Privacy

Last updated 22 October 2026.

1. Who is responsible.

GOLDRUSH is the trading name of CHOW YEE HIN (Ian Chow), a sole proprietorship in Hong Kong, and is responsible for the personal data described here. Write to goldrushindex@gmail.com.

2. What is collected, and when.

Joining the free letter: the email address you type. It is held by Buttondown, the service that sends the letter and handles the one-click unsubscribe.

Buying the ranked index: the email address on the checkout, and the identifiers Stripe gives us for the purchase — a customer id, a subscription id, the amount and the date. Your card number never reaches our servers.

Opening the paid pages: a session cookie (below), carrying the subscription id so the server can check the subscription is still live.

Asking for a sign-in link: the email address, and a record that a link was requested so the same address cannot be flooded.

Writing to us: whatever you put in the email.

3. Cookies.

One cookie, gr_session. It is set only after a purchase or a sign-in, it is strictly necessary to serve the paid pages, it is HttpOnly and Secure, it lasts up to 400 days, and signing out clears it. There is no analytics, advertising or tracking cookie on this site, so there is no consent banner.

4. Who else touches the data.

A small number of processors, each for one job: Stripe for payments, subscriptions, invoices and the billing portal; Cloudflare for hosting, the database that holds subscriber records, and the logs that show an error when one happens; Resend for sign-in emails; Buttondown for the free weekly letter; GitHub for the scheduled scan that rebuilds the index.

Data is not sold, and it is not shared for advertising.

5. Why it is allowed to be held.

To perform the contract with you (the subscription), to comply with tax and accounting duties, and for the legitimate interest in keeping the service up and preventing abuse. The letter is sent on the basis of your consent, which you can withdraw with one click in any issue.

6. How long it is kept.

Subscription records while the subscription is live and for 12 months after its last charge, then deleted — longer only where tax law requires it. Sign-in links expire in 15 minutes and single-use records are cleared after use. Rate-limit counters last an hour. Cloudflare keeps request logs for a short operational window, not for profiling.

7. Your rights.

Write to goldrushindex@gmail.com to ask for a copy of what is held, a correction, or deletion. We answer within 30 days. Deleting the record ends access, because access is the record.

8. Where the data lives.

Cloudflare and Stripe process data in several regions, including the United States and the European Union, under their own standard contractual terms.

9. Security.

Transport is HTTPS only with HSTS. The session cookie is signed and cannot be edited into another subscription. Sign-in links are single-use and expire. Payment data never reaches our servers.

10. Children.

The site is not aimed at anyone under 18 and no data about children is knowingly held.

11. Changes.

A change that matters is announced by email to subscribers before it takes effect.

12. Contact.

goldrushindex@gmail.com.