Privacy policy
Effective November 2, 2026.
Privacy is the third of the five tests: there should be a public list of every piece of data a product collects, and why. This is that list for realprosperity.org, along with what you can ask me to do about it. If you find something the site keeps that isn't here, tell me and I'll fix the site or the policy.
Who runs this site
I do. I'm Richard Whitney, and I decide what this site collects and what happens to it. You can reach me at richard@whitneys.co.
What the site doesn't do
No analytics, no cookies, no accounts, and no scripts, fonts or images from anyone else. Nothing follows you from page to page or from this site to another one. I don't sell your information, I don't share it for advertising, and I don't use it to build a profile of you.
What it collects, why, and for how long
The visit log. Every time a page is requested, the server writes one line: your IP address, the time, the page, whether it worked, the page you came from and your browser's name and version. I use it to keep the site running and to spot abuse, like someone hammering the contact form. The site's own copy is kept 30 days. The same line also lands in the server's process log, kept 14 days, and the web server in front of the site keeps its own access log, also for 14 days.
The monitoring copy. From the process log, each line is forwarded to my own monitoring service, which runs on my computer. It keeps the same details plus how long the page took to load and a country worked out from your IP address, using a database stored on that computer. It's kept for about a year, then deleted automatically.
Abuse reports. If an IP address sends attack traffic, like probing for passwords or scanning for weak spots, the monitoring service looks it up at ipinfo.io and reports it to AbuseIPDB, a shared list of abusive addresses, with up to three sample log lines as evidence. This happens automatically, and ordinary visits never trigger it. I keep a record of every report, with those sample lines, and it has no set expiry. Once a report reaches AbuseIPDB, it's held under their policy, not mine.
What you send me. If you write to me with the form, I keep what you typed (your name, your email address, your message and the principle you picked, if you picked one) and the time it arrived. It's saved on the server and emailed to my own inbox through my email provider, so I can read it and write back, and nobody else reads it. I keep it until you ask me to delete it.
Spam protection. Before the form sends, your browser solves a small puzzle, and the server limits how many messages one IP address can send in an hour. Both are held in memory only, for about an hour at most, and never written to disk.
Ad clicks on the blog. The blog carries a column of ads from Pixboard, my own ad network. The ads are served from this site, and nothing tracks you while you read. Clicking one is the exception: the click passes through pixboard.ad, which records the time, your IP address, your browser and the page you came from, and keeps them for a year to count clicks and catch fraud. The lessons, the case studies and the other pages carry no ads.
Why I'm allowed to keep it
For visitors in places with data protection laws, like the European Union and the United Kingdom: the logs, the monitoring copy and the abuse reports rest on a legitimate interest in keeping the site running and secure. Your messages rest on your request that I read them and reply. The ad-click record rests on Pixboard's legitimate interest in counting clicks honestly and catching fraud.
Who else handles it
- DigitalOcean hosts the server, so the logs and messages sit on their hardware.
- My email provider carries the copy of your message to my inbox.
- ipinfo.io and AbuseIPDB see only IP addresses that send attack traffic, and the sample lines that go with a report.
- Pixboard and the monitoring service are both mine.
Everything is stored in the United States. If you're visiting from somewhere else, your information crosses that border when you load a page.
What you can ask me to do
You can ask to see what I have about you, to correct it, or to delete it, and you can object to my keeping it. Email me and say what you'd like. I'll delete your messages and anything in the logs and the monitoring copy I can match to you, and write back when it's done. I can't pull back an abuse report already sent to AbuseIPDB, but I'll tell you whether one exists. I'll answer within 30 days, and nobody gets treated differently for asking.
Matching log lines to you works by IP address, so I'll need to know the address you used, and roughly when. If you're in the European Union or the United Kingdom, you can also complain to your data protection authority.
Children
The lessons are written for teachers and families to use with students, but the site isn't meant to collect anything from children. If you're under 13, please don't use the form. If I learn I've received a message from a child under 13, I'll delete it.
Do Not Track and Global Privacy Control
There's no tracking on this site for those signals to turn off. If your browser sends one, the site treats you exactly as it treats everyone else, because everyone already gets the untracked version.
Keeping it safe
The site is served only over an encrypted connection. The logs, the monitoring copy and your messages are open to me and nobody else. No system is perfectly secure, and if something I hold about you is ever exposed, I'll say so here and tell anyone I can reach.
Changes
When this policy changes, the date at the top changes with it, and a note below says what changed. I won't use what I already have in a new way without saying so here first.
November 2, 2026: first version, replacing the shorter "What this site keeps" page.