Privacy Policy

Last updated: November 5, 2026.

This policy covers knowthesite.com: reading its pages, asking for a free state checklist, buying the guides, getting the files, asking for a refund, and emailing us.

Who we are

Tomme, Inc. runs this site and sells the guides. It is a California corporation, California Secretary of State entity number 4096370. Know the Site is a name Tomme, Inc. uses.

Tomme, Inc. 2108 N St #13526, Sacramento, CA 95816 United States

Privacy questions and requests: hello@knowthesite.com. We have not appointed a data protection officer.

Notice at collection

This is the short version. The banner, the checklist form and the buy button link here. The rest of this privacy policy has the details.

What we collect, and why.

Your email address and US state, when you use one of our email forms (the free checklist, or "Email this page to my computer" on a guide page). We use them to send what you asked for: the checklist for your state and, from a guide page, a link back to that page. If you tick the follow-ups box, we also send 5 short emails over 9 days about doing the check and about our guides, and keep your sign-up on our email list. With the box left empty, "Send it" sends that one email and adds you to no list. If you allowed advertising, a hashed version goes to our ad platforms (see "Sold or shared").
Your email address, name and billing address, when you buy. Stripe collects them on its checkout page. We use them to take payment, work out sales tax, send your files and emails about your order, keep sales records, and handle refunds. If you tick Stripe's box to hear from us and leave checkout without paying, Stripe gives us your email address and we send one reminder (see "Emails we send"). Whatever you chose on the banner, we also record with your order which of our guide pages checkout started from and any campaign tags in that page's link, only to count our own sales by page and ad (see "Buying the guides"). If you allowed advertising, hashed versions go to our ad platforms (see "Sold or shared").
Your payment card details. Stripe collects them. We never see or store your full card number.
What you send us: emails, and any notes you choose to send with a refund request. We use them to answer you and to keep a record of what we agreed.
Online identifiers and activity: cookie identifiers, your IP address, your device and browser, the pages you visit here, the page or ad you came from, and your clicks. Our host collects some of this for every visit. The analytics, session-recording and advertising tools collect it only after you allow them. Separately, whatever you choose, we record the guide page and campaign tags of a purchase with the order (see "Buying the guides").
Your privacy choices, and a record of when you made them.

We don't ask for health information, government ID numbers, account passwords, or other sensitive details.

Sold or shared. We don't sell your information for money. When you allow advertising, the advertising companies in "Cookies and tracking" collect information on this site. Our server may also send them a record of your sign-up or purchase, with your email address and other contact details hashed. California law calls that "sharing" and may call it a "sale". Other states call it "targeted advertising". Only these are shared this way, and only when you allow advertising: your online identifiers and activity; what you bought and its price; and your contact details from a sign-up or purchase, with your email address, name and street address hashed and your city, state, ZIP code and country as they are. Your payment card details and what you send us are never sold or shared. You can stop it: see "Your choices" below.

How long we keep it. See How long we keep information.

Your choices. No analytics, session-recording or advertising tool loads until you choose. Use Your Privacy Choices, also at the bottom of every page, to change your choice at any time.

What we collect

Asking for a free checklist or a page link. You type your email address and choose your US state, on the checklist form or in "Email this page to my computer" on a guide page, then press Send it. Above the button is an optional box for the follow-ups, never ticked to start with. With the box left empty, it emails you the checklist for that state and, from a guide page, a link back to that page. It adds you to no list, and nothing else follows. With the box ticked, it sends the same email, then 5 short emails over 9 days from Know the Site (Tomme, Inc.) about doing the check and about our guides. Each follow-up has a one-click unsubscribe, and they stop if you buy the guides with that address or through a link in one of them.

If you choose the follow-ups, we keep your sign-up with our email provider, Resend: your email address, the state you chose, which page of this site the form was on, the time you agreed, the version of the consent wording you saw, and a code that identifies its exact words. If you allowed analytics or advertising, we also keep the campaign source described under "Our own cookies and storage". We don't add an address that has unsubscribed, bounced or marked our email as spam. Resend also processes the delivery of every email we send, including one you asked for only.

