Privacy Policy

Draft — not yet reviewed by a lawyer. This policy is a working draft. It describes what Earl does today as accurately as we can, and it will change before Earl takes its first paying customer. Nothing here is final until this notice is gone.

Effective: [Effective date, set when a lawyer has reviewed these pages]

This policy says what Earl keeps about you, why, who else handles it, how long we keep it, and how to have it deleted. "We" and "Earl" mean Hey Earl LLC (see our Terms of Service). Questions, or requests about your information: privacy@hey-earl.com.

The short version: we keep what we need to build and run your website and to keep your account safe, and nothing else. We do not sell your information, we do not show you ads, and Earl has no third-party tracking or analytics scripts and no cookie banner, because the only cookie Earl sets is the one that keeps you signed in. We keep our own record of how Earl is used, described below. The one thing we tell an advertiser is that a visit that came from a Google ad led to a sign-up, and we say it only by the ad click's own id; see "Telling Google Ads which ad clicks became customers" below, including how to say no.

What we keep, and why

When you sign in

• Your account: your email address, your name, and, if you sign in with Google, your profile picture's address and Google's id for your account. We use them to know who you are and to email you about your account and your sites.
• Emailed sign-in codes: a code is good for ten minutes and used once. We store only a scrambled form of it (a salted hash), never the code itself.
• Passkeys: if you add one, we keep its public key, its id, a counter your device keeps, and when it was added and last used. Your fingerprint, face or PIN never leaves your device; we never see it.
• Sessions: one cookie that keeps you signed in, holding a random token. We keep a scrambled form of the token, how you signed in, and when you last proved it was you. A session ends after 7 days without use, and after 30 days at most.
• Limits: to stop people guessing codes or flooding forms, we count requests per email address and per internet address for a short time. The counts are stored under a scrambled key, not the address itself.

When Earl works on your site

• Your site: its pages, pictures and code, and every change ever made, are kept in a git repository for your site. This is the site itself, and its history; it is what you take with you when you leave.
• Your conversation with Earl: what you ask for, notes you mark on a page, images you upload, Earl's questions and your answers, and each change's preview, checks and outcome.
• Rebuilding your existing site: when you ask Earl to rebuild a site, Earl visits its public pages, the way a search engine does: it reads them, respects the site's robots.txt, takes screenshots, and measures how fast they load. It uses no passwords and cannot see anything behind a login. We keep what it found (the pages' text, links and screenshots, and the speed measurements) with your site, to rebuild it and to show you the before and after.
• Your site's visitor tracking: if the site Earl rebuilds uses Google Analytics, Google Tag Manager, the Meta Pixel or Microsoft Clarity, Earl puts the same tool, with the same account id, into the rebuilt pages, so your site keeps the tracking you already used. Those tools are yours: what they collect about your visitors goes to Google, Meta or Microsoft under your own accounts with them, not to Earl.
• Checking changes: Earl reads every change before it goes live, to catch scams, phishing and similar content (see the Terms, section 6). A change it is unsure about is held for a person at Earl to look at, who then sees the change and its reasons.

Contact forms on your site

If your site has a contact form, a message a visitor sends is emailed to the addresses you chose, and we also keep the last 100 messages per site, for at most 90 days, so you can read them in Earl even if an email went astray. Each message holds what the visitor typed (usually a name, an email address and a message), the page's address, and when it was sent. Messages we judge to be spam are never kept; we only count them. To tell people from bots, every contact form uses Google reCAPTCHA: when a visitor starts filling in the form, their browser loads Google's reCAPTCHA, which collects information about the device and how it is used and sends it to Google, and the message is checked with Google when it is sent. The form says so under it, with links to Google's Privacy Policy and Terms of Service, which apply to that. We keep a daily count of messages per site. Everything goes when the site is deleted.

The addresses you choose to receive messages, and whether each has confirmed, are kept with your site. For your visitors, you are the one collecting their information and we handle it on your behalf; your own site's privacy notice should say so.

Joining the waitlist

If you join the waitlist, we keep your email address, the website you gave, and where you heard of Earl, and email you a link to confirm it. If you never open the link, we delete what you sent after 3 days. We keep the newest 20,000 requests, for at most 365 days, whether or not you are let in. We email you your place in line, and again when you are in.

Inviting a friend

If you invite a friend, we keep their email address and who invited them, and email them the invitation once. We keep it whether or not they take it, so you can see what happened to it.

Payment

Payments are handled by Stripe. Your card details go straight to Stripe and never reach us. We keep Stripe's ids for your site's customer record and subscription, the plan, and whether it is paid up.

Email we send

Sign-in codes, "your site changed" after every change goes live, notices about your account's security, contact form messages, your place on the waitlist, invitations, and word about a domain Earl registered for you (a reminder to confirm it, or that it will stop renewing). These are part of running Earl, so you cannot turn them off while you have an account. We send no marketing email.

