Privacy Policy

Last updated: July 4, 2026

This policy explains what information Pip & Glitch (pipandglitch.com) collects, why we collect it, and what rights you have over it. We've tried to write it in plain English rather than legalese.

Who we are

Pip & Glitch is operated by MendozaLab (Ken Mendoza and Toni Bailey), based in Portland, Oregon, USA. We publish an illustrated children's coloring-story book series about healthy AI habits. This website is aimed at the parents, educators, and librarians who acquire the books — not at the children who read them.

What we collect

When you join our waitlist or fill out a form

• Email address — required
• Name — optional
• Consent flag and timestamp — recorded when you opt in
• Role (parent / educator / librarian / other) — optional
• Interest area (Book 1 / Book 2 / printables / events) — optional
• Source offer — which call-to-action captured your signup
• Page path — the page you signed up from
• UTM parameters (source, medium, campaign, term, content), if present in the link you clicked
• Referrer URL — the page that linked you to us, if any

Automatically, when you submit a form

• A SHA-256 hash of your IP address, generated with a server-side salt. We never store your raw IP address. This is used only for abuse and rate-limit prevention.
• User-agent string (your browser/device information)
• Country — a 2-letter code (e.g. "US") read from Cloudflare's CF-IPCountry header

Site analytics

We use Cloudflare Web Analytics, which is server-side and cookieless. It does not use cross-site tracking and does not collect personal identifiers. See our Cookie Policy for full details.

What we do not collect or use

• No third-party ad networks or retargeting pixels
• No Google Analytics, Facebook Pixel, or TikTok Pixel
• No cross-site tracking cookies
• No session recording
• No behavioral profiling

Why we collect it (legal basis)

For visitors in the EU/UK, our legal bases under GDPR are:

• Consent (Art. 6(1)(a)) — for our mailing list. We use double opt-in, so your consent is confirmed before we send you anything beyond the confirmation email.
• Legitimate interest (Art. 6(1)(f)) — for abuse prevention, such as the hashed IP address and user-agent string, which help us stop spam and automated abuse of our forms.

Who we share it with

We don't sell your data. We use a small number of service providers ("subprocessors") to run the site and mailing list:

How long we keep it

• Unconfirmed leads (never clicked the confirmation link) are purged after 90 days.
• Confirmed subscribers are retained until you unsubscribe.
• Unsubscribed rows are retained with an unsubscribed_at timestamp for our audit trail — no further email is sent to that address. We keep the email itself (rather than deleting it) so we don't accidentally re-add you through a bulk import later.

Your rights

If you're in the EU/UK (GDPR)

You have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Request erasure of your data
• Restrict how we process your data
• Receive your data in a portable format
• Object to our processing
• Withdraw consent at any time

If you're in California (CCPA)

You have the right to know what personal information we collect, to delete it, and to correct it. You also have the right to opt out of the "sale" of personal information — we don't sell personal information, so this right doesn't currently apply in practice, but we wanted to state it clearly.

How to exercise your rights

Email [email protected] with your request. We will respond within 30 days. You can also unsubscribe from any email using the one-click link in the email footer.

Children under 13

Pip & Glitch, the website, is built for parents, educators, and librarians — not for children. We do not knowingly collect personal information from children under 13, and there is no direct signup or account creation available to children on this site (COPPA). The Pip & Glitch book series itself is written for children ages 4–8, but it is purchased and used under adult supervision; children do not interact with this website to obtain it. If we become aware that we've inadvertently collected information from a child under 13, we will delete it promptly — contact us at [email protected].

International transfers

Because we use global infrastructure providers like Cloudflare, your data may be processed on servers located outside your own country, including in the United States. These providers maintain their own safeguards for international data transfers, as described in their privacy policies linked above.

Security

We take reasonable technical measures to protect your information, including hashing (never storing raw) IP addresses, relying on Cloudflare's security infrastructure (bot protection, TLS encryption), and limiting the data we collect in the first place. No method of transmission or storage is 100% secure, but we aim to collect the minimum necessary and keep it well protected.

Changes to this policy

We may update this policy as the site evolves. We'll update the "Last updated" date at the top of this page when we do. Material changes will be reflected here before they take effect.

Contact

Questions about this policy or your data? Email us at [email protected].

MendozaLab · Portland, Oregon, USA