Privacy Policy

This Privacy Policy explains how Stephen Leynard (“Stephen,” “I,” or “me”), operator of stephenleynard.com and Mind Over Matter (the “Site”), handles personal information. The Site is operated from British Columbia, Canada. This policy is intended to describe the Site's actual practices clearly and to support compliance with applicable Canadian and British Columbia privacy requirements, including British Columbia's Personal Information Protection Act where applicable.

1. What information is collected

The information collected depends on how you use the Site. It may include your email address; account identifier; chosen display name; authentication and session information; newsletter consent, subscription status, and topic preferences; comments and likes you intentionally submit; messages you send to me; and technical information needed to deliver and protect the Site, such as IP address, browser or device information, request data, and security logs processed by infrastructure providers.

Your email address is not displayed publicly by the Site. Your display name, comments, and similar community activity may be visible to other visitors. Please do not post sensitive health information, confidential information, or personal information about another person in public comments.

2. Why information is used

Personal information is used only for purposes reasonably connected to operating the Site, including authenticating reader accounts; providing comments, likes, and account preferences; sending publication emails you choose to receive; responding to inquiries; maintaining consent and unsubscribe records; securing and troubleshooting the Site; understanding aggregate Site performance; preventing misuse; and meeting applicable legal obligations.

3. Consent and your choices

Where consent is required, the Site seeks consent appropriate to the circumstances and sensitivity of the information. Publication emails are optional and are separate from having a reader account. The newsletter option is not pre-selected. You may turn publication emails off through your reader account or use the unsubscribe mechanism included in publication emails.

You may withdraw consent for optional uses, subject to legal or operational limits. Withdrawal does not invalidate processing that was lawful before the withdrawal.

4. Reader accounts and authentication

Reader authentication and database functions use Supabase. Account data can include your email address, user identifier, display name, authentication information, community activity, and account preferences. Your browser stores authentication-session information so that you can remain signed in.

Supabase's own handling of information is described in its Privacy Policy. The Site does not place private Supabase administrative or service-role credentials in public webpage code.

5. Publication emails

Publication emails are delivered using Resend. When you opt in, records may include your email address, subscription status, selected topics, consent timestamp or source, unsubscribe status, and delivery information needed to operate the mailing list and prevent duplicate sends.

Resend's handling of information is described in its Privacy Policy. Publication emails include an unsubscribe mechanism. Transactional account or security messages that are necessary to operate your account may be treated separately from optional publication emails.

6. Cloudflare, analytics, and technical logs

The Site uses Cloudflare for hosting, content delivery, performance, and security. Cloudflare infrastructure may process technical request information needed to provide and protect the Site.

The Site also uses Cloudflare Web Analytics for aggregate readership and performance measurement. Cloudflare describes Web Analytics as privacy-first and cookie-free and states that it does not use cookies or local storage to track visitors for Web Analytics. Cloudflare's broader handling of information is described in its Privacy Policy.

The Site also maintains a simple per-article view count. When a published essay is opened, the Site increments that essay's aggregate counter. The counter does not store an IP address, user identifier, advertising identifier, or browser fingerprint. Session storage is used only to avoid counting repeated opens of the same essay within the same browser session.

7. Cookies and browser storage

The Site does not intentionally use advertising cookies or third-party behavioural-advertising trackers. Browser storage is used for functional purposes such as your theme preference, authentication session, navigation state, avoiding duplicate article-view counts within a browser session, and—when Stephen is using the private editor—local draft autosave. Cloudflare Web Analytics itself is operated without cookies.

8. Service providers and disclosures

Information may be processed by service providers acting in support of the Site, principally Supabase for authentication and database services, Resend for email delivery, and Cloudflare for hosting, security, content delivery, and Web Analytics. Information may also be disclosed if required or authorized by law; when reasonably necessary to protect users, the Site, or legal rights; to investigate fraud, abuse, or security incidents; or in connection with a legitimate transfer or reorganization of the Site subject to applicable obligations.

I do not sell or rent reader personal information to advertisers or data brokers.

9. Processing outside British Columbia or Canada

Service providers may process or store information in Canada, the United States, or other jurisdictions. Information handled in another jurisdiction can be subject to that jurisdiction's laws and lawful-access requirements. Provider infrastructure and subprocessors can change over time; the linked provider privacy policies contain additional information about their practices.

10. Retention

Information is retained only for as long as reasonably necessary for the purpose for which it was collected and for legitimate security, backup, dispute-resolution, consent-record, and legal needs. Different records may have different retention periods. Information no longer reasonably required will be deleted, anonymized, or securely disposed of when practicable, subject to backup and legal-retention constraints.

11. Security safeguards

Reasonable safeguards are used having regard to the nature of the Site and information involved. These include HTTPS, access controls, authenticated accounts, database row-level security, restricted server-side credentials, security response headers, and established infrastructure providers. No Internet service can guarantee absolute security.

If I become aware of a privacy or security incident, I will assess it and take response, notification, and mitigation steps required by applicable law and appropriate to the circumstances.

12. Access, correction, and account deletion

Subject to applicable legal exceptions and identity verification, you may request access to personal information about you under my control or ask that inaccurate or incomplete information be corrected. Signed-in readers can permanently delete their own reader account directly from My Reader Account. You may also contact [email protected] for an account-deletion or privacy request.

Self-service account deletion removes the active reader profile, comments, likes, newsletter-subscription/preferences record, and Supabase authentication account associated with that reader. The action is permanent and signs the reader out. Limited information may still be retained where permitted or required for security, fraud prevention, legal compliance, backup integrity, or record-keeping, and residual copies may persist temporarily in routine provider backups until they are overwritten or expire.

13. Children and youth

The Site is intended for a general audience and is not designed to knowingly solicit personal information from a child who cannot provide meaningful consent under applicable law. If you believe personal information was provided by a child in circumstances requiring parental or guardian consent, contact me so it can be reviewed.

14. Third-party links

The Site links to research sources, retailers, crisis resources, and other independent websites. Their privacy, security, and data practices are governed by their own policies. This Privacy Policy does not govern independent third-party websites.

15. Privacy questions and complaints

Please contact me first at [email protected] so I can investigate a concern. Depending on the circumstances, you may also have the right to contact the Office of the Information and Privacy Commissioner for British Columbia or another privacy regulator with jurisdiction.

16. Changes to this policy

This policy may be updated when Site functionality, service providers, or legal requirements change. The “Last updated” date identifies the current version. Material changes will be communicated in a manner appropriate to the circumstances, and additional consent will be sought where required.