Privacy Notice

Last updated 9 November 2026

Podstash works without knowing who you are. There is no account, no sign-up and no cookie for visitors. What follows is the little we do record, why we record it, and what you can ask of us.

Who we are

The controller is Podstash Ltd, registered in England and Wales, company number 17365999, registered office 128 City Road, London, EC1V 2NX. We are registered with the Information Commissioner’s Office, registration number ZC278119. You can reach us at pod-stash1@proton.me.

What we record

We went through the site’s code line by line before writing this, and these are the only places it records anything about a visit.

Clicks on a buy button. Which product link you clicked, the page it was on, the name of the site you arrived from (the domain, never the full address), the time, and for an Amazon link which Amazon store it sent you to (for example amazon.co.uk), worked out from the country your connection appears to come from. We also note whether your browser reported the click as made by a person on our own page, and whether the software name it sent looks like an automated crawler (the name itself is not kept), so we can tell readers from robots. No IP address and no identifier are stored with it. We keep this to see which products readers find useful and, once an affiliate account exists, to account for commission. Legal basis: our legitimate interest in running the site.

Searches. The words you typed and how many results came back. That is how we find out what the catalogue is missing. As with clicks, we note whether your browser reported the search as made by a person, so we can tell readers from robots. Same basis. Please keep personal details out of the search box.

Shortlist saves. Which product you saved and from which page. The shortlist itself stays in your browser and is never sent to us. Same basis.

The request-a-podcast form. The show name, its feed address and whatever you write in the note. We do not ask for a name or an email. You decide what to put in.

Reports. When you press Report under a quote we keep the reason you chose, the note you wrote, the page, and the mention it concerns. We also keep a hashed form of your IP address for 30 days, which cannot be turned back into the address; it exists only to stop one source flooding the queue. Please keep personal details out of the note.

Web analytics. We count visits with Cloudflare Web Analytics. When a page loads, a small script sends Cloudflare the page address, the site you came from, your browser and device type, and how fast the page loaded. Cloudflare sees your IP address to work out the country, but it sets no cookie, stores nothing on your device and does not build a profile of you; we see only totals (how many visits, which pages, which countries). We use this to know how many people read the site and which pages they find. Legal basis: our legitimate interest in running the site.

Server logs. Netlify, which hosts the site, keeps the usual request logs for a short time: IP address, browser, page and time. Those exist to run and secure the service.

If we email you about a mention

Now and then we write to a publisher, a literary agency or a brand to say that one of their books or products came up on a podcast, with the quote and a link to the moment. We only write to organisations, at a work address the organisation has published itself, on its own website or in a press or publicity listing, and each email says where we found the address. We never write to private individuals this way.

For each email we keep the name and work address we wrote to, the organisation, what we sent and when, and any reply. That lets us avoid writing twice about the same thing and make sure we never write again to anyone who has asked us not to. Legal basis: our legitimate interest in telling organisations about mentions of their work.

You can object at any time. Reply to any of our emails, or write to pod-stash1@proton.me, and we will stop. We then keep your address on a do-not-contact list, with nothing more than we need to be sure we don’t write again. Objecting stops our emails. It does not take a book or product out of the catalogue, which records what was said on a podcast.

Browser storage and cookies

We set no cookies for visitors. Your browser’s local storage holds two things at your own request: the display theme and your shortlist. Both stay on your device. Clear them through your browser whenever you like. Because each exists only to provide something you asked for, no consent banner is needed. Podstash staff have cookies of their own: one set keeps them logged in to the administration area, another keeps our own clicks, searches and visits out of our counts. Visitors never receive any of them.

Content that comes from elsewhere

Two kinds of content are fetched by your browser from other services, which see your IP address and browser type in the ordinary way. Book covers come from Google Books or Open Library. Episode audio is streamed from the podcast’s own hosting service when you press play. We hold no copy of either and get nothing back about you. Their privacy notices apply to those requests.

Amazon

A buy button takes you to Amazon, where Amazon’s privacy notice takes over. If our Associates account is approved, Amazon will tell us which items were bought through our links and what commission we earned, in aggregate. It will not tell us who bought them. Our affiliate disclosure has the rest.

Who processes data for us

Supabase hosts the database. Netlify hosts the website. Cloudflare provides the visit counts. Proton provides our email. Each works to our instructions under a written data processing agreement. Some of this processing happens outside the United Kingdom, in the European Union and the United States, under the UK’s international transfer safeguards (the UK Addendum to the EU standard contractual clauses, or an adequacy decision).

How long we keep it

Click, search and shortlist records for up to 24 months, after which they are deleted or reduced to totals. Podcast requests until we have acted on them, and no more than 12 months after that. Reports until we have acted on them, with the hashed address removed after 30 days. Server logs for as long as our hosting provider’s rolling short-term retention runs. Visit counts for as long as Cloudflare’s analytics dashboard keeps them; they are totals, not records of individual visits. Records of emails we have sent to organisations for 24 months after the last exchange. A do-not-contact entry for as long as we send these emails.

Your rights

UK data protection law lets you ask for access to personal data we hold about you, for it to be corrected or erased, for its use to be restricted, to object to our use of it, and to receive a copy in a portable form. In practice we usually cannot tie any record to a particular person, because we do not record who you are, and if that is the position we will say so. Email pod-stash1@proton.me to ask. You can also complain to the Information Commissioner’s Office at ico.org.uk.

Children

Podstash is not aimed at children under 13, and we do not knowingly collect anything from them.

Changes

If we add a way of collecting data, an email digest for instance, which would ask for your address and your consent at the time, this notice will change before it goes live and the date at the top will move.