What we collect, and what we don't.
Short version: we collect as little as we can, we say exactly why, we name who handles it, and we don't sell it. Effective September 24, 2026.
Who is responsible
The Baseline is published by Cory Hepler, who is responsible for the data described here and answers privacy requests personally at coryh2014+baseline-privacy@gmail.com.
What we collect, and why
Newsletter. If you subscribe to the brief, we store your email address to send it. That is its only use. Every edition carries an unsubscribe, and we delete your address on request.
Reader accounts. Signing in means an emailed one-time link; no password exists anywhere. We store your email address and a session cookie that keeps you signed in. When you follow a public figure, we store that follow beside your address so we can email you when a new check on them publishes. Signing out ends the session; asking us deletes the account and its follows.
Reader surveys. A first-party cookie helps prevent duplicate responses. We store a one-way voter identifier and a temporary keyed hash of your network address to limit repeated submissions; the survey database does not store your raw IP address. Rate-limit records expire after one hour and are removed on the next survey request. Surveys are voluntary reader responses, not representative opinion polls.
Aggregate analytics. We measure traffic with Vercel Web Analytics and Speed Insights: which pages are read, roughly where readers come from, how fast pages load. These run without cookies, do not follow you across sites, and build no advertising profile.
Server logs. Our host keeps standard request logs (network address, browser, page requested, time) for a limited period, for security and debugging. We do not mine them.
Mail you send us. Tips, corrections and questions sit in the editor's mailbox for as long as they bear on the record.
Cookies
Two, both first-party: the sign-in session cookie for readers with an account, and the survey cookie described above. This site sets no third-party advertising or tracking cookies.
What we don't do
We don't sell or rent your personal data. We don't run third-party ad trackers. We don't require an account to read a check, and we don't combine what you do here with data from anywhere else.
Who processes data for us
A small number of infrastructure providers handle data on our behalf under their own terms: Vercel (hosting, logs, analytics), Supabase (our database and the sign-in service that sends one-time links), and Resend (newsletter and follow-alert delivery). Mail to a desk address lands in a Google mailbox. Headlines on the news desk link out to third-party publishers, whose privacy practices are their own.
How long we keep it
Newsletter addresses until you unsubscribe or ask. Accounts and follows until you ask us to delete them. Survey rate-limit records for an hour. Logs for the limited period our host retains them. Correspondence for as long as it bears on a published check.
Your choices and rights
To access, correct, or delete anything we hold about you, email coryh2014+baseline-privacy@gmail.com from the address in question. We answer within 30 days, usually much sooner. You can also unsubscribe from any edition, sign out or delete your account, and skip the survey cookie by not taking the survey.
Children
The Baseline is not directed at children under 13, and we do not knowingly collect their data. If a child has given us an address, tell us and we will remove it.
Changes
When this policy changes in substance, the date at the top changes with it and the change is logged in the newsroom notes. It is written in plain language by the publisher, who is accountable for it.