Privacy
Privacy policy
What we collect, why, and how to control it. Last updated: October 2026.
1. Who is responsible
Controller under the GDPR: Dr. Ivan Capobianco, STITCHES Newsletter, Im Winkelrain 36, 72076 Tübingen, Germany. Email: hello@stitches.today. STITCHES is a free, non-commercial newsletter project; we have not appointed a data protection officer because we are not required to.
2. In short
- We only ask for your email address (and, if you write to us, your name and message).
- Your email address is used to send the newsletters you chose, nothing else. We never sell it.
- We use Google Analytics and similar tools to understand how the website is used (see section 7).
3. Visiting the website
Hosting. The website is hosted by GoDaddy. When you open a page, the server automatically records technical data in log files: IP address, date and time, page requested, referring page, browser and operating system. We need this to deliver the website securely and to detect attacks (Art. 6(1)(f) GDPR). Log files are deleted by the host after a short period.
Fonts. Our typeface (Hanken Grotesk) is stored on our own server. No connection to Google Fonts is made.
Article pages. Article pages are published with WordPress. WordPress sets cookies only when an administrator logs in.
4. Newsletter subscription
When you subscribe, you are added directly to the newsletters you chose. We process your email address, the newsletters you chose, the page you subscribed from, and, if you came through a colleague’s link, their referral code. Legal basis is your consent (Art. 6(1)(a) GDPR).
Record of consent. We store the date and time of your subscription and the page you used, to be able to prove your consent.
Brevo. We send newsletters with Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France), which processes data on our behalf under a data processing agreement (Art. 28 GDPR), on servers in the EU.
Reading statistics. Our emails contain standard measurement of opens and clicks, so we can see which content surgeons find useful and improve the selection. This is part of the consent you give when subscribing.
Referral program. Each subscriber receives a personal referral code. When someone subscribes through your link, we store your code with their contact so we can count your referrals.
Unsubscribe. You can withdraw your consent at any time with the link at the end of every email or by writing to us. Your address is then removed from our lists. We may keep a blocklist entry so that you are not contacted again.
5. Spam protection
To stop automated sign-ups, our forms use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). It is loaded only when you start filling in a form and checks technical browser signals and your IP address, without tracking cookies. Legal basis is our legitimate interest in protecting the forms and the people whose addresses could be misused (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework. In addition, our server limits how often a form can be sent from the same IP address; these counters are kept for at most 24 hours.
6. Contact form and email
If you write to us, we use your name, email address and message only to answer you (Art. 6(1)(b) and (f) GDPR). Messages from the form are delivered to our mailbox through Brevo’s email service. We delete correspondence when it is no longer needed, unless statutory retention periods apply.
7. Website statistics
To understand how the website is used, we use the following services. You can block them at any time with your browser’s privacy settings or a content blocker, or opt out of Google Analytics with Google’s browser add-on (tools.google.com/dlpage/gaoptout).
Google Analytics 4
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use it to understand which pages lead to subscriptions. Google sets cookies and processes usage data; IP addresses are not stored by Google Analytics 4. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. Data is kept for the retention period set in our account, at most 14 months.
Brevo website tracker
Lets us connect website visits with newsletter subscriptions to improve our emails. Provider: Sendinblue SAS (see section 4).
SparkLoop (referral page only)
On the referral sign-up page we use SparkLoop (SparkLoop, Inc., USA) to attribute subscriptions to the referring partner. Data may be processed in the USA.
8. Podcast and external links
Podcast audio and the episode list are delivered from GitHub Pages (GitHub, Inc., USA). When you load the podcast page or play an episode, your browser connects to GitHub, which receives your IP address. Links to Spotify, Apple Podcasts, Amazon Music, YouTube, LinkedIn and journal websites are plain links: no data is sent to these services until you click them.
9. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). Write to hello@stitches.today.
You may also lodge a complaint with a supervisory authority, for example the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.
10. Changes
We update this policy when our services change. The current version is always on this page.