Privacy Policy

Effective: July 28, 2026

The Mountain Messenger (“we,” “us,” “our”) operates the website themountainmessenger.org (the “Site”). This Privacy Policy describes how we collect, use, disclose, and protect information when you use the Site, create an account, subscribe, donate, submit letters or story tips, or interact with our features.

By using the Site, you agree to this Privacy Policy. If you do not agree, please do not use the Site.

1. Information we collect

1.1 Information you provide

• Account and authentication

Accounts are created and managed on our infrastructure, with profile and session data stored primarily in Cloudflare D1 (and related application storage on Cloudflare). Depending on how you sign in, we may process your email address, display name, profile photo URL, email verification status, and sign-in method (email and password, Google, or Facebook). When you use Google or Facebook to sign in, those companies act as identity providers and process information under their own policies. Many accounts were imported from our previous Firebase-based authentication system; we no longer use Firebase to authenticate new sessions. Imported credentials may remain in a compatible format until you sign in successfully and we upgrade how your password is stored.

• Subscriptions and payments

If you purchase or manage a subscription, Stripe processes payment and billing details. We associate subscription status with your account as needed to provide access.

• Newsletter

If you are signed in, we may use your account email to register you for our mailing list through Mailchimp (or a comparable email marketing provider we configure).

• Letters to the editor and story tips (submissions)

Through our Submissions form on the Site, you may send:

• a letter to the editor (letter text, name, and town or general location are required; email and phone are optional); or
• a story tip (tip text is required; name, town, email, phone, and photo or file attachments are optional).

For letters, we ask you to confirm that you understand your name, town or location, and letter text may be published (print and/or online). We reserve the right not to publish any letter.

Optional contact information is used only to verify authorship, follow up on a tip or letter, or address safety and legal issues—not to enroll you in marketing emails unless you separately subscribe.

Submitted files for story tips (for example images or PDFs) are stored in Cloudflare R2. Submission records (including optional contact details and message text) are stored in Cloudflare D1. For security and abuse prevention we may also store your IP address and browser user agent, and we use Cloudflare Turnstile (a captcha-like challenge) and rate limiting when you submit.

• Communications

If you contact us (for example via email or phone links on the Site), we receive whatever information you choose to send.

1.2 Information collected automatically

• Usage and analytics

We use Google Analytics (Google tag / gtag) to understand how the Site is used (for example pages viewed, device and browser characteristics, and general traffic patterns). We also send custom analytics events related to features such as article reading, subscription steps, and sign-in flows.

We also use PostHog (product analytics) to measure how people use the Site and to improve reliability. Depending on configuration, PostHog may collect:

• page views, clicks, and similar interaction data (including automatic capture of some UI interactions);
• device, browser, and approximate location or network signals as provided by your browser and our hosting environment;
• session replay (recordings of how a browser session interacted with the Site, which can include on-screen content and mouse movements in the pages you visit—not a video of you or your camera);
• error and exception reports from the browser and, where enabled, from our servers (for example error messages and technical stack information); and
• product events we send on purpose (for example account sign-up or sign-in method, subscription checkout steps, plan interest, or subscription cancellation status).

When you are signed in, we may link analytics activity to your account identifier so we can understand usage across visits. We may also attach limited account-related properties in analytics (for example whether your account has web access, and a display name if one is set on your profile). We do not intend to send your email address or password into analytics event payloads.

Browser analytics traffic to PostHog is often sent through a first-party path on our Site (a reverse proxy) so that requests go via our domain; the underlying processing is still performed by PostHog. We may process some of the same product events on our servers (for example after a successful sign-in or a Stripe-related subscription change) and send them to PostHog as well.

We may use Cloudflare Web Analytics (or similar Cloudflare analytics products) to measure traffic and performance.

Google’s, PostHog’s, and Cloudflare’s services may use cookies, local storage, or similar technologies. See each provider’s policies for how they process data (including PostHog’s privacy policy).

• Paywall and free article limits

To enforce limits on free article views, we set a first-party, HTTP-only cookie (tmm_reader_id) containing a random identifier (not your name or email). We store counts and timing of article access in Cloudflare KV (key-value storage), keyed to that identifier. If the cookie is not available, we may temporarily associate a new identifier with your IP address in KV so that disabling cookies does not reset your limit on every request.

• Reading history (on your device)

The Site may store recent article titles and slugs in your browser’s local storage to power a “reading history” feature. This stays on your device unless you clear it.

• Server logs, hosting, and operations

The Site runs on Cloudflare (Workers, Pages, and related services). Cloudflare and our configuration may log IP addresses, request metadata, and similar technical data for security, reliability, and operations. We may also use Cloudflare features such as observability or logging to diagnose issues. Bot-mitigation tools such as Turnstile process challenge tokens as described in Cloudflare’s policies.

