Privacy policy

This policy explains what I Wrote That Book (“we”, “us”) collects through the website iwrotethatbook.com, including its waitlists and free printables, and what we do with it. The I Wrote That Book app, where children make books, has its own children’s privacy notice.

The short version

• If you join a waitlist, we keep your email address and which list you joined, and email you to confirm it and, later, to tell you the app has launched. Teachers can also tell us a grade band, a class size band, whether they’d like to hear about a pilot, and a state.
• The waitlist is for grown-ups. We ask you to confirm you’re 18 or older, and we never knowingly collect anything from a child on this site.
• The forms use a spam check from Cloudflare, called Turnstile, which loads only once you start filling in a form.
• We count visits with Cloudflare Web Analytics, which doesn’t use cookies.
• The site sets no cookies and has no ads, ad pixels or tracking tools. It remembers your light or dark theme choice in your own browser, and that choice never leaves your device.
• We don’t sell or rent your personal information, and we don’t use it for advertising.

What we collect and why

The waitlists

There are two lists: one for families and one for teachers. When you sign up, we store:

• your email address;
• which list you joined;
• when you signed up, and when you confirmed;
• for teachers, only if you give them: a grade band, a class size band, whether you’d like to hear about a classroom pilot, and your state.

We then send one email asking you to confirm the address. Until you confirm, we send you nothing else; if you sign up again more than a day later without having confirmed, we send a fresh confirmation email in place of the first. Once you confirm, we use the address only to tell you when the app opens (for teachers, when classrooms can start and how to get a class code), and for nothing else. If you ask to hear about a pilot, we may write to you about it.

If you came to the site from an ad or a newsletter, the form also sends the campaign named in the page’s address. We don’t store it with your sign-up: it only adds one to a daily count of sign-ups from that campaign, so we can tell which ads are worth paying for without knowing who came from which. The campaign isn’t sent to our mailer or put in any email or link we send you, so confirming your address is counted only as one more confirmation for that day and list. Ad click IDs are removed from the address as the page loads and never sent to us.

To keep the form free of spam and abuse, our server uses your IP address to limit how many sign-ups come from one place in a short time. We never store your IP address: the limit counts sign-ups under a scrambled code made from your IP address and the current hour, which can’t be turned back into the address, isn’t linked to your sign-up, and is deleted within a day.

The lists are stored in a Cloudflare D1 database, and the confirmation and launch emails are sent through Cloudflare’s email service from [email protected]. You can leave a list at any time with the link in any email we send, or by writing to [email protected].

The spam check (Cloudflare Turnstile)

The forms use Cloudflare Turnstile. It loads from Cloudflare (challenges.cloudflare.com) only once you start filling in a form, so visitors who don’t use a form never load it. To tell people from bots, it reads signals from your browser and device, such as your IP address, your browser’s user agent and technical details of the connection, and gives the form a one-time token. Our server sends only that token to Cloudflare to check it, not your email address. Cloudflare processes these signals to run the check and, as its own controller, to improve its bot detection; see the Turnstile privacy addendum.

The free printables

The drawing sheets, story planner and certificate download without a sign-up. We don’t know who downloads them beyond the page counts below.

Email

If you write to [email protected], [email protected] or [email protected], we receive your address and whatever you send, and use it only to answer you. Please don’t send us information about a child.

Analytics (Cloudflare Web Analytics)

We use Cloudflare Web Analytics to see how many people visit and which pages they read. It works without cookies or other storage in your browser and doesn’t follow you across other websites. It records information about each page view, such as the page address, the referring site, your browser and operating system, and your approximate country, and shows it to us only as totals.

Hosting and security logs

The site is hosted on Cloudflare Pages. Like any web server, Cloudflare processes your IP address and details of each request to deliver the site and protect it from attacks. If a form runs into an error, our server may record a short technical note about the failure; that note never includes your email address or IP address.

Your theme choice and fonts

If you pick a light or dark theme, your browser remembers it in its local storage. It stays on your device and is never sent to us. The site’s fonts are served from our own site, so loading a page makes no request to a font service.

Cookies

This site sets no cookies, so it shows no cookie banner. Turnstile runs in a frame served by Cloudflare once you start filling in a form, and we use it without its clearance cookie.

Who we share it with

• Cloudflare, which hosts the site, stores the waitlists, sends our emails, forwards mail sent to our addresses, runs the spam check and provides the analytics, under the Cloudflare privacy policy.
• Authorities or other parties when the law requires it, or to protect our rights, our users or the public.
• A successor business, if I Wrote That Book is ever merged or sold, under the same protections described here.

We don’t sell, rent or trade personal information, and we don’t share it for targeted advertising.

How long we keep it

• Waitlist sign-ups you never confirm are deleted after 30 days.
• Confirmed addresses are kept until we have sent the launch email for that list and for 12 months after, in case we open in stages, or until you leave the list, whichever is first.
• The rate limit’s scrambled codes are deleted within a day.
• Campaign counts are totals with no personal information, and we keep them.
• Emails are kept as long as we need them to answer you and to meet our legal obligations.

Your choices and rights

You can ask us what personal information we hold about you, ask us to correct it, ask for a copy, or ask us to delete it, by emailing [email protected]. We’ll answer within 45 days. We may need to confirm that the request is really from you first, and we won’t treat you differently for asking. Depending on where you live, the law may give you further rights; we’ll answer any reasonable request either way.

Children

This website is for grown-ups, and the waitlists are for adults only. We don’t knowingly collect information from children under 13 on this site. If you believe a child has given us information here, email [email protected] and we’ll delete it. How the app handles children’s information is in our children’s privacy notice.

Security

The site is served only over HTTPS, and the forms are checked on the server before anything is stored. No method of transmission or storage is perfectly secure, but we take reasonable steps to protect what you send us.

Changes to this policy

If we change how the site handles information, we’ll update this page and its effective date. If a change affects how we use waitlist addresses, we’ll email confirmed subscribers before it takes effect.

Contact us

Questions or requests about privacy go to [email protected].