Privacy at Coalstoke.

• Your email. For magic-link authentication. That’s the whole account.
• Your IP address. For rate limiting on free tools and fraud prevention on paid usage. Stored with each API call in an audit log.
• The verifications and finds you run. Retained in our D1 database for billing, dashboard history, and your CSV exports.
• CSVs you upload for bulk processing. Stored in Cloudflare R2 for 30 days, then auto-deleted. The verification results derived from them stay in D1.
• If you connect HubSpot: a private-app access token, encrypted at rest on Cloudflare’s edge. Used only to sync your leads to your HubSpot Contacts.
• If you subscribe: your Stripe customer ID. Payment info stays with Stripe — we never see or store your card.

• To provide the service — your account, your verifications, your dashboard.
• To bill you fairly — only for verifications that succeeded. That’s the whole point of charge-on-success.
• To prevent abuse — rate limiting the free tools so they stay free.

Coalstoke runs on a small stack. Every party that touches your data is listed here:

• Cloudflare — hosting, edge compute, D1 database, R2 storage, DNS.
• Vercel — marketing site hosting only. Vercel does not see verification data or CSV uploads.
• Stripe — billing and payment processing.
• Resend — transactional email (magic links, receipts, partner-request notifications).
• HubSpot — only if you connect it, and only to sync your leads to your own HubSpot portal.

We do not sell your data. We do not use it for advertising. We do not have advertising. If any of these ever change I’ll email everyone with an account before it takes effect.

• Session tokens expire after 90 days of inactivity.
• R2 uploads auto-delete after 30 days.
• Verification records stay in D1 indefinitely for your own audit history — unless you delete your account, in which case we remove them within 7 days.
• Server logs (IP + timestamp + endpoint) retained for 30 days for security review, then deleted.

Essential cookies only. Full details at coalstoke.com/cookies. No analytics, no tracking, no ads. That’s why we don’t show you a consent banner — under GDPR and CCPA, essential cookies (session, CSRF, security) are exempt.

• Access. Ask for a copy of everything we have on you. Reply to any email from @coalstoke.com — goes straight to me.
• Deletion. Ask us to delete your account and all associated data. Same channel.
• Portability. Export your verification records as CSV any time from the dashboard.
• Correction. If any data we have on you is wrong, reply and I’ll fix it.

Dalton Redden — hello@coalstoke.com. I read every email personally. Weekday reply within 24 hours; weekend replies sometimes take longer. If it’s a data-deletion or access request, mark the subject “GDPR request” or “CCPA request” and I’ll prioritize it.

If this policy changes materially I’ll email everyone with an account at least 14 days before the change takes effect. Small clarifications may happen without notice; check the “last updated” date at the top of this page.