Limits on sends. To stop anyone using our forms to send unwanted email, we keep counters made from keyed, daily codes for the recipient address and the connection address, plus an aggregate daily count. The counters contain no raw email address or IP address. We use daily cleanup to remove individual counters older than 48 hours, normally within 48–72 hours. A failed cleanup can delay removal. The aggregate count is reused. Ordinary host and mail-provider records follow their own retention below.

Buying the guides. Stripe runs checkout on its own site. Stripe collects your email address, your payment details, the name on the card, and your billing address. It uses the billing address to work out sales tax. After you pay, Stripe tells us your email address, name, billing address, what you bought, the amount, the tax and the date. We use these to send your files and keep a sales record.

For every purchase from the United States, or when we can't tell the country, whatever you chose on the banner, we record with your order which of our guide pages the checkout started from, including whether it was a page link you asked us to email you, and any campaign tags in that page's link (such as utm_campaign). We use them only to count our own sales by page and ad. We don't share them with advertising companies, and we use no cookie or ad click identifier for this. If you allowed analytics or advertising tools, they see the pages you visit, campaign tags included, on their own (see "Cookies and tracking"). A copied or forwarded link does not prove which ad you saw.

We also store some details with the payment record in Stripe:

the campaign source described under "Our own cookies and storage", if you allowed analytics or advertising;
the choices you had made on this site when you started checkout;
if you arrived through a signed guides link in one of our sales emails, the email-list contact identifier. We use it to stop guide sales emails after a purchase, even if you pay with a different email address;
if you allowed analytics, the Google Analytics identifiers for your browser and visit;
if you allowed advertising, the identifiers the advertising tools set in your browser, your IP address, and your browser's user agent (the line of text that names your browser and device).

Getting your files. We email you four download links: each of the two guides as an HTML file and a PDF. The links serve the current files for the edition you bought; a copy already saved on your device does not change. Each link works for 30 days. Our host records when a link is used.

Asking for a refund. You ask by email. No reason or notes are needed. If you choose to send notes, please leave out your customers' names, messages, order details and passwords. We read them only to handle your refund and to improve the guides.

Emailing us. Email sent to our @knowthesite.com addresses is received by AgentMail, an email service. We keep emails so we can answer you and keep a record of what we agreed, including refunds. Please don't send health or other sensitive details.

Website logs. Vercel, our hosting provider, keeps technical records of visits so it can run and secure the site. These include your IP address, your browser type, the page you asked for, and the time. We use them to keep the site working, fix problems and spot abuse. We don't use them to build a profile of you.

Your consent record. When you make a choice in the banner or on the choices page, your browser sends our server a short record. See "The record of your choice" below.

Analytics, session recording and advertising tools. Only after you allow them. See "Cookies and tracking".

Cookies and tracking

Nothing loads until you choose

Where you are decides what happens. We go by the location our host sees for your connection. A VPN can put you in the wrong place.

In the United States, including its territories, and whenever we can't tell where you are, a banner asks first. It has three buttons of equal weight: "Accept all", "Reject all" and "Choose". Until you choose, none of the analytics, session-recording or advertising tools loads, and your browser sends nothing to those companies. If you choose "Reject all", we remember it on later visits in the same browser. If you agree, we ask again after 12 months.
Outside the United States, none of these tools runs at all, and there is no banner.

Without JavaScript, none of these tools runs.

You can check this yourself, the way our guide teaches. Open a fresh private window, visit this site, and don't click anything. Your browser's Network tab shows requests only to knowthesite.com.

"Choose" lets you allow each kind of tool separately:

Analytics: counts visits and the steps people take, so we can see how the site is used.
Advertising: tells our ad platforms whether an ad led to a visit, a sign-up or a purchase, and lets them show our ads to people who have visited this site.

The banner shows only the kinds of tool we use at the time.

Your choices

The "Your Privacy Choices" link is at the bottom of every page. It opens a page titled "Do Not Sell or Share My Personal Information". There you can turn each kind of tool off or on, or choose "Reject all". Turning a tool off stops it in that browser. It also removes the cookies that tool set on this site, where our script can reach them. It can't remove cookies those companies set on their own sites.

