Townloops.
Menu

Privacy Policy

How Townloops handles your data — and the rights you have over it.

Last updated: 2026-07-06

Who we are

Townloops is operated by CrimsonCowLabs. If you need to reach us about anything in this policy, email [email protected].

What we collect

Only what's needed to run the site. If you ask for the newsletter, we collect what's needed to send it.

  • Newsletter signups. Your email address, which town's newsletter you signed up for, the page you signed up from, and the time you confirmed. We use these to send you the weekly digest and nothing else.
  • Server logs. Standard web-server access logs (IP address, user-agent, requested URL, response status). Retained for up to 14 days for abuse-monitoring and debugging.
  • Cookies. Strictly-necessary (session, CSRF, and your cookie-preference choice) plus one optional preferences cookie — townloops_subscribed, set only if you accept preferences AND subscribe to a newsletter. It records which town newsletters you joined so we can hide the signup form on your next visit and show a share prompt instead. Retained for 180 days. See the Cookie Policy for the full list.
  • Analytics. We record aggregate page-view counts via a self-hosted Umami instance. Umami is cookieless — it uses a rotating in-memory hash of IP address, User-Agent, hostname, and a per-day salt as a session identifier. Nothing is stored on your device, no persistent identifier is created, no personal data is collected, and no data is sold or shared. If your browser sends Sec-GPC: 1 or DNT: 1, the tracker doesn't load at all. See the Cookie Policy for the exact behavior.

What we don't collect

  • No Google Analytics. No Meta Pixel. No advertising-network trackers.
  • We don't sell or rent personal data. Ever.
  • No browser fingerprinting. No cross-site tracking.
  • We honor DNT: 1 and Sec-GPC: 1 as an automatic analytics opt-out.

Newsletter and consent

The newsletter uses double opt-in. You give us your email. We hand it to our self-hosted Listmonk instance. Listmonk sends you a confirmation email. You click the link. That click is your consent record. Unsubscribe links live in the footer of every issue and take effect immediately. Listmonk pushes the state back to us via webhook, and we stop mailing you.

How long we keep things

  • Subscriber records: until you unsubscribe, then retained (marked inactive) for 12 months in case of a support question, and then deleted.
  • Server logs: up to 14 days.
  • Consent choice cookie: 12 months from your last update, then re-prompted.

Where your data lives

Everything runs on a single DigitalOcean droplet in the United States. Newsletter mail is relayed through a transactional email provider (currently Postmark). Their EU privacy terms are at postmarkapp.com/eu-privacy. We don't transfer data anywhere else.

Your rights

If you're in the EEA, UK, or California, you have the right to access, correct, delete, or export the personal data we hold about you, and to withdraw consent at any time. Email [email protected] and we'll respond within 30 days. If you don't feel we've handled a request well, you can complain to your local data-protection authority.

Changes to this policy

Material changes update the "Last updated" date at the top and trigger a re-prompt of the cookie bar. Non-material tweaks (typos, formatting) are made in place.