privacy policy

last updated: june 16, 2026

this policy explains what data emptywords.co (the “site”) collects, how it is used, and your rights. the site is operated by Empty Words LLC.

1. what we collect

account information. username, email address, and a hashed PIN. if you arrive through an access request, the email you submitted.

payment information. payment processing is handled by Stripe. we do not store your card number, CVV, or full payment details. Stripe provides us with a customer ID, subscription status, and billing email. see Stripe’s privacy policy.

usage data. we collect data about how you interact with the site: pages visited, time spent reading, training exercise responses and scores, and session timing. this data is tied to your account and used to personalize your experience (progression, training spacing, engagement tracking).

technical data. browser type, device type, IP address, and referring URL. collected automatically through standard web server logs and client-side analytics.

local storage. the site stores session data, training progress, and authentication tokens in your browser’s local storage. this data stays on your device unless synced to our servers as described above.

2. how we use your data

  • to provide and personalize the service (content progression, training state, subscription management)
  • to process payments and manage subscriptions
  • to send transactional emails (account confirmation, subscription activation, access request status)
  • to improve the site and content based on aggregate usage patterns
  • to enforce our terms of service

we do not sell your personal data. we do not use your data for advertising. we do not share your personal data with third parties for their marketing purposes.

3. third-party services

we use the following services that process your data:

4. data retention

account data is retained as long as your account exists. if you request account deletion, we will remove your personal data within 30 days. aggregated, anonymized data may be retained indefinitely.

payment records are retained as required by tax and financial regulations.

5. your rights

you may:

  • request a copy of your personal data
  • request correction of inaccurate data
  • request deletion of your account and associated data
  • cancel your subscription at any time

to exercise these rights, contact hello@emptywords.co.

if you are in the European Economic Area, you have additional rights under the GDPR including the right to data portability and the right to lodge a complaint with a supervisory authority. where you exercise your right to data portability, we will provide your personal data in a structured, commonly used, machine-readable format (JSON or CSV).

if you are a California resident, you have rights under the CCPA including the right to know what data is collected, the right to deletion, and the right to opt out of sale. we do not sell personal data.

we do not sell your personal data to third parties. we do not collect biometric identifiers.

6. cookies

the site does not use third-party tracking cookies. we use browser local storage for authentication and training state as described above.

7. children

the site is not intended for anyone under 18. we do not knowingly collect data from anyone under 18. if we learn we have collected such data, we will delete it.

8. international users

the site is operated from the United States. if you access the site from outside the US, your data will be transferred to and processed in the US. by using the site, you consent to this transfer.

if you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

  • performance of a contract. account information, payment information, and usage data necessary to deliver the subscription you signed up for.
  • legitimate interests. technical data and aggregate usage analytics used to secure, maintain, and improve the site, balanced against your rights and interests.
  • legal obligation. payment and tax records we are required to retain under applicable law.
  • consent. any processing you have specifically agreed to, which you may withdraw at any time by contacting us.

10. data breach notification

we maintain reasonable safeguards to protect your data. in the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where required, within 72 hours of becoming aware of it. where the breach is likely to result in a high risk to you, we will notify you directly without undue delay.

11. changes

we may update this policy at any time. changes will be posted on this page with an updated date.

12. contact

questions about this policy: hello@emptywords.co