Privacy Policy

1. Who we are and what this policy covers

Geldzak ("Geldzak", "we", "us") operates geldzak.com and its subdomains (the "Site"), a personal finance education website with articles, browser-based calculators, downloadable planning templates, and an email newsletter. We are the data controller for the personal information described in this policy.

This policy explains what information we collect, why we collect it, who we share it with, how long we keep it, and the choices you have. It applies to the Site, our newsletter, and our emails. It does not cover third-party websites we link to (including Gumroad if we offer paid products), which have their own privacy policies.

Questions or requests can be sent to hello@geldzak.com.

2. The short version

• You can read every article and use every calculator without creating an account.
• Calculator inputs are processed in your browser. When you run a calculation, an analytics event includes the strategy, number of debts, and total balance. When you use the "Email your plan" card, a separate analytics event includes the strategy and extra monthly payment. The strategy can be avalanche, snowball, or compare (the default). These events do not include your name, email address, debt names, or interest rates. Calculation events do not break the total down by debt.
• If you subscribe to the newsletter, we collect your email address and the page you signed up from. To confirm, open the link we email you and press the "Confirm my subscription" button on the page (double opt-in). You can unsubscribe at any time.
• We use Google Analytics 4 and Vercel Analytics to understand how the Site is used. Google Analytics sets cookies. Vercel Analytics does not.
• We never sell your personal information and we do not run advertising on the Site.

3. Information we collect

Information you give us

• Newsletter signup. Your email address, the form or page you signed up from (for example "homepage" or "footer"), the free resource you requested, if any, and the time you signed up. We do not ask for your name. We look up your address at Buttondown to check whether you are already subscribed. Before confirmation, we do not store a pending signup record or create one at Buttondown. Your Buttondown subscriber record is created or updated only when you confirm. We use Resend to send the confirmation email and, after you confirm, a welcome email with the requested resource. Resend receives the recipient email address and full message content, including the signed confirmation link.
• Confirmation link. The confirmation email contains a signed, time-limited token that encodes your email address and signup details so we can complete your subscription when you open the link and press the "Confirm my subscription" button on the page. Opening the link alone does not confirm your subscription. The link expires after 24 hours. The Site removes the link's token from the address bar when the confirmation page opens, before analytics load, and confirmation pages send only the Site's origin as the referrer.
• Messages you send us. If you email us, we keep the message and your email address so we can reply.

Information from our calculators and tools

The debt payoff calculator and similar tools calculate entirely in your browser. The figures you enter are lost when you close the page. The analytics events below are an exception to keeping your calculator inputs on your device: they send the strategy and summary figures to our analytics services.

Separately from the calculation, the Site sends usage events to Google Analytics 4 and Vercel Web Analytics, described in the next section, so we can understand which features are useful:

• When you run a calculation: the debt_calculator_calculate event includes the strategy you chose (strategy: avalanche, snowball, or compare, the default), the number of debts (debt_count), and the total balance you entered (total_balance). We do not break the total down by debt.
• When you use the "Email your plan" card: the debt_calculator_email_signup event includes the strategy you chose (strategy: avalanche, snowball, or compare, the default) and the extra monthly payment you entered (extra_payment). The card records interest in that feature only. The email address you type there is not sent to us or saved, and no plan is sent.
• When a newsletter signup request is accepted: the newsletter_signup event includes the signup source (source) and the resource requested (lead_magnet). This event is sent to Google Analytics 4 and Vercel Web Analytics before you confirm your subscription.

These events do not include your name, email address, debt names, or interest rates, and we do not link them to any newsletter subscription. Google Analytics associates events with a cookie identifier. They are subject to the same cookie and identifier handling as the rest of our analytics.

