Privacy.

Last updated. August 13, 2026

Who is responsible

This website is operated by Mehreen Arshi, a writer and reader based in Canberra, Australia. Your privacy matters. This policy explains what information this site collects, why, and the choices you have. It applies to everyone who visits the site or sends a message from it.

A plain-language summary

• This site does not sell your information to anyone, ever.
• If you send a message through the contact form, only the details you provide are kept, and only so Mehreen can reply.
• If you join the monthly letter, your email address is used only to confirm and manage that subscription and send the letter.
• If you order a book, payments are processed entirely by Stripe. Card details never pass through this site.
• Like most websites, this one uses Google Analytics and PostHog to understand which pages are read and how visitors move through the site.

Information this site collects

Contact messages. If you use the contact form, the name, email address, and message you submit are sent to this site’s hosting provider (Netlify) and delivered to Mehreen’s inbox. They are used only to reply to you. Contact details are kept for the ongoing conversation; the message itself may be kept while the correspondence is active.

The monthly letter. If you subscribe, this site collects your email address, where on the site you joined, the date and time of your request, the version of the consent notice you accepted, and the dates of confirmation or unsubscribe actions. A confirmation email is sent before the subscription becomes active. Convex stores the subscription and consent record. Resend sends the confirmation and newsletter emails and records delivery, bounce, complaint, and unsubscribe events needed to operate the list safely. Newsletter signup fields are not sent to Google Analytics or PostHog.

Book orders. If you buy a copy of I carry your heart through the book page, the checkout is completed on Stripe, our payment provider. Stripe collects your name, email address, billing and shipping address, and payment details to process the payment and deliver your copy. This site itself does not receive or store your card details, and it only receives the information needed to confirm your order. Your name and shipping address are shared with Australia Post solely to deliver your copy.

Analytics. This site uses Google Analytics and PostHog to measure traffic and understand how visitors use the site. These services use cookies and similar technologies to record pages visited, approximate location, device and browser type, referrer, and browsing behaviour. PostHog is configured to collect anonymous page views, page exits, link and button clicks, form submissions, and session replays. A session replay reconstructs page content and interactions such as clicks, scrolling, and pointer movement. It is not a camera recording. All form inputs are masked in the browser before replay data is sent, and PostHog does not create identified visitor profiles. This information helps Mehreen understand what writing to share and what to improve. You can opt out of Google Analytics tracking with the Google Analytics opt-out browser add-on. PostHog tracking and session replay respect your browser's Do Not Track setting.

Server logs. Netlify, the hosting provider, records standard server logs (such as IP addresses and requested pages) as part of operating the site and securing it against abuse.

How information is used

Information collected is used for these purposes only:

• to reply to messages you send,
• to confirm, manage, and send the monthly letter you request,
• to process and deliver book orders,
• to understand site traffic in aggregate,
• to keep the site secure and working correctly.

This site does not sell, rent, or trade personal information. It does not display advertising.

Legal bases and Australian law

As an Australian website, this site is operated in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where the GDPR applies to you, the legal bases relied on are:

• Consent. For analytics cookies, sending a contact message, and subscribing to the monthly letter.
• Contract. For processing a book order.
• Legitimate interest. For operating and securing the website.

Who information is shared with

Information is shared only with the service providers required to run the site:

• Netlify (hosting and contact-form delivery),
• Convex, Inc. (newsletter subscription and consent records, hosted in the US East region),
• Resend, Inc. (newsletter confirmation, delivery, and unsubscribe handling),
• Google LLC (analytics),
• PostHog, Inc. (analytics),
• Stripe, Inc. (payment processing),
• Australia Post (delivery of orders).

Each of these providers processes information under its own privacy policy and data-protection commitments. Some of these providers store data on servers outside Australia; Stripe and Google operate in jurisdictions with recognised privacy safeguards.

Retention

• Contact messages and correspondence are kept only while the conversation is active.
• Unconfirmed newsletter requests are removed after seven days. Active subscription records are kept while you remain subscribed. After you unsubscribe, the minimum record needed to honour that choice and prevent further sends may be retained. You may ask for it to be deleted.
• Order records are kept as long as needed for tax, accounting, and delivery purposes.
• Google Analytics data is retained per Google’s retention settings (currently 14 months).
• PostHog analytics data is retained according to the site’s PostHog project settings and reviewed periodically. Session replays are retained for 30 days.
• Server logs are kept on a rolling basis and deleted regularly.

Your rights

You may ask at any time for access to the personal information this site holds about you, or ask to have it corrected or deleted. To make a request, use the contact form on the contact page and mark your message accordingly. Requests will be answered within a reasonable time and, where the law requires, within 30 days.

You may also:

• opt out of Google Analytics with the tool above, opt out of PostHog by enabling Do Not Track, or limit analytics by blocking cookies in your browser,
• request erasure of personal information where it is no longer needed,
• unsubscribe from the monthly letter at any time using the link in every edition,
• complain to your local data-protection authority if you believe your information has been mishandled.

Cookies

This site uses cookies and local storage only for analytics (Google Analytics and PostHog) and for the operation of the site itself (such as remembering the day/night theme choice). It does not use advertising cookies.

Third-party links

The site links to external services, including the existing Substack archive. Once you leave this site, those services have their own privacy policies, which this policy does not cover.

Changes to this policy

If this policy changes, the updated version will be published on this page with a new revision date. Material changes will be noted prominently.

Questions

If you have any question about this policy, or about information this site holds, please get in touch through the contact page.