Privacy

A short, plain-language account of what this site collects and what we do with it.

This page describes how cecilyharrow.com ("the site") collects, uses, and shares information about visitors. We have tried to write it in the same voice as the rest of the site — clear, careful, and short on legalese — while still meeting the requirements of applicable privacy laws.

1. Who runs this site

cecilyharrow.com is operated by Marketing Maverick LLC, a Minnesota limited liability company (referred to below as "we," "us," or "Cecily Harrow"). "Cecily Harrow" is the pen name under which we publish The Footnote Mysteries.

For any privacy-related question, or to exercise any of the rights described in section 8, please write to us through the contact form.

2. What we collect

We collect three categories of information:

A. Information you give us directly. When you subscribe to the newsletter From the Marginalia, we collect your email address. We do not require any other personal information to subscribe. If you write to us through the contact form, we collect whatever you choose to put in that message.

B. Information collected automatically. Our hosting provider, Hostinger, keeps standard server logs — IP address, browser identifier, the page you requested, and a timestamp — for security, abuse-prevention, and basic operational purposes. These logs are not used to build a profile of you across the web.

C. Information collected by advertising partners. This site may display advertisements served by Google AdSense and its advertising partners. Those third parties use cookies and similar technologies to serve and measure ads, including ads based on your prior visits to this and other sites. See section 5 for details.

3. How we use the information

Newsletter address. We use your email address only to deliver From the Marginalia, including the welcome letter containing Chapter One of The Empress's Wake. We do not sell, rent, or share your email with anyone outside the processors named in section 6.

Server logs. Used only to keep the site running and to investigate misuse. Logs are not combined with newsletter data.

Advertising data. Google and its partners use the data described in section 2(C) to serve ads (including personalized ads where you have consented to them) and to measure ad performance.

4. Legal bases for processing (EEA / UK / Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR and equivalent laws:

Consent — for the newsletter, and for any non-essential cookies (including personalized advertising cookies). You may withdraw consent at any time without affecting any prior processing.

Legitimate interests — for keeping the site secure (server logs) and for serving non-personalized advertising, where consent has not been given but we have a legitimate interest in operating the site.

Legal obligation — where we are required to retain or disclose data to comply with applicable law.

5. Cookies and similar technologies

We do not set first-party tracking or analytics cookies of our own.

However, Google AdSense and its advertising partners may set or read cookies, web beacons, and similar technologies on your device when ads are displayed. These include the DoubleClick DART cookie and others described in Google's "How Google uses cookies in advertising" notice.

If you are in the European Economic Area, the United Kingdom, or Switzerland, a Consent Management Platform will ask for your consent before any non-essential cookies are set. You can change your consent at any time using the "Cookie preferences" link in the footer (where available).

To opt out of personalized advertising regardless of jurisdiction, you can:

6. Third parties who process data on our behalf

We rely on a small number of vendors to operate the site. Each is bound to use your data only for the purposes for which we engaged them:

Hostinger — hosts the site and stores server logs. Hostinger privacy policy.

Hostinger Reach — manages the newsletter and stores your email address until you unsubscribe. Same privacy policy as Hostinger.

Google AdSense (when ads are enabled) — serves and measures advertisements. Google may transfer data to, and store data in, the United States and other countries. Google privacy policy; "How Google uses information from sites or apps that use our services".

7. Newsletter — how to unsubscribe

Every newsletter we send includes a one-click unsubscribe link in the footer. Click it and your address is removed from our list immediately. You can also write to us through the contact form and ask to be removed; we will do so within seven days.

8. Your rights

Depending on where you live, you have the following rights regarding your personal data. To exercise any of them, write to us through the contact form. We will respond within 30 days (45 days for California residents, where required by law).

If you are in the EEA, UK, or Switzerland

Under the GDPR and equivalent laws, you may request:

  • Access to the personal data we hold about you;
  • Correction of inaccurate or incomplete data;
  • Deletion ("the right to be forgotten");
  • Restriction of processing in certain circumstances;
  • Portability — a copy of your data in a structured, machine-readable format;
  • To object to processing, including direct marketing;
  • To withdraw consent at any time, where processing is based on consent.

You also have the right to lodge a complaint with your local supervisory authority.

If you are a California resident

Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), you may request:

  • To know what categories and specific pieces of personal information we have collected about you, the sources, the business purpose, and the categories of third parties with whom we have shared it;
  • To delete personal information we hold about you;
  • To correct inaccurate personal information;
  • To opt out of "sale" or "sharing" of personal information for cross-context behavioral advertising. We do not sell personal information for money. When AdSense is enabled, the use of advertising identifiers may qualify as "sharing" under the CPRA; you can opt out via Google Ads Settings or the "Cookie preferences" link in the footer.

You will not be discriminated against for exercising these rights.

9. Data retention

Newsletter address — retained until you unsubscribe, then deleted from active lists. A short suppression record may be retained to ensure we do not contact you again in error.

Server logs — retained per Hostinger's standard schedule (typically 30 to 90 days).

Advertising cookies — retained per the cookie's own expiration. Google's DoubleClick cookie typically expires after 13 months. See Google's documentation for current values.

10. International transfers

Hostinger, Hostinger Reach, and Google operate in multiple countries. By using this site you acknowledge that your data may be transferred to, stored in, and processed in countries other than your own — including the United States and the European Union. Where such transfers are made out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses or equivalent safeguards offered by our processors.

11. Children's privacy

This site is not directed at children under 13 (or 16, in jurisdictions where the GDPR applies). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please write to us through the contact form and we will delete it.

12. Security

The site is served over HTTPS. Newsletter data is held by Hostinger Reach, subject to their security practices. We take reasonable technical and organizational measures to protect personal data, but no system is perfectly secure. By using this site you accept that residual risk.

13. Changes to this policy

We may update this policy from time to time. The effective date below records the most recent change. Material changes will be announced in the next issue of the newsletter.

14. Contact

For privacy questions or to exercise any of the rights described above, please write through the contact form.

Effective date

This policy is effective from 10 May 2026.