Privacy policy

This policy explains what Noosletter collects, why, where it is kept and what you can do about it. It is written in plain English. If anything is unclear, email hello@noosletter.com.

Who we are

Noosletter is a newsletter platform at noosletter.com. It is built, designed, hosted, sent and supported in England. Our full company name and registered address will be published on this page.

Noosletter is used by three kinds of people, and we handle each a little differently:

• Publishers: people who run a newsletter on Noosletter, and their team members.
• Subscribers: people on a publisher's list.
• Readers: people who read, like or comment on newsletters at noosletter.com, and who can manage all their subscriptions in one place.

When a publisher keeps their subscriber list on Noosletter, the publisher decides how that list is used and we look after it for them. For publisher accounts, reader accounts and this website, we decide how the data is used.

What we collect

Publishers

• Your name and email address, and how you sign in (a magic link or Google). Two-factor authentication is optional.
• Your newsletter details: its name, your public handle, its category and description.
• The postal address you add before your first send. The law requires it in the footer of marketing emails, so it appears there.
• The emails you write, your forms, and your public profile and pages.
• Your team members' names, email addresses and roles.
• A log of important actions in your account, such as imports, sends and changes to settings.
• When paid plans are available, billing details are handled by our payment provider (see below). We don't store card numbers.

Subscribers

A publisher's list can hold:

• your email address, and your name and any other fields the publisher asks for
• which of that publisher's newsletters you subscribe to, and the history of those subscriptions
• evidence of consent: when and how you signed up, and when you confirmed
• where you signed up, such as a form, a recommendation or the directory
• the result of an address check (valid, risky, invalid or not checked)
• delivery problems and opt-outs: bounces, spam complaints and unsubscribes

Bounces, complaints and unsubscribes are kept against your address because they stop you being emailed again. Since 30 September 2026 opens, clicks and visits are recorded against your address too (see below).

When you sign up on the web, nothing is subscribed until you click the link in the confirmation email. Unconfirmed signups expire after 7 days and are deleted 30 days after that.

Readers

• Your email address and your reader sign-in sessions.
• The newsletters you subscribe to. Each publisher sees only their own subscribers, never your other subscriptions.
• Your likes and comments. Comments are public.

Visitors to noosletter.com

• Page views, counted without cookies, and, only if you accept the banner, the pages you visit and how long you spend on them (see below).
• Messages you send us through the contact form: your name, email address, company (if you add it) and message.

What we record: opens, clicks and visits

From 30 September 2026, Noosletter records what subscribers do with a publisher's emails and pages, and the publisher can see it against each subscriber. Nothing before that date was recorded per person.

In emails

• When an email is opened, and which link is clicked. Each is recorded against the subscriber it was sent to, and shown on that subscriber's Activity tab and in the publisher's Activity page.
• An estimate of how long the email held your attention (a glance, a skim or a read). It is approximate: email apps don't tell us how long anyone looked, so we work it out from the gap between an open and a click. It is labeled as approximate wherever it appears.
• Open figures are approximate for other reasons too. Some email apps, including Apple Mail with Mail Privacy Protection, load images automatically before anyone reads. Others hide opens or block images. Known link scanners and automated opens are counted apart and never recorded against a person.
• Unsubscribe, manage-subscription and referral links in emails are never tracked and never carry a visitor link.
• Links in an email that lead to Noosletter's pages, or to a publisher's own website, carry a signed, personal token, so a visit that follows is linked to the subscriber it was sent to. If an email is forwarded, whoever opens the forwarded link is recorded as the original recipient.

On web pages

• On a publisher's profile and email pages on noosletter.com, we ask first. If you choose Accept, we record the pages you visit, how long you spend on them, where you came from, clicks on the subscribe form and share buttons, and whether you go on to subscribe. If you choose Reject, none of that is recorded against you. Your choice on this banner is what counts: browser signals such as Global Privacy Control or Do Not Track are not read as a choice either way. You can change your mind at any time from "Tracking" in the page footer.
• To do this, we store a random visit code and your choice in your browser's local storage (not in cookies). See our cookie policy.
• If you arrive from a link in an email, and you have chosen Accept, the visit is linked to the subscriber that email was sent to. Otherwise a visit is recorded only against a random code, and is linked to a person only if they later sign up or their publisher's own website tells us who they are.
• A publisher can also add our tracking snippet to their own website. They are responsible for asking their visitors for consent there.

What publishers control

Publishers can't switch recording on or off. Opens, clicks and read time in emails are recorded for every newsletter, and web visits are recorded only when you accept on the banner, so the rules above are the same everywhere on Noosletter.

Points and levels

What you do with a newsletter earns you points on it: 1 for each email you read, like, comment on or share (once each per email), and 5 for each friend who subscribes through your invite link. Your points set your level on that newsletter, which can unlock perks the publisher offers. The publisher sees your points and level. Your total points show on your public profile, and you can appear on a newsletter's subscriber leaderboard (your name, picture, level and points) unless you turn off "Show me on this newsletter's page" or hide your level badge, or your profile is private.

How long it is kept

Recorded opens, clicks and visits are kept while you're subscribed to any of that publisher's newsletters. They're deleted 30 days after you've left all of them, or straight away when you or the publisher delete your data. Subscription history, and bounce, complaint and unsubscribe records, follow the rules above. A kept reply (see "Replies to a publisher's emails" below) follows the same rule.

We still keep aggregate totals per email, such as how many times it was opened. To count each person once in those totals, we use a short-lived keyed code that expires within 30 days.

Replies to a publisher's emails

Some publishers use a feature called Reply routing, which gives their emails a reply address of ours instead of their own inbox. If you reply, we check it's a genuine reply (not an auto-reply, bounce or mailing-list message) and match it to the newsletter and email it was sent in response to. Your reply is read against rules the publisher has set up (for example, to tag you based on words in your reply, or to alert the publisher). It is kept only if at least one of those rules matches; otherwise it is discarded straight away and nothing about it is stored. A reply never subscribes or unsubscribes you, whatever it says.

Page views without cookies

Visits to noosletter.com pages are also counted as anonymous totals without cookies. To count unique views, each visit becomes a one-way code made from the IP address, browser and page, mixed with a secret that changes every day. The secret and the IP address are never stored, and a code can't be linked to a person or matched across days. This happens whatever you choose on the banner, because it identifies no one.

Checking email addresses

To keep lists clean, new addresses are checked:

1. First against a local copy of a public list of disposable email domains. This happens on our own servers.
2. Then with Reoon, an email verification service. Reoon receives the email address only, and it processes it outside the UK.

Amazon's sending service also checks addresses when an email is sent, and marks undeliverable addresses as invalid.

The copy checker

The spelling, grammar and link checker runs on our own servers in London. Your email content is never sent to a third-party grammar or AI service.

Where your data is kept

The app, database and file storage run in London, and every email Noosletter sends goes through Amazon SES in London. Pages may be cached by our hosting provider's network close to visitors, which can be outside the UK.

We use these providers to run Noosletter:

Provider	What it does	Where
Amazon SES	Sends every email Noosletter sends: newsletters, confirmations, sign-in links and notifications	London (eu-west-2)
Amazon S3	Stores images and files	London (eu-west-2)
Amazon Web Services (other)	Runs background jobs and hosts the copy checker	London (eu-west-2)
Supabase	The database: accounts, contacts, subscriptions and emails	London (eu-west-2)
Vercel	Runs the app and public pages	London. Requests are routed by the server nearest the visitor, which stores nothing.
Reoon	Checks email addresses (the address only)	Outside the UK
Stripe	Billing for paid plans, when available: account owners' payment details only	Stripe's own infrastructure (EU and US)
logo.dev	Fetches a logo for a public domain name only, nothing about any person: a site that sends readers to a publisher, or a publisher's own workspace website	United States
Gravatar (Automattic)	A profile picture for a team member, author or contact: your browser asks Gravatar for the picture belonging to a one-way fingerprint (an MD5 hash) of their email address. The address itself is not sent. In-app only, never on a public page	United States
Google	"Sign in with Google", for publishers who choose it; and a favicon service that is the fallback for a referring site's logo (a public domain name only)	Google

How long we keep data

• Publisher and subscriber data is kept while the account is active, until it is deleted by the publisher, or by you as described below.
• Recorded opens, clicks and visits: while you're subscribed to that publisher, and deleted 30 days after you leave all of their newsletters, or straight away on deletion. A kept reply follows the same rule.
• Unconfirmed web signups: they expire after 7 days and are deleted 30 days later.
• Reader sign-in sessions last up to 90 days. Sign-in links expire after 30 minutes.
• Records used to stop form abuse hold only a one-way code of the IP address and are deleted after 48 hours.
• Deleted items go to Trash first, where they can be restored for a limited time. The exact period will be published here.
• Backups expire on a fixed schedule. The exact period will be published here.

Your choices and rights

If you're a subscriber

• Unsubscribe with one click from any email.
• Manage my profile, linked in every email, lets you:
  • subscribe or unsubscribe from each of that publisher's newsletters
  • opt out of everything from that publisher
  • update your details
  • download your data
  • ask for your data to be permanently deleted

For downloads and deletion we send a confirmation to your email address first.

When your data is deleted, it is removed from our live systems promptly, including the opens, clicks and visits recorded against you. Aggregate totals, such as how many people opened an email, stay the same. Older backups expire on their normal schedule. If you had unsubscribed or complained, we may keep a one-way code of your email address so you aren't emailed again by mistake. The code can't be turned back into your address.

If you're a reader

You can manage all your subscriptions in one place and delete your reader account. Deleting it removes your reader identity, likes and profile. Your comments stay but show as "Deleted reader". Each publisher's copy of your subscription follows the subscriber steps above, which you can start from your reader account.

If you're a publisher

You can see, correct and remove your subscribers and content in the app. To close your account or get a copy of your data, email us.

Everyone

Under UK data protection law you can ask us for a copy of your data, to correct it, delete it or restrict how it is used, to object to how it is used, or to move it elsewhere. Email hello@noosletter.com.

If you're on a publisher's list, you can also contact that publisher directly.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Children

Noosletter is a publishing tool, and most newsletters are written for adults. Reader accounts are for people aged 16 or over, as our terms say.

Changes to this policy

When we change this policy, we'll update the date at the top of this page.

Contact

Email hello@noosletter.com with any question about your data.