed and delete it on the schedule above.
Changes
If we change this policy, we will update the dates above. For material changes, we will note it on the homepage and, if they affect subscribers, mention it in the next newsletter before the change applies.
Contact
Hey Mr. Facts · hello@heymrfacts.com