Privacy, in plain English.

What we keep, and why

Your email address, and who referred you if you joined through a link. We need these to run the list, sign you in and run the daily draw.

What you write. If you are drawn, your Soapbox (subject, text and drafts) and any note from the reviewer. If it is sent, it goes to everyone on the list, anonymously unless you sign off with your name.

Replies you send. When you reply to a Broadcast, your message and your email address go to that Broadcast's writer, and only to them. We store the reply so the writer can read it, and we never publish it.

Whether you open, click or reply. Every Broadcast carries a tiny image and tracked links, so we know if it was opened or clicked, and we note when you reply to one. We use this for one thing: if you ignore seven Broadcasts in a row, your tickets pause until you show up again. Some email apps open images automatically, so this is not exact.

Short-lived housekeeping. Sign-in links (stored only as a hash) and counters that stop abuse of the sign-up form, which include your email address and IP address and are deleted within two days.

Cookies and analytics

We set a sign-in cookie that keeps you signed in for 30 days, and, if you arrive through a friend's link, a referral cookie for 30 days so they get their ticket. Both are needed for the site to work.

We use Fathom for simple page-view counts and PostHog (hosted in the EU) to see how the site performs, catch errors and watch anonymised session replays. Replays mask everything you type, and on signed-in pages they mask the text too. PostHog may keep an identifier in your browser. The secret parts of links in your emails are stripped before anything reaches either service.

If you arrive from a Reddit ad, the Reddit pixel on our home page tells Reddit that you visited and whether you signed up, so we can tell whether the ad worked. It never runs on pages that show your account or sign-in links.

Who else handles your data

Cloudflare hosts the site and the database, sends and receives our email, and runs the bot check on the sign-up form. Fathom and PostHog handle analytics as above. We do not sell your data or share it with advertisers.

Leaving and deleting

Unsubscribing stops all email and takes you out of the draw. You can resubscribe from your account.

Deleting your data, from your account page or the unsubscribe page, removes your email, your tickets, anything you wrote and the replies you sent. We keep only your email address on a do-not-email list, so we never write to you again unless you sign up afresh. Broadcasts already in other people's inboxes cannot be recalled.

To ask what we hold about you, or to correct it, email max@thesoapbox.email. If you are not happy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk).