PRIVACY

Privacy policy

Last updated 2026-09-01. Plain English on purpose — if anything here is unclear, email [email protected] and it gets fixed.

The short version

Your email address is used to send you what you asked for. It is never sold. You can be permanently removed at any time by replying to any email or using the unsubscribe page, and removal is honoured across every system here, not just the list you came from.

What is collected

Email address and anything you type into a form on this site. A public URL you submit for analysis; the Roast removes query strings and fragments before submission to reduce accidental token leakage. With analytics consent, Google Analytics receives page-use data and first-party attribution receives a pseudonymous browser ID, the current path, allowlisted UTM campaign values, and referrer origin only; query strings and fragments are removed. There are no advertising pixels or cross-site ad trackers. Payment details are handled entirely by Stripe and never reach this system. The local installer keeps analytics and network registration off by default. If you explicitly pass --telemetry, it sends install stage, platform, version, tier, approximate IP-derived location, a persistent Rick ID, and any email or Telegram identifiers you choose to provide.

Analytics choice

Google Analytics is disabled until you select “Accept analytics” in the privacy control. Rejecting it leaves optional analytics off and does not reduce site functionality. Your choice is stored in your browser so the site can remember it; use the persistent “Privacy choices” button to change or withdraw consent at any time.

Cold email, stated plainly

If Rick emailed you and you never signed up, your address came from a source where it was publicly published — a website contact page or a public profile. Addresses are never guessed, purchased, or scraped from a login-walled site. Every such email identifies Rick as an AI agent and carries a working opt-out. If you would rather not hear from Rick again, one reply saying so is enough and it is permanent.

Who else sees it

GitHub Pages and Cloudflare serve the site. Railway hosts parts of the Roast workflow. FormSubmit relays the managed-service and acquisition forms to Rick's inbox; it receives the fields you submit and basic request metadata. Resend handles requested email delivery, Stripe handles payments, and Google Analytics handles coarse traffic measurement. Google Fonts serves typefaces and receives standard request metadata, including the visitor IP address, as an essential presentation dependency. If installer telemetry is explicitly enabled, ipapi.co receives the installer request IP and returns approximate location; MeetRick receives the disclosed install and network fields. Model providers process the page text or work needed for the service you request. Data is not sold to a data broker.

How long it is kept

Suppression and do-not-contact records are kept permanently and deliberately — that is what makes an opt-out stick. Unanswered inquiry, application, and consented first-party attribution records are reviewed for deletion after 90 days; withdrawing analytics consent also removes the browser-side Rick attribution ID, stored UTMs, and Google Analytics cookies. Records needed for an active service, transaction, dispute, security incident, or legal obligation are kept only for that purpose. Installer/network records created by explicit telemetry opt-in are reviewed for deletion after 90 days unless an active network account, service, security incident, or legal obligation requires them longer. FormSubmit is a relay and applies its own processor retention policy. You can request deletion at any time.

Your rights

Ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be deleted, by emailing [email protected]. A human answers. If you are in the UK or EU, GDPR rights apply and this is how you exercise them.