Privacy policy
Privacy
Short version: no ads, no tracking cookies, no analytics. We only handle what our host logs, what you email us, and, if you choose to back us, what Stripe tells us about your subscription.
Effective 16 Oct 2026.
Who is responsible
The data controller is The Mikanao Hub, Oslo, Norway. Questions or requests about your data: hello@day7.dev. We follow the GDPR as it applies in Norway through the EEA Agreement and the Norwegian Personal Data Act (personopplysningsloven).
What we process, and why
1. Hosting logs (everyone who visits)
Our host, Vercel, records technical request data so the site can run and be kept secure: IP address, date and time, the page requested, browser user agent and referrer. We use it only to keep the site working and to deal with abuse. We don’t build profiles from it and don’t combine it with anything else.
Legal basis: legitimate interests (GDPR Art. 6(1)(f)) in running a secure website. Kept: for Vercel’s standard log retention period; we don’t keep our own copies.
2. No ads, no tracking cookies, no analytics
Day 7 sets no cookies. We run no analytics or advertising scripts and embed no third-party trackers. Our fonts are served from our own site, not from a font service. If you go to Stripe to pay, Stripe’s own pages set their own cookies under Stripe’s policy.
3. Emails you send us
When you email hello@day7.dev (evidence, corrections, right of reply, sponsorship or anything else), we process your name, email address, the message and anything you attach, so we can read it, reply and act on it. We never publish your name or email address. If we use evidence you send, we paraphrase it and link only to public sources.
Legal basis: legitimate interests (Art. 6(1)(f)) in answering you, checking claims and keeping an accurate record of corrections; for sponsors, steps before entering a contract (Art. 6(1)(b)). Kept: evidence, correction and general emails for up to 3 years after our last exchange, so we can show why a receipt or correction says what it does; sponsorship emails that lead to a deal for as long as bookkeeping law requires, others for up to 1 year.
4. The Friday Receipt newsletter (not live yet)
The Friday Receipt isn’t open yet and we are not collecting any sign-ups. When it launches it will run on beehiiv, and we will only add you if you sign up and agree. Every issue will have a one-click unsubscribe.
Legal basis (when live): your consent (Art. 6(1)(a)), which you can withdraw at any time. Kept: until you unsubscribe, then removed from the list.
5. Supporters (payments)
Supporter payments are processed by Stripe. You enter your card details on Stripe’s pages; we never see or store card numbers. From Stripe we keep your email address, your plan (monthly or yearly), your subscription status and payment dates, so we can run your subscription and keep our accounts.
Legal basis: performing our contract with you (Art. 6(1)(b)) and our legal obligations under Norwegian bookkeeping law (Art. 6(1)(c)). Kept: while you are a Supporter, then only the records bookkeeping law requires, for as long as it requires them.
6. People whose public posts we cite
Receipts summarise public posts (issues, forum threads, Reddit, X, Hacker News) in our own words and link to them. We don’t publish usernames, emails or ticket IDs. If you wrote a post we cite and want the link removed, email us and we’ll look at it promptly.
Who processes data for us
- Vercel Inc. (USA): website hosting and request logs.
- Stripe (Stripe Payments Europe Ltd, Ireland, and Stripe affiliates): Supporter payments.
- Google (Google Workspace): our email inbox at hello@day7.dev.
- beehiiv Inc. (USA): the Friday Receipt newsletter, only once it launches.
They process data on our instructions under data processing terms. Stripe also acts as an independent controller for some payment data (for example fraud prevention), under its own privacy policy. We don’t sell personal data and never share it with sponsors.
Transfers outside the EEA
Some of these providers are based in, or use sub-processors in, the United States. Where personal data leaves the EEA, the transfer relies on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses. Ask us for details.
Your rights
You can ask us to:
- give you a copy of the data we hold about you (access);
- correct it (rectification);
- delete it (erasure), unless we must keep it by law;
- limit how we use it (restriction), or object to processing based on legitimate interests;
- send it to you in a portable format (portability);
- withdraw consent at any time, without affecting earlier processing.
Email hello@day7.dev. We reply within one month. It’s free.
If you think we handle your data wrongly, you can complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no). We’d appreciate the chance to fix it first.
Changes
If this policy changes, we’ll update this page and the date below. See also our terms.
Effective date: 16 Oct 2026. Controller: The Mikanao Hub, Oslo, Norway.