Privacy

This notice covers nova-nevedoma.com. It was last updated on 19 October 2026.

We do not sell personal information, run ad networks, or set tracking cookies. Most of what follows exists because you ordered a book, wrote to us, signed up for a newsletter, or because your browser fetched a page.

Our · Contact · Details

Name: nova·nevédoma, a one-person literary press trading as a sole trader, which is the data controller. The proprietor’s legal name and postal address are given on every order confirmation and on request.

Country: United Kingdom.

E-mail: [email protected]

Postal address: available on request — email us and we will provide one for any formal request.

The · Type · Of · Personal · Information · We · Collect

We currently collect and process the following information:

  • Order details — your name, email address, postal address, and the edition you chose, when you order a book.
  • Correspondence — your email address and the content of your message, when you write to us.
  • Reader account — your email address, when you sign in to read texts kept for members and patrons, together with whether you are a patron: Stripe tells us when you subscribe on the site, and for earlier patrons we copied it from our Substack subscriber list. Signing in sets one cookie that remembers you on this browser.
  • Newsletter address — your email address and the letters you sign up for, when you subscribe on the newsletter page, on the sign-in form or on your account page; nothing is sent to it until you have confirmed the address, by the link we email you or by signing in with the code we email you.
  • Public replies — your name, avatar and the text of your reply, if you respond to a post from your own website, Mastodon or Bluesky.
  • IP address — when you submit the order form, and as part of routing and protecting the site.
  • Device and browsing information — your browser, operating system, language, screen width, country, the pages you visit and the site that referred you.

How · We · Get · Your · Personal · Information · And · Why · We · Collect · It

Most of the personal information we process is provided to us directly by you for one of the following reasons:

  • You placed an order for a book.
  • You sent us an email.
  • You published a reply to one of our posts, which reached us as a webmention.
  • You signed in with your email address to read a text that is not public.
  • You signed up for one of our newsletters.

We also receive personal information indirectly when your browser loads a page, which supplies your IP address and basic device information as described below.

We use the information you have given us in order to send you the book you ordered and correspond with you about it, keep the business records HMRC requires, answer your emails, display public replies beneath the posts they respond to, prevent the order form being abused, and understand which pages people read. If you sign in, we use your email address to let you read the texts kept for members and patrons, and to know whether you are a patron. If you sign up for a newsletter, we use your email address to send it to you, and to pass it to Substack if you asked for the letter.

We share this information with Resend, which delivers the email telling us about your order, and Cloudflare, which routes traffic to the site and blocks attacks. Orders are stored in our own database, PocketBase, running on our Railway account. Payment is handled by a payment provider; card details never reach us. If you sign in, Resend also delivers the login code to you, and your reader record lives in the same PocketBase database. If you become a patron on the site, payment is taken by Stripe, and the subscription is sold to you by its company Link as the merchant of record. Your card number never reaches us. The name and billing address you give at checkout, and your invoices, are held by Stripe; we can see them in our Stripe account but do not copy them into our own records. Our database keeps only that your subscription exists, whether it is active, and when the current period ends. Patrons who subscribed through Substack are billed there. If you sign up for a newsletter, Resend delivers the confirmation email and the letters we send, and your address lives in our own Listmonk database on the same Railway account. If you tick nova·nevédoma, we also pass your confirmed address to Substack, which sends that letter. Books bought elsewhere are sold to you by the shop that takes your money, not by us, and that shop holds your details under its own privacy policy: Gumroad for ebooks, and IngramSpark for printed books bought from its checkout. From IngramSpark we learn only how many copies were sold and in which country. Gumroad shows us each buyer’s email address in our account there; we do not copy it anywhere. Buying a book or a subscription, here or anywhere else, never adds you to a newsletter.

Under the UK GDPR, the lawful bases we rely on for processing this information are:

  • (a) Your consent — for our newsletters. You are able to remove your consent at any time, with the unsubscribe link in every letter or by emailing us.
  • (b) We have a contractual obligation — for your order details. We cannot send you a book without them.
  • (b) We have a contractual obligation — for your reader account, if you have one. We cannot show you the texts kept for members and patrons without knowing it is you.
  • (c) We have a legal obligation — for keeping order records as business records for tax purposes.
  • (f) We have a legitimate interest — for correspondence, for displaying public replies, for limiting abuse of the order form, of sign-in and of the newsletter form, and for visitor statistics. You can object to processing based on legitimate interests; see your rights below.

Other · Companies · Your · Browser · Contacts

Loading a page makes your browser fetch things from other servers, and each request carries your IP address to them. We list them so you do not have to find out from a network tab.

  • Cloudflare sits in front of the site and sees every visitor’s IP address. It passes us a two-letter country code, which is how a book page shows a shop that ships to you.
  • webmention.io is queried by your browser at the foot of every post to fetch replies, so it sees your IP address and which post you are reading.
  • Wikimedia Commons (upload.wikimedia.org) serves many of the illustrations on posts and wiki pages, which are linked from where they live rather than copied here.
  • YouTube (www.youtube-nocookie.com) on the handful of pages that embed a video. We use the youtube-nocookie domain, which switches off ad personalisation, but the player, once you press play, contacts Google and can write to your browser’s storage.

