Privacy policy

1. Who we are

Stakyco is published by Dovydas Glavinskas, trading as a registered sole trader (individuali veikla) in Lithuania. He is the data controller.

Contact email for all privacy matters: info@stakyco.com.

2. What data we collect

When you register we collect: the email address you enter yourself, your language preference (LT or EN), the source of the signup (for example, which post you came from, if the link was tagged), the time you registered, and the time access to the member area was opened. An unsubscribe token is created alongside it, so that the unsubscribe link works in every letter.

We do not collect your name, address or phone number. We never see or store your card details: you enter them directly on Stripe's page.

Once payments are switched on and you subscribe, our database keeps next to your address: your Stripe customer identifier, the subscription status, the date you have paid until, and whether the founding discount applies to you.

Our server infrastructure (Vercel) may temporarily record your IP address and browser type in standard access logs for technical purposes. The country your IP resolves to is used to decide which language the page opens in, and that country marker is not stored in the database. None of this is used for profiling or marketing.

So that nobody can flood the form with signups or order a pile of sign-in links for somebody else's address, we limit how often those can be requested. To do that we store neither your address nor your IP, but a cryptographic digest computed from them with a timestamp, from which the address cannot be recovered. Those records are cleared automatically within an hour.

Since 2026-09-08 the member area records which page a signed-in member opened and when: the address, the page address, its title and the time. It exists so that we can see which of the things we write are actually read. The same page opened several times within half an hour is recorded once. There is no tracking tool here, no extra cookie and no third-party analytics provider, and these records stay in the same database and are passed to nobody.

3. What we use your email for

Three things: sending the Stakyco letters on Tuesdays and Fridays; sending a one-time sign-in link when you ask for one; and checking whether your address has access to the member area.

Your email address is not sold, rented or shared with third parties for marketing purposes.

4. Legal basis

For the letters it is your consent, given by ticking the box in the signup form (GDPR Article 6(1)(a)). You can withdraw it at any time with the unsubscribe link at the bottom of any letter.

For signing in and for running the membership itself the basis is performance of our agreement with you (GDPR Article 6(1)(b)), since without checking the address there is no way to open the member area to you. The same basis covers the subscription and its payment.

We keep payment records because accounting law requires it (GDPR Article 6(1)(c)).

If you want the record erased from the database entirely, rather than only marked as unsubscribed, write to the address above.

5. Where the data is stored and who it goes to

Data is stored in Supabase (a PostgreSQL database) and reached through the site hosted on Vercel. Only Dovydas Glavinskas has access to the full list, through an administrator key. The public part of the site can only write a new email address, never read the list back.

We use Resend (United States) to deliver the letters. Your email address and the content of the letter are passed to it so that the letter can reach you.

The assistant in the member area runs on a model from Anthropic (United States). Only the text of your question is sent to it, together with what Stakyco has published. Your email address and any other identifier are not sent, and the conversation stays in your browser rather than in our database. As anywhere else, do not put into a question something you would not want to leave your own computer.

Payments are handled by Stripe (Stripe Payments Europe, Ltd., Ireland). Stripe receives your email address and the payment details you enter, and returns to us only what is listed in section 2. Stripe also processes payment data as a controller in its own right, for example to prevent fraud, under its own privacy policy at stripe.com/privacy.

The other providers involved: Vercel (hosting) and Cloudflare (domain and email forwarding). Transfers outside the EU are made under the standard contractual clauses approved by the European Commission.

6. Signing in, and the one cookie

There is no password. You enter your address, receive a one-time link good for 15 minutes, and clicking it sets a sign-in cookie named stakyco_session in your browser, valid for 30 days.

The cookie holds your email address and an expiry time, signed with a server key so that it cannot be forged. It is httpOnly, SameSite=Lax and sent over HTTPS only, so the page's JavaScript cannot read it. Signing out clears it immediately.

This is the only cookie on the site and it is strictly necessary for the service to work, so no separate consent is asked for it. We use no analytics or marketing cookies: there is no Google Analytics, no Meta Pixel and nothing similar. If that ever changes, this section will be updated and separate consent will be asked for.

7. How long we keep it

A member record is kept for as long as you are a member. If you unsubscribe, the record is marked as such and we stop writing to you; if you ask for it to be erased entirely, that is done within 30 days at the latest.

Rate-limiting records are cleared automatically within an hour. Access logs are kept by Vercel under its own standard practice. The member-area reading records are kept for as long as you are a member and are deleted together with your record.

Payment and invoice records are kept for as long as Lithuanian accounting law requires, even after you end your membership. This is the one exception to a request to erase everything.

8. Your rights

Under the GDPR you have the right to: find out whether your data is stored; receive a copy of it; ask for it to be corrected or erased; withdraw your consent; and lodge a complaint with the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt). Write to info@stakyco.com about any of these.

9. Changes

On 2026-09-27 the policy gained the sections on Stripe and on accounting records, ahead of payments being switched on. Significant changes will be announced by email.