Your choices are kept in your browser, so they apply to that browser only. Make your choice in each browser you use. An email to us can't change the setting in your browser. If your browser blocks storage for this site, or a choice can't be saved, the tools stay off for the rest of the visit.

Global Privacy Control

If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sale, sharing and targeted advertising, and we also turn off session recording. The advertising tools and session recording stay off in that browser, even if you click "Accept all". "Opt-Out Request Honored" shows beside the "Your Privacy Choices" link while the signal is on. We store the opt-out, so advertising and session recording stay off in that browser if the signal later stops. The signal on its own stores nothing for a visit we treat as outside the United States, because the tools don't run there. A choice you make before the page has finished checking where you are is saved as "Our own cookies and storage" describes, with advertising and session recording off while the signal is on.

The signal does not turn off analytics if you allowed it. You can turn analytics off with the "Your Privacy Choices" link.

We don't respond to "Do Not Track" signals, which have no agreed meaning.

Analytics

Google Analytics (Google). It collects the pages you visit, the page you came from, your device and browser, your approximate location from your IP address, how far you scroll and which parts of a guide page you reach, the buttons and links you click (including links to other sites), the questions you open, whether a demo video plays, and these steps: viewing the guides' sales section, opening the email form, asking for a checklist, starting checkout, and buying. These records name the part of the page or the button, never what you type. On the thank-you page it records the purchase: what you bought, the price, and an order reference that is not your name or email address.

Cookies on this site: _ga and _ga_<ID>. Google documents both as lasting 2 years.

When you start checkout with analytics allowed, we store your browser's Google Analytics identifiers with the order in Stripe. When the payment goes through, our server sends Google Analytics the purchase with those identifiers and the same order reference. If you later get a refund, our server tells Google Analytics about the refund with the same order reference, unless you have since turned analytics off in that browser. That is how we count purchases when the thank-you page doesn't load.

When advertising is also allowed in your browser:

we turn on Google Analytics' "Google signals". Google links your visits here to your Google account, if you are signed in to Google and your account allows ad personalization. We see visits across devices, and reports on the age range, gender and interests of visitors, only as totals;
with the purchase on the thank-you page, Google Analytics receives a one-way hash (SHA-256) of your email address, name and street address, and your city, state, ZIP code and country as they are, from checkout. Google's format takes those four unhashed. Our server works out the hashes, so your plain email address and name are never put on the page.

When advertising is off, Google signals is off, and Google Analytics gets no contact details. We tell Google not to use Analytics data for ads when advertising is off, and we have turned on Google's setting that restricts advertising data when advertising storage is denied.

We have set Google Analytics to keep information tied to cookie identifiers for 14 months.

Google's notices: https://policies.google.com/privacy and https://business.safety.google/privacy/.

Advertising

Google Ads (Google). It collects the ad click identifier if you came from a Google ad, the pages you visit here, and two steps: asking for a checklist, and buying. With each of those steps it receives data Google calls "enhanced conversions". For a checklist sign-up, that is a one-way hash (SHA-256) of your email address. For a purchase, it is a one-way hash of your email address, name and street address, with your city, state, ZIP code and country as they are, and the order reference. Our server works out the hashes. Your browser sends them to Google from the page after you sign up and from the thank-you page.

Cookies on this site: _gcl_au, and _gcl_aw and similar _gcl_ cookies when you arrive from a Google ad. Google documents them as lasting 90 days. It also keeps _gcl_ls in your browser's local storage, for the same purpose. Turning advertising off deletes it.

We also store the Google ad click identifier with your sign-up and your order. Our server does not send it to Google today. If that changes, we will update this policy first.

Meta pixel and Conversions API (Meta, for Facebook and Instagram ads). The pixel collects the pages you visit here, whether you viewed the guides' sales section, asked for a checklist, started checkout or bought, and details of the pages and the buttons you click.

Cookies on this site: _fbp (Meta doesn't state how long it lasts) and _fbc when you arrive from a Facebook or Instagram ad (Meta says 90 days). The pixel also keeps lastExternalReferrer and lastExternalReferrerTime in your browser's local storage (the last site that sent you here, and when). Turning advertising off deletes them.

