Skip to main content

Privacy Policy

Effective: September 9, 2026

The Mountain Messenger (“we,” “us,” “our”) operates themountainmessenger.org (the “Site”). This Privacy Policy explains how we collect, use, disclose, and protect information when you read the Site, create an account, subscribe, donate, play games, submit letters or story tips, or receive our emails.

1. Information we collect

1.1 Information you provide

  • Accounts and sign-in

We store account and session records in our application database on Cloudflare D1. These records may include your email address, display name, profile photo URL, email verification status, sign-in method, account identifiers, and subscription access. For password sign-in, we store a password hash rather than your password in readable form. Session records may also include your IP address, browser user agent, and sign-in timing.

If you choose Google or Facebook sign-in, we receive identity and profile information from that provider, which also processes information under its own privacy policy. Some accounts were imported from our former Firebase authentication system; we retain the imported account records and compatible password hashes, but Firebase no longer authenticates Site sessions.

  • Subscriptions, print delivery, and donations

Stripe processes subscription payments and donations. We share account identifiers and email addresses with Stripe to connect purchases to your account. We receive or retain customer and subscription identifiers, plan and payment status, transaction-related records, and, for print subscriptions, recipient and shipping information needed for delivery. Payment card details are entered through Stripe's payment interfaces.

  • Newsletters and mailing lists

Our weekly newsletter is prepared in our newsroom CMS and sent through Cloudflare Email. Its mailing list uses the email addresses in our Site account database, excluding addresses on our newsletter unsubscribe list. Having an account can therefore result in receiving the weekly newsletter without a separate newsletter signup. We store unsubscribe addresses and the time of the request in Cloudflare D1 so we can honor that preference.

We also use Mailchimp. When you visit the Site while signed in, the Site may send your account email address to Mailchimp to add or update your mailing-list record and label it as associated with a Site account. This sync can create a subscribed Mailchimp contact if your address is new to that audience. Mailchimp campaigns may measure email opens and link clicks when those tracking features are enabled. See Mailchimp's explanations of open tracking and click tracking.

The CMS newsletter and Mailchimp maintain separate unsubscribe records. See section 7 for your choices.

  • Letters to the editor and story tips

Our Submissions form collects letter text, your name, and your town or general location for letters to the editor. Email and phone are optional. For story tips, only the tip text is required; name, location, email, phone, and file attachments are optional.

Letters require confirmation that your name, location, and letter text may be published in print or online. We decide which letters to publish. We use optional contact details to verify authorship, follow up, or address safety and legal issues; submitting a letter or tip does not by itself add that contact information to a mailing list.

Submission records, publication consent where required, IP addresses, and browser user agents are stored in Cloudflare D1. Uploaded tip files, such as photos or PDFs, are stored in Cloudflare R2. Files may contain personal information or metadata you include. We use Cloudflare Turnstile and IP-based rate limits to prevent abuse. Turnstile processes browser and network signals as explained in Cloudflare's Turnstile Privacy Addendum.

  • Games

Games process guesses, puzzle entries, and results to check answers and support gameplay. When you are signed in, we may save game results and related state, including completion times where applicable, with your account in Cloudflare D1. Games also save progress or results in your browser.

  • Communications

If you contact us by email, phone, or another channel, we receive the information you choose to send and use it to respond and manage your request.

1.2 Information collected automatically

  • Usage analytics and diagnostics

We use Google Analytics and PostHog to understand traffic, measure feature use, and diagnose problems. Information may include page URLs and titles, referring pages, search terms or other URL parameters, clicks and interactions, browser and device characteristics, identifiers, approximate location, and network information. We send events about article reading, sign-in, checkout, and subscription activity.

PostHog may also collect session replays and error reports, depending on configuration. Replays reconstruct on-page content, scrolling, clicks, and mouse movements; they do not record your camera. Error reports can include error messages, stack traces, and request or page context. When you are signed in, we identify your activity in PostHog using your account identifier and may include your display name and whether your account has web access. Server events may use your account or Stripe customer identifier.

Browser requests to PostHog pass through a path on our own domain, but PostHog still processes that data. We also send some events from our servers, including sign-in, subscription changes, and errors. Blocking a browser script does not stop these server events.

We may use Cloudflare Web Analytics and related performance or operational analytics. Providers process information according to their roles, settings, and policies, linked in section 3.

  • Free article limits

We set a first-party, HTTP-only cookie named tmm_reader_id containing a random identifier. We store article-access counts and timing in Cloudflare KV under that identifier. When the cookie is absent, we use an IP-to-reader association in KV to recover or create an identifier. Clearing or blocking cookies does not necessarily reset your article limit.

  • Browser storage

Reading history, bookmarks, reading preferences such as text size, and game progress or results may be kept in local storage on your device. We also use session storage for temporary browser state. Reading history and bookmark lists are stored locally; article visits and interactions may separately be recorded by analytics, and signed-in game results may also be stored with your account.

  • Hosting and security

The Site runs on Cloudflare Workers and related services. Cloudflare and our application may process IP addresses, request URLs, browser user agents, timestamps, error details, and other technical information to deliver the Site, protect accounts, prevent abuse, and investigate problems.

  • Weather

Our servers request forecasts for regional locations from OpenWeather. The weather page does not need your device's precise location. Weather icons may load directly from OpenWeather, which receives ordinary request information such as your IP address when your browser fetches them.