Information collected automatically

• Device and usage data. Pages viewed, referring site, approximate location derived from your IP address, browser type, operating system, screen size, and page performance metrics, collected through the analytics services described in the next section.
• IP address for abuse prevention. When you submit the newsletter form or attempt to confirm a subscription, we keep your IP address and request timestamps in server memory to limit signup and confirmation attempts (five requests per hour by default). Expired entries are pruned when later requests arrive on the same server instance, and all entries are lost when that instance shuts down. They are not written to a database. Vercel Edge Config supplies only the limit settings.
• Server and hosting logs. Our hosting providers keep standard request logs (IP address, time, URL, user agent) for security and debugging.
• Display preference. If you switch between light and dark mode, that choice is saved in your browser's local storage. It never leaves your device.

4. Cookies and analytics

We use the following analytics and measurement services on the Site:

• Google Analytics 4 (Google LLC). Google Analytics uses cookies (primarily _ga and _ga_<id>) to distinguish visitors and measure page views, sessions, and events such as calculator usage. If you visit from the EU/EEA, the UK, or Switzerland and have not made a choice, we show a cookie banner. In those regions, Google Analytics and these cookies load only after you choose "Allow analytics". Elsewhere, Google Analytics loads by default. Google processes this data on our behalf and may transfer it to servers in the United States. Learn how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites. You can also opt out with the Google Analytics opt-out browser add-on or by blocking cookies in your browser.
• Vercel Web Analytics (Vercel Inc.) measures page views and referrers. It does not use cookies or track visitors across websites. It identifies visitors using a hash of incoming request data that is discarded after 24 hours.
• Vercel Speed Insights (Vercel Inc.) collects anonymous performance data points, including route, URL, device, and network details. It does not identify visitors or rebuild sessions.

Vercel Web Analytics and Speed Insights run for all visitors because they set no cookies.

Every visitor can change their choice at any time through "Cookie settings" in the footer. Choosing "Decline" stops Google Analytics on the Site and deletes its _ga and _ga_<id> cookies from this site.

We save your choice in your browser's local storage (gz-analytics-consent), not in a cookie.

When needed, the Site asks our server whether analytics consent is required. The server uses the country Vercel derives from your IP address for that request. This check stores nothing on our server. Your browser keeps only the yes/no answer in session storage (gz-consent-region) until you close the tab.

We do not use advertising cookies or sell or share analytics data for cross-context behavioral advertising.

The Site does not currently change its behavior in response to browser "Do Not Track" signals, because there is no common standard for how to interpret them. Use the opt-outs described in this section instead.

5. How we use your information

• To deliver the newsletter you subscribed to and the free resources you requested.
• To send the one-time confirmation email required to complete your subscription.
• To prevent spam, automated signups, and abuse of our forms and infrastructure.
• To understand which articles and tools are useful so we can improve them.
• To monitor and improve the speed, stability, and security of the Site.
• To respond to your messages and requests.
• To comply with legal obligations and enforce our Terms of Service.

6. Legal bases for processing

Where data protection laws such as the EU or UK GDPR apply, we rely on the following legal bases:

• Consent for sending you the newsletter and, for visitors in the EU/EEA, the UK, and Switzerland, for Google Analytics cookies. In those regions, Google Analytics loads only after you choose "Allow analytics" in the cookie banner. You can withdraw consent at any time by unsubscribing from the newsletter or using "Cookie settings" in the footer for analytics.
• Performance of a contract to deliver the resources you asked for when you subscribed.
• Legitimate interests in keeping the Site secure, preventing abuse, and measuring and improving our content, balanced against your rights. Outside those regions, Google Analytics runs by default. Anyone can turn it off through "Cookie settings" in the footer.
• Legal obligation where we must keep or disclose information to comply with the law.

7. Service providers we share data with

We share personal information only with providers that help us run the Site, under agreements that limit how they can use it. We do not sell personal information.