Our server also sends Meta a record of your checklist sign-up and of your purchase. See "Sign-ups and purchases sent from our server".

Meta's notice: https://www.facebook.com/privacy/policy/.

The advertising companies above can also use what their tools collect for their own purposes, including showing ads on other sites. They may connect it to an account you have with them. That can include your activity over time and across other websites. You can also opt out of many interest-based ads at https://www.aboutads.info/choices.

Under California law, letting the advertising companies above collect information here, and sending them records of sign-ups and purchases, is "sharing" personal information for cross-context behavioral advertising. It is also a "sale" under California law and other state laws that count the value of the advertising service, even though no one pays us money for the information. Other states call it "targeted advertising".

Letting Google use Google Analytics data for ads while advertising is allowed (Google signals and the hashed contact details) is part of the same "sharing" and "sale".

Sign-ups and purchases sent from our server

Some records go from our server straight to an analytics or advertising company, not through your browser. They go only if you allowed that kind of tool in your browser at the moment it counts:

a checklist or page-link request counts at the moment you send the form;
a purchase counts at the moment you start checkout. If you finish a checkout later from the link in our reminder email, our server sends them nothing about that purchase. If you turn advertising or analytics off in the same browser after you start checkout, or it starts sending Global Privacy Control, our server checks again immediately before each attempt to send anything about that order, a later refund included, and sends nothing for the kinds you turned off. If it can't check, it sends nothing. If our server can't save your choice when you make it, your browser sends it again, a few times on that page and then on each page you open, until it is saved. If your browser won't let this site store anything, it tries only on that page. Global Privacy Control needs none of that: every page you open asks our server where you are, and while the signal is on, our server marks your orders then, wherever you are. If it can't mark them at that moment, your browser sends it a record of the signal, retried as above. This works through the kts_rv cookie, so it can't reach an order if you clear your cookies before you turn things off. If you start two checkouts at the same moment in one browser, the cookie may keep the code for only one of them, and a later choice then can't reach the other order.

Our server checks again when you send the form or start checkout. It sends nothing to an advertising company if your browser sent Global Privacy Control, if our opt-out cookie says advertising is off, or if we treat the visit as outside the United States. Before it sends any later record, such as a purchase, it also checks a list of people who have opted out or asked us to delete their information by email (see "Your choices and rights"), and sends nothing for them.

To Google Analytics, when analytics was allowed: the purchase, and any later refund, as described under "Analytics".
To Meta, when advertising was allowed: your sign-up and your purchase.

A record sent to an advertising company contains:

a one-way hash (SHA-256) of your email address, which is also used as an ID for you;
for a sign-up, the state you chose, hashed;
for a purchase, a one-way hash of your first name, last name, city, state, ZIP code and country from checkout, what you bought, and the price;
the identifiers that company's tool set in your browser on this site;
your IP address and your browser's user agent;
an event code, so the company counts the event once when your browser also reports it.

Each company receives only the items its format accepts. Our server works out the hashes. Your plain email address and name are never sent.

What we never send

We never send your plain email address or name, your Stripe session ID, a download link, your refund notes, or anything you email us, to any analytics or advertising company.

We don't add the guide page and campaign tags recorded with your order to the purchase records we send to analytics or advertising companies. If you allowed those tools, they receive the page addresses and campaign tags of your visits separately, as described under "Cookies and tracking".

Where the tools never run

None of the analytics, session-recording or advertising tools loads on the download pages or the "Your Privacy Choices" page. Session recording also never loads on the checklist pages, the checkout page, or our order and thank-you pages. On the thank-you page, the analytics and advertising tools you allowed load to record the purchase. The thank-you page's address does not contain your Stripe session ID.

Our own cookies and storage

These belong to this site. They are not shared with other companies, except as the table says.

Name	Kind	When it is set	What it holds	How long it lasts
`kts_consent`	Browser storage (not a cookie)	When you make a choice. A choice made before the page has finished checking where you are is saved straight away, and kept even if we then treat the visit as outside the United States.	Your choices, the time, the policy version, and the random code in "The record of your choice"	An opt-out stays until you clear your browser's storage. An agreement is asked again after 12 months.
`kts_optout`	Cookie	When you turn a kind of tool off, including before the page has finished checking where you are (so this can happen on a visit we then treat as outside the United States), or when your browser sends Global Privacy Control (the signal on its own sets nothing for visits outside the United States)	Only which kinds of tool are off. It keeps your opt-out even if browser storage fails.	1 year
`kts_src`	Cookie	Only after you allow analytics or advertising	Where your first and latest visits came from: campaign tags in the link (such as `utm_source`), ad click identifiers, the first page you landed on, and the time. We copy it to your checklist sign-up and to your order in Stripe.	90 days
`kts_contact`	Cookie	When you follow a valid signed guides link in one of our sales emails, whether or not you allowed analytics or advertising	A signed email-list contact identifier, not your email address. Our server reads it only on `/buy/` to hold sales emails during checkout and match a purchase to that contact. The identifier is stored with the checkout record in Stripe and the checkout start time with the contact in Resend. Page scripts cannot read this cookie.	30 days after the link is followed; the signed token can expire sooner. The token in the email link lasts 60 days from issue.
`kts_checkout`	Cookie	When you click to buy	A random code that lets the thank-you page check it is talking to the browser that started checkout. It works only on our order pages.	1 hour
`kts_rv`	Cookie	When you click to buy, only if you allowed analytics or advertising	A random code for each checkout you started in the last 45 days (up to 128), each with the day it was made, and nothing else about you. Each code is also stored with its order in Stripe. If you later turn analytics or advertising off in this browser, our server uses the codes to stop sending anything about those orders for the kinds you turned off. It keeps a note of what you turned off for each code for 24 months, as it keeps the record of your choice. Page scripts can't read this cookie, and it is never sent to another company.	45 days from your latest checkout. Each code is dropped 45 days after it was made, which covers checkout, payment and the 30-day refund window.
`kts_order`	Cookie	When checkout sends you back to our site	Which order the thank-you page should show, so the order number isn't in the page's address. It works only on our order pages.	1 hour
`kts_sent`	Browser storage (not a cookie)	When the thank-you page loads after a purchase, whatever you chose	Up to 50 references to purchases already reported to a tool you allowed, so the same purchase isn't counted twice. No new references are added when no tool is allowed; an empty list may be saved if none was stored.	Until you clear your browser's storage
`kts_consent_retry`	Browser storage, and browser storage for this visit only	When our server couldn't save a choice that turns analytics or advertising off, or a Global Privacy Control record	Up to 20 of those records, as described in "The record of your choice", so your browser can send them again	Until our server saves them, or until you clear your browser's storage
`kts_storage_failed`	Browser storage for this visit only	When your browser won't let us save a choice	Only that saving failed, so the tools stay off for the rest of the visit	Until you close the tab
`kts_probe`	Browser storage (not a cookie)	When a page checks that browser storage works	A test value	Removed straight away

Stripe runs checkout on its own site and may use its own cookies there for payments, security and fraud prevention. Stripe's privacy policy covers those.

The record of your choice

When you make a choice in the banner or on the "Your Privacy Choices" page, your browser sends our server a short record. The record holds a random code created for this purpose, the time, your choices, the version of this policy, whether we placed you in the United States, and whether your browser sent Global Privacy Control. We don't put your name, email address or IP address in it. If our server can't save what a choice turns off, your browser sends the same record again, so we may receive it more than once. If your browser sends Global Privacy Control but won't let this site store anything, it sends a new record on each page. Our host's ordinary logs of that request include your IP address, as they do for every page (see "Website logs"). We keep these records for 24 months, so we can show what choices were made and when.

How we use information

Send the checklist or page link you asked for, and the follow-up emails if you chose them.
Email buyers about their order: the files, short help emails in the two weeks after buying, and corrections and law updates to the edition they bought.
Send one checkout reminder to people who ticked Stripe's box to hear from us and didn't finish paying.
Take payment, work out sales tax, and deliver the guides.
Answer your emails and handle refunds.
Read refund notes and replies to improve the guides.
Keep the site working and secure, and stop abuse of our forms and download links.
Keep the records we need for accounting, taxes and disputes.
Count our own sales by guide page and ad, from the guide page and campaign tags recorded with each order (see "Buying the guides").
See how the site is used, and count the sign-ups and sales our ads lead to (see "Cookies and tracking").
Show our ads to people who have visited this site, when they have allowed advertising.

