Privacy policy.

• We count visits without cookies (Ahrefs Web Analytics and PostHog). Only if you accept analytics do PostHog, Google Analytics, Microsoft Clarity and Vercel Web Analytics set cookies or record how pages are used, with anything you type hidden.
• If you sign up for the newsletter, we collect your email and (optionally) a source label.
• If you create an account to save tool results, we collect your email and the saved results.
• If you buy the toolkit, Stripe handles payment (we never see your card).
• We do not sell user data. Period.
• You can delete your data any time by emailing info@sleepyhero.com.

2.1 Analytics

Two tools count visits for everyone, without cookies and without storing anything on your device:

• Ahrefs Web Analytics — aggregate page views, referrer, country and device class; no personal identifiers.
• PostHog, cookieless mode — page views and clicks on buy buttons. PostHog makes an anonymous ID by hashing your IP address and browser on its own servers with a salt that changes every day, so visits cannot be linked across days. We also send your country, a two-letter code our host reads from your connection; never the address itself. Nothing is recorded. posthog.com/privacy.

When you click a buy button, the link carries two labels: the kind of site your visit came from (for example “chatgpt” or “google”, never the address you came from) and the first page you opened here. We log them with the click, Amazon links use a tracking code for that source, and Impact receives them for the stores it handles, so we can see which sources lead to purchases. Neither label identifies you. For everyone they are held only in the open page; after “Accept analytics” they are also kept in this tab’s session storage until you close the tab.

These load only after you click “Accept analytics” on the consent banner, and never if you choose “Essential only”:

• PostHog — sets a first-party cookie so the pages of one visit link together, and may record the session (pages, scrolling, clicks) so we can find what is broken or confusing. Everything typed into a form is hidden in recordings.
• Google Analytics 4 — cookies; page views and events. policies.google.com/privacy.
• Microsoft Clarity — session recordings and heatmaps, with sensitive content masked. privacy.microsoft.com/privacystatement.
• Vercel Web Analytics — cookieless, no third-party trackers. Page views and route performance only. Vercel hashes the visitor IP and rotates the hash daily so visits cannot be linked across days. vercel.com/docs/analytics/privacy-policy.

2.2 Newsletter subscribers

When you subscribe to the newsletter, we collect your email address and (optionally) a source label that tells us which page you subscribed from. We use Resend to deliver emails. Resend's privacy policy: resend.com/legal/privacy-policy.

2.3 Account holders (saved tool results)

If you create an account to save tool results, we use Supabase to authenticate you (magic link via email) and to store your saved results. We collect: your email address, your authentication metadata, and the input + output data of any tool result you choose to save. Supabase's privacy policy: supabase.com/privacy.

2.4 Toolkit buyers

If you buy the SleepyHero Toolkit, payment is handled by Stripe. Stripe collects your payment information directly — we never see your full card number. We receive an order ID, your email, and the amount. Stripe's privacy policy: stripe.com/privacy.

2.5 Error reporting

We use Sentry for error reporting on the production site. Sentry may collect your IP address and user agent when an error occurs in your browser. We do not associate Sentry data with newsletter subscribers or account holders. Sentry's privacy policy: sentry.io/privacy.

We use the minimum cookies necessary for the site to function. Specifically: an authentication cookie if you create an account, a theme preference cookie (dark/light), and Stripe's checkout cookies during checkout flow. We do not use advertising cookies, tracking cookies, or third-party analytics cookies.

A cookie banner with consent management lands at Gate B per GDPR requirements. EU visitors will be asked to consent before any non-essential cookie is set.

4.1 GDPR (EU residents)

You have the right to access, correct, delete, or export your personal data. You also have the right to object to processing and to lodge a complaint with your supervisory authority. To exercise any of these rights, email info@sleepyhero.com. We respond within 30 days.

4.2 CCPA (California residents)

California residents have the right to know what personal information we collect, to delete it, to correct it, and to opt out of sale (we do not sell user data, so this last one is automatic). To exercise these rights, email the same address.

4.3 Children

SleepyHero is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, contact us and we'll delete it.

• Newsletter subscriber emails: retained until you unsubscribe.
• Account data: retained until you delete your account.
• Saved tool results: retained until you delete the result or your account.
• Stripe order data: retained for 7 years (tax/legal requirement).
• Sentry error logs: retained for 90 days.
• Analytics data (Ahrefs, PostHog, Google Analytics, Clarity, Vercel): kept for the period each provider's plan sets.

Our hosting (Vercel), database (Supabase), email (Resend), payment (Stripe) and analytics (PostHog, Google, Microsoft, Ahrefs) providers may store data in the United States. For EU residents, we rely on Standard Contractual Clauses (SCCs) with these providers per Article 46 GDPR.

We update this policy when our data handling changes. The "last updated" date at the top reflects the most recent change. Material changes are notified via the newsletter and (where applicable) by a banner on the site.

For any privacy question or to exercise your rights, email info@sleepyhero.com. We aim to respond within 5 business days.