1.3 Newsroom content and embedded services

We manage articles, author information, photos, public notices, and newspaper archives in our own newsroom CMS hosted on Cloudflare. Content records are stored in Cloudflare D1, published content is cached in Cloudflare KV, and photos, attachments, and newspaper PDFs are stored in Cloudflare R2. Cloudflare also processes and delivers article images. Editorial records can include names, bylines, photo credits, and information submitted or gathered for publication.

Articles may contain third-party embeds or externally hosted content, such as videos, maps, or social posts. Loading those features can send your IP address, page or referrer information, and browser details to their providers, which may use cookies or other tracking technologies under their own policies. External links and social-share buttons take you to services with their own privacy practices.

2. How we use information

We use information to:

  • Deliver articles, archives, search, weather, games, and other Site features
  • Create and secure accounts, maintain sessions, and provide subscription access
  • Process payments, manage subscriptions, and arrange print delivery
  • Review submissions, follow up with contributors, and prepare and publish editorial content
  • Send account messages, including verification and password-reset emails, through Cloudflare Email
  • Send the weekly newsletter and Mailchimp communications, manage mailing lists, and record unsubscribe preferences
  • Measure audience and product use, understand email engagement where enabled, and diagnose errors
  • Prevent spam and abuse, maintain records, and meet legal and operational obligations

3. Sharing of information

We use providers for these purposes:

  • Cloudflare: hosting, databases, file and image delivery, caching, security, Turnstile, analytics, and email delivery
  • Stripe: payments, donations, billing, and subscription management
  • Google: Google sign-in and Google Analytics
  • Meta / Facebook: Facebook sign-in and features you use on that platform
  • PostHog: product analytics, session replay, and error tracking
  • Mailchimp / Intuit: mailing-list management, email campaigns, and campaign reporting
  • OpenWeather: forecasts and weather icons

These providers receive information needed for their services and may also process information in their own roles as described in their policies. Analytics and embedded-content providers may collect information about your activity over time and across other websites or services.

We also disclose information to the public when we publish editorial material, including letters and the associated name and location; to professional advisers as needed; and to authorities or other parties when required by law or needed to protect rights and safety.

We do not sell your personal information for money. The provider disclosures above describe the analytics and other data sharing that occurs when you use the Site.

4. Cookies and similar technologies

We use authentication cookies (tmm_at and tmm_rt) to keep you signed in, the reader cookie described above to meter article access, and local or session storage for Site features. Google Analytics and PostHog may use cookies, local storage, or similar technologies to recognize browsers and measure activity. Security features and third-party embeds may also use cookies or similar technologies.

You can remove or restrict cookies and storage through your browser. Doing so may sign you out or remove saved preferences, bookmarks, and game progress. The Site does not currently use browser Do Not Track signals to switch off analytics. See section 7 for other choices.

5. Data retention

We retain account, subscription, payment-related, and editorial records for as long as needed to provide services, maintain archives, resolve disputes, and meet legal, accounting, and security obligations. Submission records and attachments are kept for editorial and operational purposes. Published material may remain in our archives.

Our reader cookie and IP-to-reader association are configured to last up to 400 days. Article-access count entries expire 31 days after their last write. Other temporary security and cache records have expiry periods appropriate to their purpose. Browser local storage remains until it is removed by you, your browser, or the Site.

We retain unsubscribe records to avoid sending unwanted newsletters. Our CMS newsletter list and Mailchimp's audience records are maintained separately. Analytics, replay, and campaign data are also subject to our settings and the providers' retention practices.

6. Security

We use measures such as encrypted connections, password hashing, access controls, and session checks to protect information. No method of transmission or storage is completely secure.

7. Your choices and rights

Depending on applicable law, you may have rights to access, correct, delete, or obtain a copy of personal information, or to object to or opt out of certain uses. Contact us using section 11 to make a request. We may need to verify your identity, and some records may need to be retained for legal, security, accounting, or editorial reasons.

Newsletters: Use the unsubscribe link in the email you receive. The link in the CMS weekly newsletter records your preference in our Site database; a Mailchimp unsubscribe applies to the relevant Mailchimp audience. Unsubscribing from one does not automatically unsubscribe you from the other. Contact us if you want help stopping both. Newsletter opt-outs do not cancel your subscription or stop necessary account and service messages.

Analytics and browser storage: Browser privacy settings and script-blocking tools can limit some tracking. These controls do not necessarily prevent all collection, including server-side events. You can clear local Site storage to remove locally saved reading history, bookmarks, preferences, and game progress. This does not delete records already saved to your account or sent to providers.

Sign-in providers: You can manage your Google or Facebook connection through that provider's account settings. Contact us about changes to or deletion of your Site account.

Submissions: You can omit optional contact details and tip attachments. If we publish a letter, its name, location, and text become public. Contact us with requests about submitted or published material.

8. Children

The Site is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, please contact us.

9. International users

Information may be processed in the United States and other countries where our providers operate. Those countries may have different data-protection laws from the country where you live.

10. Changes to this policy

We may update this policy as our services and practices change. We will post the revised policy here with a new effective date. Prior dated versions remain available below for transparency.

11. Contact us

For privacy questions or requests, contact The Mountain Messenger at team@themountainmessenger.org or (530) 289-3262.

Policy versions

Prior versions are kept available for transparency.