Emails we send

We use Resend to send:

the checklist, and from a guide page a page link, that you asked for;
the links to your files after you buy;
short emails about using the guides in the two weeks after you buy;
corrections and law updates to the edition of the guides you bought;
one reminder with your checkout link, if you ticked Stripe's box to hear from us and didn't finish paying;
the 5 follow-up emails over 9 days about doing the check and about our guides, only to people who ticked the follow-ups box (or, before October 30, 2026, pressed "Send it with the follow-ups").

Replies to the emails you send us come from our @knowthesite.com address through AgentMail (see "Emailing us").

Every follow-up has an unsubscribe link, and email apps that support it also show a one-click unsubscribe button. When you unsubscribe, we mark your address unsubscribed on our list; if your address isn't on the list, we add a one-way hash (SHA-256) of it to the list our server checks before sending optional email, so the stop still holds. Unsubscribing from sales emails doesn't stop emails about an order you placed or the guide updates you're owed; it does stop the optional help emails after a purchase. Resend open tracking and click tracking are turned off. Our own signed guides links can still connect a visit to an email-list contact: the kts_contact cookie described above supports checkout matching. A forwarded link can match the purchase to the person who received the original email. If no valid link cookie is present and you pay with a different address, we may not match the purchase to your subscription. You can unsubscribe from sales emails at any time.

Emails after you buy. After your files arrive we send up to four short emails over two weeks to help you use the guides: where to start, one change you can undo, a short question about what was useful, missing or unclear, and a last check for missing files with how the refund works. They don't sell anything. Each has a link to stop them; stopping them doesn't affect your order, new download links, refunds or guide updates. We don't send them after a refund, or to an address that unsubscribed or that we've stopped emailing. To decide who gets them we use your order record in Stripe, and we keep on our host's private storage a one-way hash of your email address with which of these emails went and when, so nobody gets one twice.

Corrections and law updates. We also email buyers when we publish a correction or law update to their edition of the guides. These messages say what changed and give new links to the current files. They contain no sales offers and no tracking. We send them to the address on the order, and we keep the order reference (a code made from your order number, not the number itself), the edition, the revision and whether we sent it, so each update reaches you once. Every update email has a link to stop guide-update emails, at knowthesite.com/updates/stop/, and you can also ask us by email. Stopping them doesn't change your files or your purchase. A sales-email unsubscribe doesn't stop them. We stop them after a full refund, and while a refund or a payment dispute is still open. If an email to you bounced or was marked as spam, or you asked us to delete your information, we don't send them either; you can still ask us for your files.

If you leave checkout without paying. Stripe's checkout page may show a box asking whether you want to hear from us. If you tick it and leave without paying, Stripe gives us your email address when the checkout expires, about 30 minutes later, and we send one email with a link back to the same checkout. It says what you were buying, the price and the refund terms, and has an unsubscribe link. We send at most one such reminder to an address in any seven days, and none if you've bought the guides, started a new checkout, unsubscribed or asked us to stop. If you don't tick the box, Stripe doesn't give us your address and we send nothing. Ticking it when you complete a purchase doesn't add you to any list. We keep a one-way hash of your address and when the reminder went for eight days.

Bounces, spam reports and stop requests. If an email to you can't be delivered, you mark one of ours as spam, or our email provider refuses to send to you because of an earlier bounce or complaint, Resend tells us. We add a one-way hash (SHA-256) of your address to our suppression list with the reason, and mark your address unsubscribed on our email list; we then stop optional emails and guide updates to it. If you unsubscribe from a checkout reminder or a follow-up, we add the hash with that reason: it stops reminders, sales emails and the help emails after a purchase, but not guide updates you're owed or anything about an order. We keep these entries for as long as we might otherwise email the address.

We use these companies to run this site. Each handles information so it can do its job for us. Some also use it for their own legal, security and fraud-prevention purposes, under their own privacy policies.

