Privacy Policy

Effective date: October 3, 2026

This policy explains how The Human Playbook ("we," "us," "our") — the publisher of TheoHartley.com — collects, uses, and protects your personal information. "Personal information" means anything that identifies you or can reasonably be linked to you. We built this site to be light on data by design: no ads, no data sales, and we collect only what running a publication requires.

Who we are

The Human Playbook publishes educational content about patterns in human behavior. Theo Hartley, the voice of the publication, is a fictional persona created and operated by a human team. Questions about this policy or your data: matan@theohartley.com.

What we collect

• Email subscription data. If you subscribe to the weekly newsletter, we collect your email address and, over time, engagement data (opens, clicks) through our email platform. Subscribing is voluntary; every email includes an unsubscribe link that works immediately.
• Technical data. Like nearly every website, our hosting and content-delivery infrastructure (Amazon Web Services CloudFront) automatically logs requests — IP address, browser type, pages visited, timestamps — for security and performance. We do not use this to identify individuals.
• Analytics data — only with your agreement. If you accept analytics (see Analytics and cookies below), we collect which pages you view, which site referred you, an approximate location derived from your IP address (city/country level — never a precise position), your device and browser type, and a random visitor ID stored in your browser. We use this to see which articles land. It is never linked to your email address, and we do not use it to work out who you are.
• Correspondence. If you reply to a newsletter or email us, we keep the correspondence. Readers sometimes share personal stories or sensitive information about relationships, emotions, or mental health. You are never required to share this; anything you send is shared at your own discretion, and you can ask us to delete it at any time.
• Member account data (when membership launches). If you create a member account for full articles, we will collect your email and login credentials via our membership provider. This policy will be updated before that launches.

We do not knowingly collect data from children under 16. This site is intended for adults.

How we use it

• To send you the newsletter and content you asked for (legal basis: your consent).
• To operate, secure, and improve the website (legal basis: legitimate interest).
• To respond when you contact us (legal basis: legitimate interest / consent).
• To measure which articles resonate, so we write better ones (legal basis: your consent if you are in the UK or EEA; legitimate interest elsewhere).

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We do not run ads.

Who we share it with

Only service providers who process data on our behalf, under their own contractual confidentiality obligations:

• Email platform (Beehiiv) — stores subscriber emails and sends the newsletter.
• Hosting and content delivery (Amazon Web Services) — serves the website and holds server logs.
• Email service (Microsoft 365) — handles our correspondence mailboxes.
• Analytics (PostHog) — measures site traffic, and only ever runs if you have agreed to it.

We may also disclose information if required by law, or to establish, exercise, or defend legal claims.

Where your data goes

We are a small publication using established providers, and some of them store data in the United States — including Amazon Web Services (the website, member accounts and your playbook), PostHog (analytics) and Beehiiv (newsletter). If you are in the UK or EEA, that means your data may be transferred outside your country to a jurisdiction whose privacy laws differ from your own. Where those transfers happen, they rely on the safeguards our providers put in place — principally the European Commission's Standard Contractual Clauses — and, for analytics specifically, on your consent, which you can withdraw at any time using the control below.

Analytics and cookies

We use PostHog to count pageviews and see which articles actually get read. That is the only analytics on this site. We run no advertising, we do not sell or share your data with advertisers, and we do not track you across other websites. We have deliberately left session recording switched off — we do not watch recordings of your visit.

If you are in the UK or EEA: analytics does not run until you press Accept on the banner. Press Decline and nothing loads at all — no analytics script, no analytics storage, no data sent anywhere. Refusing is exactly as easy as accepting, and if you ignore the banner we treat that as a no.

If you are outside the UK and EEA: analytics runs by default, and you can switch it off at any time using the control below. We honour that choice everywhere, regardless of where you live.

When analytics is on, it stores a random visitor ID in your browser so that a returning reader is not counted as a new person. It is not connected to your name or your email. This site sets no advertising cookies of any kind. We remember your answer to the banner in a single browser entry named thp_analytics_consent — that one is stored without asking, because it is the only way to honour your answer on the next page.

Member accounts

If you create a free member account, we collect your email address and a password. Accounts are stored and managed by Amazon Cognito (AWS, our infrastructure provider); we never see your password. Signing in stores an authentication token in your browser’s local storage so you stay signed in on this device. It exists only to keep you signed in, is not used for tracking or advertising, and is removed when you sign out. To delete your account, use the contact below and we will remove it. Members can post public responses to articles; the display name and text you submit are published with the article and stored with your account id. Contact us to remove a response. To power member features, we also keep with your account a record of which articles you have read and rated as a signed-in member.

Your playbook

Members can keep a private playbook. At the end of a play you can note where it shows up in your life, the move you plan to make and by when; a few days later we ask whether you ran it, and you can say what happened. If you save a move from an exercise in Tools, your answers in that exercise are kept with the move.

Your agreement comes first. Nothing is saved until you agree, the first time you save a move. We record the date and the version of the wording you agreed to. The legal basis is your consent, which you can withdraw at any time by deleting your playbook.

What we store: the move you wrote, the area you picked (for example “Work”), when you meant to do it, the play or tool it came from, the date, and — if you answer — whether you ran it and your one-line note. That is all. We do not score, rate or label you, and we do not analyse what you write for mood or mental state.

Who can see it: only you, when signed in. Entries are stored with your account by Amazon Web Services in the United States, encrypted with a key used for nothing else. No page on this site, including our own admin screens, shows anyone’s entries. Access to the underlying database is limited to the small team that runs the publication, and is used only to keep the service working or to carry out a request from you. Your entries are never used for advertising, never sold or shared, and never sent to our analytics: analytics may record that a move was saved or answered and on which play, but never what you wrote.

Your control: on the Your playbook page you can edit or delete any entry, download everything we hold about your playbook as a file, or delete all of it, your agreement included, in one step. Deletion takes effect immediately; deleted entries can survive in our encrypted backups for up to 35 days before they are gone.

In your browser: if you start writing a move before signing in, the text waits in that browser tab only, and is saved to your account once you sign in. If you choose “Not for me right now”, this browser remembers which play you said it on, so it doesn’t ask again.

It is a notebook, not treatment. Your playbook is for your own use. It is not psychological treatment, therapy or medical advice, and no one reviews what you write. If you are in distress, contact a qualified professional or your local emergency services.

How long we keep it

Subscriber data is kept while you are subscribed and deleted from active systems after you unsubscribe, subject to short backup-retention windows at our providers. Correspondence is kept as long as needed to handle it. Server logs rotate automatically. Playbook entries are kept until you delete them, or until your account is deleted. We delete or anonymize data once it is no longer needed.

Your rights

Depending on where you live (including under the GDPR and the California Consumer Privacy Act), you may have the right to access, correct, delete, or receive a copy of your personal information; to object to or restrict processing; to withdraw consent at any time (for analytics, use the on/off control in Analytics and cookies above — no email needed); and to complain to your local data-protection authority. We honor these requests regardless of jurisdiction where practicable, without discrimination. To exercise any of them, email matan@theohartley.com. Your playbook has its own download and delete buttons on the Your playbook page — no email needed. Unsubscribing from the newsletter needs no email — use the link in any issue.

California residents: we have not sold or shared personal information as defined by the CCPA/CPRA in the preceding 12 months.

Security

The site is served exclusively over HTTPS, subscriber data lives with established providers, and access to it is limited to the small team operating the publication. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security; if a breach affecting you requires notification by law, we will notify you.

Changes

We may revise this policy as the publication grows (for example, when memberships or paid products launch). The current version always lives at this address; material changes will be flagged in the newsletter.