• Buttondown

  Purpose: Stores our newsletter list and sends newsletter issues

  Data involved: Email address, signup source, resource requested, subscription status, and email delivery, open, and click data where enabled

• Resend

  Purpose: Sends confirmation emails and welcome emails with the requested resource after confirmation

  Data involved: Recipient email address and full message content, including the signed confirmation link

• Vercel

  Purpose: Hosts the Site, provides Web Analytics, Speed Insights, and configuration storage for rate limits

  Data involved: Request logs including IP address; Web Analytics usage data with no cookies and a request hash discarded after 24 hours; Speed Insights anonymous performance data without identifying visitors or rebuilding sessions

• Google Analytics 4

  Purpose: Website usage measurement

  Data involved: Cookie identifiers, pages viewed, device data, approximate location, usage events

• Content hosting (WordPress)

  Purpose: Stores our articles and images and handles searches; also hosted on Vercel

  Data involved: Search text is sent to our WordPress content backend through GraphQL, and results may be cached by the Site. Standard request logs when images are loaded from the content server

• Gravatar (Automattic)

  Purpose: Provides author profile images on the homepage and article pages, loaded directly from secure.gravatar.com

  Data involved: Your browser sends Gravatar your IP address, browser details, and the site address as allowed by the browser's referrer settings when it loads an image

We may also disclose information when required by law, to protect our rights or the safety of others, or as part of a merger, acquisition, or sale of assets, in which case this policy will continue to apply to your information.

8. Third-party products and links

If we offer paid digital products such as the Debt Destroyer spreadsheet, they are sold through Gumroad. If you purchase a product, Gumroad collects your payment and contact details under its own privacy policy and terms. We receive the information Gumroad shares with sellers, such as your email address and purchase record, so we can provide the product and support. If the Debt Destroyer link is shown and you click it, we send an outbound_click event to Google Analytics 4 and Vercel Web Analytics with destination set to gumroad and product set to debt-destroyer. This event does not include your name, email address, debt names, or interest rates. Google Analytics associates it with a cookie identifier.

9. International transfers

Our service providers process data in the United States and other countries that may not have the same data protection laws as your country. Where required, we rely on the providers' standard contractual clauses or equivalent safeguards, including the EU-US Data Privacy Framework where a provider is certified under it.

10. How long we keep information

• Newsletter subscribers: for as long as you remain subscribed. After you unsubscribe, a suppression record of your email address is kept so we do not email you again.
• Unconfirmed signups: we do not store a pending signup record or create one at Buttondown before confirmation. The signed confirmation link carries your email address and signup details and expires after 24 hours. Your Buttondown subscriber record is created or updated only when you confirm.
• Rate-limit counters: IP addresses and request timestamps for signup and confirmation attempts are held in server memory. Expired entries are pruned when later requests arrive on the same server instance, and all entries are lost when that instance shuts down. The limit is five requests per hour by default; Vercel Edge Config supplies only the limit settings.
• Analytics data: retained according to the retention settings of Google Analytics and Vercel Analytics for our account.
• Messages you send us: for as long as needed to handle your request and keep a record of it.

11. Your rights and choices

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a portable copy, restrict or object to certain processing, and withdraw consent. Residents of California and some other US states have the right to know what we collect, request deletion, opt out of the sale or sharing of personal information (we do neither), and not be discriminated against for exercising these rights.

To exercise any of these rights:

• Unsubscribe using the link at the bottom of any newsletter email.
• Email us at hello@geldzak.com for access, correction, or deletion requests. We will verify that the request comes from the email address concerned and respond within the time required by applicable law, usually within 30 days.
• Control cookies through your browser settings or the Google Analytics opt-out add-on described above.

If you are in the EU, UK, or another jurisdiction with a data protection authority, you also have the right to lodge a complaint with that authority. We would appreciate the chance to address your concern first.

12. Children

The Site is written for adults and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has subscribed to our newsletter, contact us at hello@geldzak.com and we will delete the address.

13. Security

The Site is served over HTTPS. Newsletter confirmation links are cryptographically signed and expire after 24 hours, signup forms are rate limited and protected against automated submissions, and we hold no account passwords because the Site has no user accounts. No system is completely secure, so we cannot guarantee the absolute security of your information.

14. Changes to this policy

We may update this policy when our practices or the law change. The effective date at the top of the page shows when it was last revised. For material changes that affect newsletter subscribers, we will tell you by email or with a notice on the Site before the change takes effect.

15. Contact us

Geldzak
Email: hello@geldzak.com
Website: geldzak.com