Privacy policy

The Biohacking Bible("we") is an educational publisher based in the United Kingdom. This page describes what personal data we collect, why, how long we keep it, and your rights under UK GDPR and the Data Protection Act 2018.

Who we are

We are the data controller for the data described below. Contact: [email protected].

What we collect, why, and how long we keep it

1. Newsletter subscriptions

• What: Your email address and the source of the subscription.
• Why: So we can send the monthly newsletter you signed up for.
• Lawful basis: Consent (UK GDPR Art. 6(1)(a)).
• Retention: Until you unsubscribe, then deleted within 30 days.

2. Account data (if you choose to sign up)

• What: Email address, password (hashed and never stored in plaintext), display name (optional), and the protocols you bookmark.
• Why: So you can sign in, manage your account, and access your bookmarks.
• Lawful basis: Contract performance (UK GDPR Art. 6(1)(b)).
• Retention: Until you delete your account; you can request deletion at any time.

3. Analytics (with your consent)

• What: Page views, approximate location (country/region), device type, and which pages were visited. No personally identifying information unless you also send it (e.g. in a contact email).
• Why: To understand which content is useful and improve what we write.
• Lawful basis: Consent (UK GDPR Art. 6(1)(a) and PECR for cookies).
• Retention: Google Analytics retains data for 14 months under our configuration.
• Withdrawal: Open the consent banner via the footer link any time to revoke.

4. Page feedback (“Was this useful?”)

• What: Your Yes/No vote, the page it relates to, an optional short comment if you choose to write one, and a one-way hash of your IP address and browser user-agent. We never store your IP address itself; the hash is made with a secret key only we hold, and we don’t attempt to reverse it.
• Why: To count each visitor’s vote once per page, to limit abuse, and to see which pages need review.
• Lawful basis: Legitimate interests (UK GDPR Art. 6(1)(f)): improving the accuracy of what we publish.
• Retention: Kept for as long as the page it relates to is published. Please don’t include personal details in a comment; we will delete a comment on request.

5. Contact email

• What: Whatever you send us by email.
• Why: To respond to you.
• Lawful basis: Legitimate interests (UK GDPR Art. 6(1)(f)) — operating the site and responding to correspondence.
• Retention: Email correspondence is retained for up to 24 months unless required longer for legal reasons.

Who processes data on our behalf

We use the following service providers (data processors) under written agreements:

• Resend — transactional email (EU region). Sends signup confirmation and newsletter emails.
• Hetzner Cloud — server and database hosting (Germany). Our self-hosted database stores accounts, newsletter subscribers, bookmarks, and page feedback.
• Cloudflare — DNS, CDN, and DDoS protection. Some request metadata transits Cloudflare.
• Google (Google Analytics) — analytics, only with your consent. Data may transfer outside the UK/EEA under Standard Contractual Clauses.
• GitHub — code hosting (no personal data of our users).

International transfers

Most of our processing happens in the EU/UK. Google Analytics (and some Cloudflare edge processing) may involve transfers outside the UK/EEA. These are protected by Standard Contractual Clauses or equivalent UK International Data Transfer Agreements.

Cookies

See our cookie policy for a full breakdown.

Your rights

Under UK GDPR you have the right to:

• Access the data we hold about you
• Correct inaccurate data
• Erase your data (the right to be forgotten)
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent at any time (where consent is the lawful basis)

To exercise any of these rights, email [email protected]. We aim to respond within one month.

Complaints

If you're unhappy with how we've handled your data you can complain to the UK Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to address it first.

Security

Passwords are hashed (we never see or store them in readable form). Connections to the site use HTTPS. Database access is restricted. We try to follow reasonable security practice for a small site.

Children

This site isn't aimed at under-18s. Don't create an account if you're under 18.

Changes to this policy

Material changes will be flagged on the site. Last reviewed: 2026-05-19.