Stripe runs checkout and processes payments, and works out sales tax (Stripe Tax). It handles your email address, name, billing address and payment details, and the details we store with your order (see "Buying the guides").
Resend sends requested checklists and page links, your file links, the help emails after a purchase, guide-update emails, checkout reminders and the follow-ups, and keeps our email list. It handles your email address, the state you chose, your sign-up details and the content of the emails we send you. It tells us when an email bounces or is marked as spam, and before each guide-update email we ask Resend whether the address is on its list of addresses that bounced or complained.
Vercel hosts this website and the download links. It handles visit logs, including IP addresses, the record of your choice, the short-lived abuse counters for our email forms, and our private email records: the guide-update send records and stop requests, which help emails and checkout reminders went, and the suppression list.
AgentMail receives and sends email for our @knowthesite.com addresses. It handles your email address, the emails you send us and our replies.
Service providers that help us read and answer email handle the content of your emails and our replies.
Google Workspace runs our company mailbox, which may get copies of the emails you send us and our replies.
Google runs Google Analytics. It handles what is described under "Analytics".
Google runs Google Ads. It handles what is described under "Advertising".
Meta runs the Meta pixel and the Conversions API. It handles what is described under "Advertising" and "Sign-ups and purchases sent from our server".

We may also share information if the law requires it, to defend a legal claim, or to protect people who use this site. If Tomme, Inc. sells or transfers this business, the records of the business go to the new owner, under this policy.

How long we keep information

Follow-up sign-ups: until you unsubscribe or ask us to delete them. This includes the consent wording version and the time you agreed. After you unsubscribe, Resend keeps your email address marked as unsubscribed, so you don't get our follow-ups again. Leaving the box empty does not create a list contact; the email provider still processes its delivery record.
Email-form abuse counters: individual keyed counters are normally removed within 48–72 hours by daily cleanup; a failed cleanup can delay removal. The aggregate count is reused.
Guide-update records: for each order, a code made from the order number, the edition, the revision and whether we sent it, kept as long as the order record. A request to stop guide-update emails is kept as a code made from your email address, for as long as we need it to honor the request. If you ask us to delete your information, we delete your send records and keep only that code.
Emails after you buy and checkout reminders: the hashed record of which help email went and when, for as long as we need it to avoid sending one twice; checkout-reminder records, eight days; stop requests and suppression entries, for as long as we might otherwise email you.
Orders and refunds: the record in Stripe, with the details we store there, for as long as tax, accounting and legal rules require. Stripe keeps its own payment records under its own policy.
Download links: each stops working 30 days after we send it. That doesn't delete your order record or our host's logs.
Our cookies and storage: as listed in "Our own cookies and storage".
The record of your choice: 24 months.
Email-list purchase matching: the signed link expires after 60 days and its browser cookie lasts at most 30 days. The matching contact identifier in Stripe follows the order-record retention above. The checkout start time in Resend follows the follow-up sign-up retention above.
Your emails and refund notes: as long as we need them to answer you, keep a record of what we agreed, and improve the guides.
Website logs: Vercel keeps our request logs for at most 30 days (1 day on our current plan).
Google Analytics: 14 months for information tied to cookie identifiers. Totals, such as visits in a month, are kept longer.
The session-recording and advertising companies: each keeps what its tool collects under its own policy and settings. Their cookies last as listed in "Cookies and tracking".

Your choices and rights

You can ask us to:

tell you what personal information we have about you, and what we did with it;
correct it;
delete it;
send you a copy;
stop selling or sharing it, and stop using it for targeted advertising.

Wherever you live in the United States, you can make these requests.

How to ask. Email hello@knowthesite.com. We may ask for details that confirm it's you and help us find your records, such as the email address you used. Someone you authorize can ask for you, if they show they are acting for you. We will answer within 30 days. If we need longer, we will tell you why and when to expect an answer. If we can't do what you ask, we will tell you why. For example, we must keep a purchase record for taxes.

Appeal. If we say no, you can appeal. Reply to our answer with "Appeal" in the subject line. A person at Tomme, Inc. will look at the request again and answer within 45 days. If we still say no, we will tell you how to contact your state's attorney general.

