Privacy Policy

The short version: we don’t run analytics, we don’t run ad pixels, we don’t set tracking cookies of our own, and we have nothing to sell about you. This page explains the little that does happen.

Last updated 8 November 2026.

Who we are

WinterCotton publishes this site, wintercotton.com, and our journal at blog.wintercotton.com. You can reach us at hello@wintercotton.com.

What we collect

Things you give us

At present, nothing. This site has no contact form, no comment section, no accounts and no newsletter sign-up. If we add an email list later, this page will be updated before it goes live, and joining will always be something you choose.

If you email us, we have your message and your address, for as long as it takes to answer you and a reasonable period afterwards.

Things collected automatically

Our host, Hostinger, keeps standard server logs: IP address, browser and operating system, the page requested, and the time. This is ordinary web-server behaviour, it’s needed to serve the site and to defend it against abuse, and we don’t connect it to any individual.

What we do not collect

Named specifically, because “we value your privacy” means nothing on its own. We do not run Google Analytics or any other analytics suite. We do not run the Meta pixel, the Pinterest tag, or any other advertising pixel. We set no cookies of our own for tracking, advertising or profiling. We do not build visitor profiles, we do not fingerprint devices, and we do not buy data about you from anyone.

Third parties that see your request

Loading a page here means your browser contacts a small number of other companies, each of which necessarily sees your IP address:

• Hostinger — our web host. They serve every page and keep the server logs described above.
• Google Fonts (fonts.googleapis.com) — serves the two typefaces this site uses.
• jsDelivr (cdn.jsdelivr.net) — serves the small animation library behind the page’s scroll effects.
• Hostinger Reach (cdn-reach.hostinger.com) — an email-marketing tool bundled with our hosting. It loads on each page but is not currently configured or collecting anything for us. If we ever switch it on for a sign-up form, we’ll say so here first.

If you follow an affiliate link, the retailer — most often Amazon — sets its own cookies to credit the referral. That happens on their domain under their policy, not ours. See our affiliate disclosure.

Why we’re allowed to do this

For readers in the UK and EU: serving the site and keeping it secure rests on our legitimate interest in running a working website. Answering an email you send us rests on that same interest, or on performing what you asked. Nothing here relies on consent, because nothing here is optional tracking.

How long we keep things

Server logs are held by our host on their normal rotation, a matter of weeks. Email correspondence is kept while it’s useful and deleted when it isn’t.

Where data goes

Our host and the services listed above operate internationally, so a request may be handled on servers outside your country, including in the United States. Where UK or EU data protection law requires a transfer safeguard, these providers rely on Standard Contractual Clauses or an equivalent mechanism.

Your rights

If you’re in the UK or EU, you may ask what we hold about you, ask for it to be corrected or deleted, object to our handling it, or ask for a copy. Since we hold almost nothing, the honest answer is usually that there’s nothing to send — but ask, and we’ll tell you plainly. Write to hello@wintercotton.com. If you’re unhappy with our answer you can complain to your national supervisory authority; in the UK that’s the Information Commissioner’s Office.

If you’re in California: we do not sell or share your personal information, and we have not done so in the preceding twelve months. We don’t offer financial incentives for data, and you won’t be treated differently for exercising any right under the CCPA or CPRA. The same address above reaches us for access and deletion requests.

Children

This site isn’t aimed at children under 13 and we don’t knowingly collect anything from them. If you believe a child has sent us personal information, email us and we’ll delete it.

Security

The site is served over HTTPS. Administrative access uses individual accounts with application-specific credentials rather than shared passwords. No site can promise perfect security, but we hold so little that there is very little to lose.

Changes

If this policy changes in a way that matters — a new form, a new tool, anything that collects something — we’ll update the date at the top and describe what changed rather than quietly editing a line.