How Earl is used

• Before you sign in, Earl records what happens on its pages anonymously: which screens are shown, which buttons are tapped, which interview questions are answered or skipped and how long they took, and where the visit came from (the website that sent you, and any campaign tags or ad click ids in the link you followed). It does this without cookies and without storing anything on your device. A visit is a random number your browser holds only while the page is open; a new page load is a new visit, and we cannot tell two visits apart as the same person.
• When you sign in, the visit you signed in on is joined to your account, and where that first visit came from is kept with your account. Signing in, you agree to this policy and our Terms.
• Signed in, Earl records how you use Earl: the screens you open and the steps you take (an ask sent, a change published, a domain connected, a plan paid for), with your account and site. We use it to run Earl and to make it better.
• It never holds what you type: not your asks, your answers, your messages, your email address or your phone number. It is ours alone: we do not sell it, we share it with no one except as the next section says, and there are no ad or tracking pixels on Earl's own pages. It is kept for 400 days, then deleted.

Telling Google Ads which ad clicks became customers

If you reached Earl by clicking a Google ad, the link carried that click's id (a gclid, gbraid or wbraid), which we record as above. When that visit later starts a site (you type in a website or name a new one) or pays for a plan, our server tells Google Ads, so Google can show Earl's ads to more people like you. What we send is the ad click's id, the time, the kind of event (started, or paid for a plan by the month or by the year) and a dollar amount for it, and nothing else: not your name, email address, site, or what you typed. Google uses it under its own terms. This is the only information about you that goes to an advertiser, and it uses no cookie, no tag and nothing stored on your device.

We never send it:

• if your browser sends Global Privacy Control (Sec-GPC), which we treat as an opt-out, with nothing for you to do;
• if you use "Do not sell or share my personal information" at the bottom of Earl's front page: it covers that visit and, if you are signed in when you use it, your account from then on. It is kept only as a random visit number (nothing on your device); a new visit needs the choice again unless you set Global Privacy Control, which lasts;
• for visitors in the European Economic Area, the United Kingdom or Switzerland, whom we do not tell Google about at all (we read your country from your connection when you visit, and keep only its two-letter code);
• for visits from crawlers and test clicks, or Earl's own staff and test accounts.

Each event is told once. To ask us not to send one that has not gone yet, or about anything above, email privacy@hey-earl.com.

Logs

Our servers log requests (including internet addresses), errors, and what each job did, to keep Earl running and secure. Logs are kept for up to 30 days. We take care that they do not hold codes, tokens, or what people type in forms.

Who else handles it

We use these companies to run Earl. Each handles your information only to provide its service to us.

Anthropic receives your content to make the changes you ask for. Under its commercial terms, Anthropic does not use what we send it to train its models.

We do not share your information with anybody else, except where the law requires it, to protect people from harm or fraud, or to a company that takes over Earl (see the Terms, section 17), which would be bound by this policy.

How long we keep it

• Your account is kept until you ask us to delete it.
• A site, its repository, its files, its conversation, its uploads, its contact form messages and its billing record are deleted when you delete the site. Stripe keeps its own records of payments, as the law requires it to.
• Contact form messages: the last 100 per site, for at most 90 days.
• Waitlist requests: the newest 20,000, for at most 365 days; never confirmed, 3 days.
• Sign-in codes stop working after ten minutes; sessions end after 7 days unused, 30 days at most.
• A domain Earl registers for you: the record that you agreed to Name.com's agreements, and the emails we send you about the domain, are kept for as long as Earl resells domains through Name.com and seven years after, as our agreement with Name.com requires, even when the site or your account is deleted.
• How Earl is used: 400 days.
• What was told to Google Ads, and opt-outs: the record of each event told (random ids and the time, no names) and each opt-out, for as long as Earl advertises on Google, then deleted.
• Logs: up to 30 days. Backups expire on their own schedule, at most 30 days after the original is deleted.

Your choices and rights

• See and take your site: your site is yours, history and all. Once it has a paid plan and that plan's refund window has passed without a refund, you can download it from Earl at any time, without asking (see the Terms, sections 8 and 9). While the window is open you can refund the plan instead, and Earl shows you the date the site is ready to take.
• Correct: you can change your account's email address in Earl; for anything else, ask us.
• Delete: delete a site from its page in Earl. To delete your whole account, email privacy@hey-earl.com from your account's address, and we will delete it and everything with it within 30 days (a site with a live plan has its plan cancelled first).
• Ask: email privacy@hey-earl.com to ask what we hold about you, or to object to how we use it. Depending on where you live (for example California or the European Union), you may have further rights, and you can complain to your local data protection authority.

Children

Earl is for businesses, and not for anyone under 18. We do not knowingly keep information about children.

Security

Sign-in uses passkeys and fresh checks before anything goes live; codes, sessions and job credentials are stored only as hashes; and each job that works on a site can reach only that site. No system is perfectly secure. If something goes wrong that affects your information, we will tell you promptly.

Changes to this policy

If we change this policy in a way that matters, we will email you at least 30 days before the change takes effect.

Contact: privacy@hey-earl.com, or write to Hey Earl LLC, 4070 N Beltline Rd, Ste 152 PMB 1032, Irving, TX 75038.