Privacy & cookies

Tommi Sundqvist is responsible for the personal data processed on this site. Questions about privacy, or about your own data, go to nakedgut@gmail.com. The site is built and maintained by Aalto Visuals, which processes data only on the author’s instructions.

This site sets no cookies of its own for visitors, and there are no advertising, social media or tracking cookies. Two exceptions are worth naming:

• Payments. The checkout is embedded on this site. When you open it — or follow a link that opens it — and only then, Stripe’s payment script (Stripe.js) loads, and it sets two cookies on this domain for fraud prevention: __stripe_mid, kept for one year, and __stripe_sid, kept for 30 minutes. They are necessary for taking the payment you asked for, which is why there is no cookie banner. Visitors who never open the checkout do not get them. Inside the payment form, Stripe may also use cookies on its own domains, under Stripe’s privacy policy.
• Site administration. When the author signs in to the site’s admin area, one first-party cookie keeps that session open. Opening the admin area also leaves a note in that browser’s local storage, so that its later visits are left out of the statistics. Neither touches visitors of the public pages.

Visits are counted without cookies and without any outside analytics service. What is recorded:

• each page view: the page address, and the domain of the site you arrived from, if any;
• how long the page was actively open in a visible tab, and how far down it was scrolled;
• clicks on links to Amazon, on the review link and on email links — the visible text of the link and which kind of link it was;
• opening the checkout, playing the podcast (and reaching its halfway point), and asking for the free sample;
• the device type (phone, tablet or computer) and whether the visit looks like an automated bot;
• a pseudonymous visitor hash.

The hash is calculated from your IP address and your browser’s user agent with a secret key that changes every day. It lets one day’s visits be counted without recording who made them: the IP address and the user agent themselves are never written to the database, and a hash from one day cannot be matched to the next. Because whoever holds the secret key could, on the same day, recompute the hash for a known IP address and browser, the statistics are pseudonymous rather than anonymous. There are no profiles, no cross-site tracking and no advertising networks.

The checkout opens in a window on this page, but the payment form inside it is run by Stripe: card details are typed into Stripe’s own form and never reach this site. Opening the checkout creates an order record that holds only Stripe’s reference for that checkout. When you pay, this site also stores the payment reference, the payment status, the amount and currency, the country Stripe reports, your email address, and how many times your download link was used and when it was last used.

Your email address is used for your payment receipt and to help if something goes wrong with your order. The book itself is delivered on the thank-you page, not by email. The address is not added to any mailing list and not used for marketing.

Buying on Amazon happens entirely on Amazon: that purchase is covered by Amazon’s own privacy policy, and this site receives no data about it.

If you ask for the free sample, your email address is added to the author’s own list. What is stored is the address, the date, where on the site you signed up, the version of the wording you agreed to, whether you are still subscribed, and a random token that lets an unsubscribe link identify you without containing your address. Nothing else — no name, no tracking of what you open.

The list is used for the sample itself and for occasional updates about the book, the audiobook and what Tommi is working on. It is never sold, rented or shared, and it is not used for anyone else’s marketing.

Before the first update is sent, the newsletter service that sends it will be named on this page. To leave the list, or to have your address erased, write to nakedgut@gmail.com — that works at any time. Any update that is sent will also include a way to unsubscribe. An unsubscribed address is kept, marked as unsubscribed, only so that it is never used again; if you ask for erasure, it is deleted completely.

If you write to nakedgut@gmail.com, your message and address are used to answer you, and for nothing else.

• Selling and delivering the eBook, including the receipt and help with your order: to perform the contract with you.
• Keeping order records for bookkeeping: a legal obligation under accounting law.
• The mailing list: your consent, which you can withdraw at any time.
• Visitor statistics and keeping the site secure — limiting abusive traffic and preventing payment fraud: the author’s legitimate interest in understanding how the site is used and in keeping it and its buyers safe.
• Answering your email: the legitimate interest in replying to you, or the contract when it concerns your order.

• Hosting: Vercel. The site’s server functions run in Vercel’s Stockholm region (EU).
• Database: Supabase, EU region (Stockholm).
• Payments: Stripe.
• Email: Google (Gmail), for the messages you send to nakedgut@gmail.com.

Each of these providers handles the data to provide its service, under its own terms and privacy policy. Vercel, Stripe and Google are headquartered in the United States, and Supabase is also a company based outside the EU, so even where data is stored in the EU, they or their subcontractors may process it elsewhere. Where personal data may be transferred outside the EU, the transfer relies on the provider’s standard contractual safeguards — the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

Order records are kept as long as bookkeeping law requires. A mailing-list address is used while you are subscribed; after you unsubscribe, only the address and the opt-out mark are kept, so that the opt-out is honoured, until you ask for erasure. Visitor statistics are kept in the pseudonymous form described above, and records that can be tied to you are deleted on request.

Under the GDPR you may ask for access to your data, correction of it, its erasure, restriction of its use, or a copy of it to take elsewhere, and you may object to its processing. Where processing is based on your consent, you can withdraw it at any time. In practice this concerns order and email data — the visit statistics hold no name, email address or IP address, only the pseudonymous hash described above. Write to nakedgut@gmail.com.

If you believe your data has been handled incorrectly, you can also contact the Finnish Data Protection Ombudsman (tietosuoja.fi).

The date at the top of the page shows when this statement was last changed. Material changes will be described here rather than made quietly.