Privacy Policy

Effective September 17, 2026

This policy explains how Leon Lin operates leonlins.com and the Avoid Boring People newsletter. Questions can be sent to [email protected].

Information collected

If you subscribe to the newsletter, the information involved is your email address, subscription and consent records, confirmation and unsubscribe records, and limited security information used to prevent abusive sign-up attempts. The website may also receive standard technical information from your browser and hosting providers, such as IP address, device/browser details, and pages requested.

How information is used

Information is used to operate the site and newsletter, confirm a subscription, deliver requested writing, honour unsubscribe requests, prevent abuse, and maintain the security and reliability of the service. Newsletter data is not sold.

Newsletter providers and legacy subscriptions

The current public newsletter sign-up form is operated by Substack. If you subscribe through it, Substack also processes your information under its own terms and privacy practices. The planned owned newsletter uses Neon for subscriber records and Amazon Web Services Simple Email Service (SES) for delivery and delivery-event processing. The site is hosted on Vercel. These providers process information only as needed to provide their services.

If legacy Substack subscribers are migrated in the future, the retained information will be limited to the subscription, consent, and suppression history needed to provide the newsletter and prevent accidental resubscription of people who opted out.

When sign-up on this site is enabled, the subscription record also keeps how you arrived: the campaign tags on the link you followed, the referring site's domain, and the page you landed on, taken from the first such visit your browser remembers. That record carries no IP address, sets no cookie of its own, and is never used for advertising or profiling; it exists so the author can tell which channel produced a subscription. The current public sign-up form still runs on Substack, which stores none of it.

Choices and retention

Every newsletter will include an unsubscribe link. You can also contact [email protected] for help with your subscription or privacy questions. Suppression records may be retained after an unsubscribe request as needed to honour that request and avoid sending you future newsletter email by mistake.

If you unsubscribe and later change your mind, submitting the sign-up form again starts a fresh confirmation: your subscription is restored only after you confirm the new email, and no one can re-add you by resubmitting the form on your behalf. An address that was suppressed after a hard bounce or a spam complaint is not restored this way, because that suppression protects deliverability for everyone on the list.

Article discussion

Article discussions are hosted on this site rather than by a third-party comment provider. Posting a comment stores the display name you type, the comment text, and the time it was posted. To let you edit or delete your own comment for 30 minutes after posting, the site stores an anonymous random token in your browser and keeps only a one-way hash of it; the token is not linked to your newsletter subscription, email address, or any account, and there are no accounts to sign in to.

Comments are public and are shown in full to any reader of the article. Please do not post anything you want kept private; the article page also offers a direct email link for private conversations. The site does not store IP addresses with comments and does not build comment analytics or profiles.

Cloudflare Turnstile is used to check that a comment is posted by a person rather than a script. Turnstile runs in the page and Cloudflare processes the request needed to perform that check under its own privacy policy. To limit abuse, comments from one browser are limited to about three in a ten-minute window.

You can delete your own comment from the article page for 30 minutes after posting it, which removes the comment text. After that window, contact [email protected] to ask for a comment to be removed.

Notes you send

A note sent from the contact form stores the name, email address, and message you type, along with the page you sent it from and the time it arrived, so the author can reply and not lose track of the conversation. The note is also emailed to the author so it is not missed, which means Amazon SES processes your email address for that notification. Sending a note does not subscribe you to the newsletter. When the author's private note log is enabled, the same fields are copied to it; it is the author's own tool and not a third-party marketing service.

Cloudflare Turnstile is used to check that a note is sent by a person rather than a script, and it processes the request needed for that check under its own privacy policy. The site does not store IP addresses, browser tokens, or advertising identifiers with notes, and notes are not used for profiling or automated marketing.

Analytics and third-party content

The site may use a privacy-conscious Google Analytics configuration when enabled and reports lightweight engagement events such as a comment being posted; those events carry no comment text, name, or commenter identifier. Newsletter email carries no open or click tracking, so the author's newsletter reports show subscription counts and delivery outcomes rather than whether you opened or clicked anything. This site does not use behavioural advertising, profiling, or a third-party analytics product for the newsletter.

Your rights

Depending on where you live, privacy law may give you rights to request access, correction, deletion, restriction, or objection to certain uses of personal information. Contact [email protected] to make a request. You may also have the right to complain to the privacy regulator where you live.

Changes to this policy

This policy may be updated when the site or newsletter changes. The effective date above will be updated when material changes are published.