Opting out of sale, sharing and targeted advertising. Use the "Your Privacy Choices" link at the bottom of every page, or turn on Global Privacy Control. Both work for the browser you use them in. You can also email us. We then add a one-way hash (SHA-256) of your email address to a list our server checks before it sends any later sign-up or purchase record to an advertising company, and within five minutes of that, our servers stop sending later records for that address. An email can't change the setting in your browser; use the link for that. Records of sign-ups and purchases are sent from our server only when advertising was allowed in your browser at that moment (see "Sign-ups and purchases sent from our server").

What a deletion covers. We delete what we and the companies that run this site for us hold, including your contact on our email list, except records we must keep, such as a purchase record for taxes. We also add a one-way hash of your email address to a list our server checks; within five minutes, it stops sending later records about you. If you ask, we also ask the analytics and advertising companies to delete what they received, using the tools they give us. You can also use their own privacy tools, linked in "Cookies and tracking".

We won't charge you a different price or give you a worse service because you used these rights. Unsubscribing from our emails doesn't change your purchase or your refund.

Deleting your information doesn't delete the files you already downloaded.

You don't have to give us any information. Without an email address, we can't send a checklist or sell you the guides.

US state privacy laws

Some US states give their residents specific privacy rights, such as the rights in "Your choices and rights" above. Wherever you live, you can use those rights with us.

We started using analytics and advertising tools on this site on October 6, 2026. Before that day, we had not sold or shared personal information. Since then, we have shared these kinds of personal information with the advertising companies named in "Cookies and tracking", when advertising was allowed:

identifiers: cookie identifiers, your IP address, and one-way hashes of your email address, name and address details;
approximate location: from your IP address, and the city, state, ZIP code and country from checkout;
commercial information: whether you looked at the guides, asked for a checklist, started checkout or bought, and the price;
internet or network activity: the pages you visit here, the page or ad you came from, and your clicks;
device and browser details.

We have also shared inferences with Google: the age range, gender and interests Google estimates through Google signals, which we see only as totals.

We use the information for the purposes in "How we use information".

We don't knowingly sell or share the personal information of anyone under 16.

California privacy notices

Changes to this policy. The date at the top shows when it last changed. See "Changes to this policy".
Do Not Track. We don't respond to browser "Do Not Track" signals. We do honor Global Privacy Control, as described above.
Other companies' tracking. When you allow them, the companies in "Cookies and tracking" collect information about your activity on this site, and they may connect it to your activity over time and on other websites.
Reviewing and changing your information. Email hello@knowthesite.com to see or correct what we hold.

Children

This site and the guides are for adults running a business. You must be 18 or older to buy the guides or ask for a checklist. We don't knowingly collect personal information from children under 13. If you believe a child has sent us personal information, email hello@knowthesite.com. We will look into it and delete information we should not have.

Visitors outside the United States

Tomme, Inc. is based in the United States. If you are outside the United States, none of our analytics, session-recording or advertising tools runs for you. We store nothing in your browser for them, with two exceptions described in "Our own cookies and storage", and a third only if your browser sends Global Privacy Control after a checkout and our server can't record it at once: kts_consent_retry, until it does. A privacy choice you make before the page has finished checking where you are is saved when you make it, and recorded as described in "The record of your choice". The thank-you page after a purchase saves kts_sent. No new references are added when no tool is allowed; an empty list may be saved if none was stored. Neither turns any of these tools on.

If you ask for a checklist, buy the guides or email us from outside the United States, we use your information as this policy describes, except that we don't record the guide page or campaign tags described in "Buying the guides" with your order. We rely on our contract with you to take payment and deliver the guides, on a legal duty for tax and accounting records, on your request for the checklist and our emails, and on our interest in keeping the site secure and answering your emails.

Your information is processed in the United States. You can ask to see, correct, delete, or receive your information, and you can object where we rely on our own interest. You can complain to your local data protection authority. We have not appointed a representative in the EU or the UK.

Changes to this policy

If we change this policy, we will update the date at the top. If a change is significant, we will make it easy to notice on this page. If we start collecting new kinds of information, or using it in a new way, we will update this policy before we do.

Contact

hello@knowthesite.com