Privacy

The short version: your email address, and almost nothing else. There is no advertising, no third-party cookie, and no tracker that follows you anywhere. The fonts are served from our own server, so reading a transcript here does not tell Google you read it.

We do count page views, with a cookieless analytics service called Umami. It sets nothing on your device, it builds no profile of you, and it cannot recognise you on another site — there is no identifier to recognise. It tells us how many people read a page, which link sent them, and coarse things like your browser and rough country. The details are below.

What we hold, and why

Your email address. It is the account — there is no password and no username. We use it to sign you in, to send your private feed link, and to write to you about something you bought.

What you bought, and when. The season, the date, and Stripe's reference for the order, so the site knows what to unlock and so a refund can be matched to a purchase.

Sign-in links, stored only as a SHA-256 hash, single use, expiring 15 minutes after they are sent. We cannot read a sign-in link back out of the database, only check one.

A session cookie if you sign in, valid for 90 days. It holds your account id and a signature, nothing else. It is not shared with anyone and it is not used to follow you anywhere.

A coarse record of where your private feed is used. Each private feed is for one person, and we check that it has not been posted somewhere public. So when your podcast app fetches the feed we store a hash of your rough network and the app's name — the first three parts of the IP address and the app string, run through SHA-256 and truncated. Your actual IP address is never written down. The result is a count of distinct places, which is all the question needs: a phone moving around one network looks like one listener, and a feed being used from thirty unrelated networks looks like what it is.

Page views, counted without a cookie. We use Umami, a privacy-first analytics service, to count visits, to see which sites link to us, and to get a coarse picture of the browsers, devices and countries our readers use. Umami stores nothing on your device — no cookie, no local storage, no identifier of any kind. It works out that two page views are one visit by hashing your IP address together with your browser's name and a secret that is rotated regularly; the hash cannot be reversed and your IP address is never written down. There is no profile, no cross-site tracking, and no advertising use, because there is no advertising.

A note of where you arrived from. When you land on any page here, the site makes a note — for that browser tab alone — of which link brought you: a search engine, a podcast directory, a newsletter. It stays in your browser unless you press the buy button. Pressing it sends that one word to our checkout, and to Umami together with the page you pressed it on. If you go on to buy, the word is stored alongside your purchase, so we know which of the things we do actually reach people. Pressing the button is the moment it leaves your browser, not paying — so if you press buy and then change your mind at the checkout, that one word stays on the abandoned checkout in Stripe's records, and the fact that somebody pressed the button stays in Umami. If you never press buy at all, it goes nowhere and is discarded when you close the tab. What we keep with a purchase is that one word and nothing about what you read. If you do buy, the tab also remembers that the purchase has been counted, so refreshing the page does not count it twice.

Web server logs. Our server records requests in the ordinary way, including IP address and browser or app name, and they are kept for a short period. For the audio files we count these into download numbers using the IAB v2.1 rules, which is how we know whether anyone is listening. We do not tie those logs to your account.

What we do not do

• No advertising pixels, no fingerprinting scripts, no A/B tools, and no analytics that identifies you or follows you off this site.
• No advertising, ever, and therefore no ad networks to hand anything to.
• No selling, renting or sharing your address with anybody.
• No marketing email you did not ask for. If you buy, you get your access and any notice that actually concerns your purchase.
• No profiling and no automated decisions about you.

Who else touches your data

• Stripe processes the payment. They receive your email and payment details directly; we never see your card number. Stripe's own privacy policy governs what they hold.
• Umami counts page views, as described above, on their United States region. They receive your IP address in order to hash it and do not store it.
• Migadu carries our email, so your address passes through their servers when we write to you.
• Hetzner hosts the server the site and the database run on, in Germany.

That is the complete list. Nobody else is in the path.

How long

Your account and purchase record stay while the account exists — a season is a thing you bought, and we would rather you can still sign in to it in three years. Sign-in links are deleted after use or expiry. Feed-usage rows and server logs are short-lived.

Your rights

Write to hello@leastsuspected.com and we will:

• tell you everything we hold about you,
• correct it,
• delete it. That closes the account and revokes the private feed; the purchase record may be kept where tax or accounting law requires it.

Depending on where you live you may also have the right to object, to restrict processing, to receive your data in a portable form, or to complain to a data protection authority — the Office of the Privacy Commissioner of Canada, or your national authority in the EU and UK. You do not have to invoke a statute to get any of the above from us; asking is enough.

Children

The show is about serious crimes against children and is not made for children. The site is not directed at anyone under 16, and we do not knowingly hold data about anyone under 16.

Where the data lives

The site, your account and the database are on a server in Germany. Page views are counted in the United States — that is the region our Umami account is on. Nothing about you is stored there: the count is cookieless and your IP address is hashed on arrival and not written down, but the request itself does cross the Atlantic, and we would rather say so than let "a server in Germany" answer a question it does not answer. The other services named above are wherever they are; if you are outside those places your data crosses a border to reach us, which is unavoidable for any website.

Changes

If this policy changes in a way that matters, the date below changes and buyers are told by email.

---

Least Suspected is an independent podcast operated from Ontario, Canada. Contact: hello@leastsuspected.com. Last updated 19 September 2026.