Typefaces are served from this site. They previously came from Google Fonts, which meant Google received the IP address of every reader of every page; that is no longer the case.

Cookies and analytics

Visitor statistics come from GoatCounter, which we host ourselves at stats.nova-nevedoma.com and publish openly. It sets no cookies and writes no IP addresses to its database. To avoid counting one visit twice it holds your address and browser string in memory for up to eight hours.

You can switch it off for this browser, here, and we will not load the counter on any page you visit:

That setting lives in your browser, so it applies per device and is cleared if you clear your browsing data. Blocking stats.nova-nevedoma.com in an extension works too, and so does emailing us. Nothing else on the site depends on the counter.

If you use the dark-mode toggle, your browser stores that choice in localStorage. It stays on your device and we never receive it.

How · We · Store · Your · Personal · Information

Your information is securely stored in our PocketBase database on Railway, in our Listmonk database there if you signed up for a newsletter, and in our email inbox. Connections to the site are encrypted.

  • We keep order records until five years after the 31 January tax-return deadline for the year of the order, which is HMRC’s requirement for business records. We then delete them.
  • We keep correspondence for as long as it is useful for answering you, and review it every couple of years. We will then delete it.
  • We keep public replies beneath a post for as long as the post is published.
  • We keep your IP address from the order form in memory for one hour, to limit abuse. It is never written to a database. It is cleared the next time anyone submits the form after that hour is up, and whenever the server restarts.
  • Visitor statistics are kept as counts and daily totals, not as records about you.
  • We keep your newsletter address in our own Listmonk database on Railway for as long as you are subscribed. It is marked unconfirmed until you click the link in the confirmation email, and nothing else is sent before that. If you tick a letter on the sign-in form or on your account page, the code you signed in with has already confirmed the address, so no separate confirmation email is sent; your account page shows which letters you are subscribed to and lets you untick them at any time. Subscribing on the newsletter page signs you up to both letters, which are named on the form and again in the confirmation email before anything is sent: nevédomosti, publication updates only, which we send from Listmonk; and nova·nevédoma, all new writing, which Substack sends. You can drop either one at any time, on your account page or from the unsubscribe link in any letter. For nova·nevédoma we add your confirmed address to Substack by hand, usually within a week, and we keep a copy of Substack’s own subscriber list in the same database so that the two stay in step. Dropping nova·nevédoma here marks you unsubscribed in our database, and we remove you from Substack at the same sync; if you would rather not wait, the unsubscribe link in Substack’s own letters is immediate. Every letter carries an unsubscribe link. Unsubscribing stops the letters but keeps your record, marked unsubscribed; the same page offers “Wipe your data”, which deletes it, and so does writing to us. The IP address a signup comes from, and the address itself, are held in memory for up to an hour, to limit abuse, and never written down.
  • We keep your reader account until you ask us to delete it: write to [email protected]. The sign-in cookie lasts thirty days and holds your email address and a reference to your record, signed so that it cannot be altered. The IP address a login request comes from is held in memory for an hour, to limit abuse, and never written down.

Transfers · Outside · The · UK

Where we send personal information abroad, there is a contract behind it. Order details and the email address you sign in with reach Resend in the United States under its data processing agreement, which includes the Standard Contractual Clauses and the UK Addendum. Railway, which hosts the site, the order database and the newsletter list, and Cloudflare, which sits in front of it, each operate under their own data processing addendum containing the same clauses. Email us for a copy of any of them.

The other companies listed above are contacted directly by your browser, so we have no contract standing between you and them. If you become a patron, we pass your email address to Stripe to open the checkout, and everything you enter there goes to Stripe directly. The seller of record is Link, LLC, a Stripe company in the United States, which handles your payment data under its own privacy policy and Stripe’s privacy policy. What we send Stripe is covered by Stripe’s data processing agreement, which includes the Standard Contractual Clauses and the UK Addendum. If you tick nova·nevédoma, we pass your email address to Substack, in the United States, which sends that letter and holds your subscription under its own privacy policy.

Your · Data · Protection · Rights

Under data protection law, you have rights including:

Your right of access — You have the right to ask us for copies of your personal information.

Your right to rectification — You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure — You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing — You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing — You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability — You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

We make no decisions about you by automated means.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at [email protected] if you wish to make a request.

How · To · Complain

If you have any concerns about our use of your personal information, you can make a complaint to us at [email protected]. This is your right under section 164A of the Data Protection Act 2018. We will acknowledge your complaint within 30 days, investigate it, and tell you the outcome.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

Adapted from the Information Commissioner’s Office privacy notice template, © Crown copyright, licensed under the Open Government Licence v3.0.