Privacy policy

Last updated 27 August 2026

This site sells one PDF. It needs an email address to deliver it, and almost nothing else. What follows is the complete list of what is stored.

No cookies, no third-party analytics

This site sets no cookies and loads no third-party analytics or tracking scripts. There is no consent banner because there is nothing to consent to.

To know roughly how many people visit, the site keeps a random id in your browser’s local storage and counts page views, clicks on the buy button, and form submissions against it. That id is minted by your browser, is not derived from your IP address or device, is never sent to anyone but this site, and does not follow you anywhere else. Clear your browser storage and you become a new, unrelated visitor. Nothing about it can be turned back into a person.

If you buy the guide

We store one row containing:

• your email address — it is the delivery address for the download link, and the only way to send you a replacement later;
• the amount, currency and status of the order, and the payment reference given to us by the payment provider;
• a random download token, which is what your link contains, and when it expires (30 days);
• how many times the file was downloaded and when it was last downloaded.

We do not store your name, address, card details, or anything else from the checkout. We never see your card.

This is kept for as long as we sell the guide, because it is our record of the sale, our ability to re-send your copy, and what tax records require. Ask us to delete it and we will, once any refund window and tax obligation has passed.

Rate limiting, without keeping addresses

The checkout and download endpoints are open to anyone, so requests are counted to stop abuse. The counter is keyed on a hash of your IP address salted with a value that changes every day — never the address itself. What is stored is “some visitor, today, this many requests”. It cannot be reversed to an address, and today’s rows cannot be linked to yesterday’s. These counters are deleted after two days.

Who else is involved

• Dodo Payments — the merchant of record. They take the payment, hold your card details (we never do), handle tax, and have their own privacy policy. They receive your email address so they can send your receipt.
• Resend — sends the delivery email. They process your email address and the message.
• Supabase — hosts the database the order row lives in.
• Vercel — hosts the site. Like any web host they process request logs, which include IP addresses, for a short period.

Your rights

You can ask what we hold about you, ask for it to be corrected, or ask for it to be deleted. Email hello@howtoship.today from the address you bought with and we will do it. There is no form and no wait — it is one person and a very small database.

Contact

Ishan Gupta, hello@howtoship.today.