• Location and weather (approximate)

Weather features use fixed regional locations (for example named towns) with OpenWeather on the server. If you use features that resolve a map position to a place name, our servers may call Google Maps services with coordinates you or the page supplies; results may be cached server-side.

1.3 Content and CMS

News articles and pages are managed with Sanity. Content you view is delivered from Sanity’s systems according to their terms.

2. How we use information

We use the information above to:

• Provide and improve the Site, including articles, search, weather, events, and account features
• Authenticate users and maintain sessions
• Operate paywalls and subscription access
• Process payments and manage subscriptions (Stripe)
• Review and, where appropriate, publish letters to the editor (including name and location you provide) and evaluate story tips and related files for newsgathering and editorial purposes
• Follow up on submissions when you provide contact information
• Prevent spam and abuse of public forms (including Turnstile, rate limits, and related security signals)
• Send transactional or service emails (for example email verification, password reset, and other account notices through Cloudflare Email where we use it, or other providers we configure) and, where applicable, newsletter messages (Mailchimp)
• Measure audience and product usage, diagnose errors, and improve the Site (Google Analytics, PostHog, Cloudflare analytics, and related custom events)
• Secure the Site, debug issues, and comply with law

We do not use optional submission contact information to add you to marketing lists unless you separately sign up for our newsletter or account marketing.

3. Sharing of information

We may share information with:

• Service providers who assist us under contract, including: Google (Sign in with Google, Analytics, Maps), Meta / Facebook (Sign in with Facebook), Stripe, Cloudflare (hosting, KV, D1, R2, Turnstile, analytics, email, and related infrastructure), PostHog (product analytics, session replay, and error tracking), Sanity, Mailchimp, and OpenWeather, each according to their roles and our configuration.
• The public, when we publish a letter to the editor or related editorial content that includes information you submitted for that purpose (such as name, town, and letter text).
• Professional advisers where permitted by law.
• Authorities when required by law or to protect rights and safety.

We do not sell your personal information for money as commonly understood in U.S. state privacy laws. Analytics providers may use data as described in their own policies (notably Google, PostHog, and Cloudflare).

Social sharing: Share buttons link to third-party sites (for example Facebook, X, LinkedIn). If you use those links, those platforms’ privacy policies apply.

Donations: Donation flows may redirect to a Stripe-hosted donation page; Stripe’s privacy notice applies there.

4. Cookies and similar technologies

We use cookies (including our paywall cookie), local storage, and analytics scripts as described above—including scripts and storage used by Google Analytics and PostHog (for example to recognize returning browsers, measure sessions, support session replay, and attribute product events). Cloudflare Turnstile may set or use cookies or similar technologies for security. You can control cookies through your browser; blocking some cookies may limit paywall metering accuracy, analytics accuracy, or certain features.

5. Data retention

We retain information as long as needed for the purposes above, including editorial, legal, accounting, security, and subscription obligations. Server-side access counts and data in Cloudflare KV are subject to time-to-live (TTL) / expiry in our configuration. Account and billing records follow normal business and legal retention periods. Submission records and attachments are kept for as long as needed for editorial and operational purposes. Analytics and session data held by Google, PostHog, or Cloudflare are also subject to those providers’ retention settings and our configuration with them.

6. Security

We use industry-standard measures appropriate to the nature of the Site. No method of transmission or storage is completely secure.

7. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or export personal information, or to opt out of certain processing (for example targeted advertising, where applicable). To exercise rights, contact us using the information below. You may also use controls in your Google, Facebook, or email accounts for single sign-on, and browser or device settings for cookies and local storage.

Analytics: You can limit some tracking by adjusting browser cookies, using browser privacy features, or industry opt-out tools where available. Blocking analytics cookies or scripts may reduce the accuracy of audience measurement but should not prevent basic reading of public pages. For rights or deletion requests that involve data we control, contact us as described below; for data held only by a provider under their independent role, their policies may also apply.

Newsletter: You can unsubscribe using links in marketing emails where provided, or by contacting us.

Submissions: You may choose not to provide optional contact details or tip attachments. Providing a letter for publication necessarily involves the name, location, and text you submit if we publish it.

8. Children

The Site is not directed at children under 13 (or the age required in your jurisdiction). We do not knowingly collect personal information from children.

9. International users

If you access the Site from outside the United States, your information may be processed in the United States and other countries where our providers operate (including analytics and hosting providers).

10. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised policy on the Site with a new effective date. Prior dated versions may remain available on the Site for transparency.

11. Contact us

For privacy questions or requests, contact The Mountain Messenger at team@themountainmessenger.org or (530) 289-3262.