Privacy

Last updated October 20, 2026

I'm Collin Mallery, a website designer in Reno, Nevada ("I", "me"). I build and host websites for small businesses. This policy explains what information I collect, why, who else handles it, how long it's kept and what you can ask me to do with it. It covers everyone who uses anything I run:

Visitors to collinmallery.com.
People who ask for a free preview.
Clients and their team members who use a website dashboard, including signup and sign-in at app.collinmallery.com and on their own site.
Visitors to the websites I build and host for my clients ("client websites"), including people who send a request, book an appointment, buy something or pay through one.

The short version: I collect only what's needed to run these websites, and I don't sell or rent anyone's information. collinmallery.com uses Google Analytics and Google Ads to see how visitors find it and whether my ads work. A client website uses them only if that business turns them on (section 5). You can turn them off with Cookie choices or your browser's Global Privacy Control.

1. What I collect

From everyone. Like any website, the servers receive your IP address, your browser and device type, and the pages you ask for. Cloudflare, which hosts everything, uses this to deliver pages and block attacks. I use IP addresses briefly to limit repeated attempts, like wrong passwords or form spam; those records are deleted within a day.

If you ask for a free preview: what you type in the form. That's your name, business name, phone, email, current website and message.

If you ask for a website or book a call with me: your name, business, email, mobile number, current website, any notes, whether you want a plan or a custom project, and the time you pick. I may send you a personal message from my own number by iMessage (or text on Android) through Sendblue, my messaging provider; reply STOP and I won't message you again. The call itself happens on the video service my confirmation links to (Zoom, Google Meet or Microsoft Teams), under that service's own privacy policy. Files you send me before a custom-project call are stored privately with Cloudflare, seen only by me, and deleted when we're done talking or if you remove them. If you pay a deposit for a custom website, you pay on Stripe's secure page in my Stripe account; I see the amount and that it's paid, never your full card number.

If you're a client, or on a client's team:

Your account: your name, email, mobile number and role on the site (owner or editor).
How you sign in: your password is stored only as a one-way hash, so no one can read it. A passkey stores only a public key; the private part never leaves your device. An authenticator app's secret is stored encrypted, and sign-in and recovery codes are stored hashed. When you choose a password, it's checked against known data breaches without sending it: only the first five characters of a hash of it go to the Have I Been Pwned service.
Sessions: a cookie keeps you signed in for up to 30 days. Each sign-in is recorded with the browser it came from, so you can see where you're signed in and end those sessions.
Your business content: hours, services, prices, photos, announcements, brand colors and anything else you add. Most of it is meant to be public on your website.
Billing: your plan and price, invoices and payment history. Card payments are handled by Stripe. Your card number goes straight to Stripe; I only see the card's brand, last four digits and expiration date.
Activity: a log of important actions in your dashboard (sign-ins, changes, billing events), with who did what and when. It's there for security and support.
Messages: the emails I send you and whether they were delivered; change and domain requests you send me; your answers to my pricing questions, if you're a pre-founding client. I may text you from my own phone, for example your signup code, using the mobile number you gave me.

If you visit a client website:

Requests: if you send a quote or contact request, the business receives your name, phone, email, message and the page you sent it from, in its dashboard and by email.
Appointments: if you book online, the business receives your name, phone, email, notes and the appointment details, plus your answers to any questions it asks and any photos you attach. You get a confirmation, reminders and a private link to view or cancel your appointment, and the appointment can appear in the business's own calendar.
Text reminders: if you tick "Text me a reminder" when you book, your mobile number is used to text you a reminder before that appointment (about one text per appointment). Message and data rates may apply. Reply STOP to stop the texts, or HELP for help. Your mobile number and your consent to texts are never sold, and never shared with third parties or affiliates for marketing or promotional purposes; the sharing in section 4 doesn't include text-message opt-in data or consent.
After a visit: some businesses send one email asking for a review and, later, one saying it's about time to book again. Each has a link to stop them.
Orders: if you buy from a business's online store, the business receives your name, email, phone (if you give it), what you ordered, and where it's shipping (or that you'll pick it up). You pay on Stripe's secure page, for that business: your name, email and address go to Stripe for the payment and to work out the sales tax. For an order that ships, the address also goes to the business's shipping service (EasyPost, or Shippo) for shipping prices and the label. You get a receipt with a private link to your order, and the tracking number when it ships.
Shop accounts and alerts: if you sign in to a business's online store (with a code sent to your email; there's no password), that business can see your email, the name and phone you add, your orders there, the items you save and the addresses you keep. If you ask to be emailed when an item drops or a size is back, your email is used for that one email, which has a link to stop it. You can delete your account from the store's account page at any time; your orders stay with the business for its records.
Bag reminders: if you start checking out at a business's online store and don't finish, the store may email you once, about an hour later, with what was in your bag and a link to pick it back up. Never more than one a week from a store, and the email has a link to stop them (the business can also turn them off).
Drop lists: if you join a business's drop list, the business keeps your email to send you one email before each drop opens, with a link to shop it early. We email you once to confirm first; nothing is sent until you do, and unconfirmed sign-ups are deleted after a week. Every drop email has a link to leave the list, which deletes your email from it.
Raffles: if you enter a business's raffle, the business receives your name, email and Instagram name to run it, to check the winner's Instagram, and to contact you if you win. We email you once to confirm your entry; an entry you don't confirm doesn't count. Entries are deleted a year after the raffle ends (unconfirmed ones after a week). Raffles are free to enter and aren't run by Instagram.
Payments and deposits: if a business takes payments or asks for a deposit to book, you pay on Stripe's secure page, for that business. A deposit is refunded or kept by the cancellation terms shown before you pay. Neither the business nor I see your full card number.
Google tags, if the business turns them on: a business can connect its website to its own Google Analytics and Google Ads accounts. Google then receives the pages you visit, your device and browser, your approximate location, and that you sent a request, booked, started a checkout or paid. It never receives what you typed, your name, or your order details. See section 5.
Visit counts: the business sees daily totals of page views, call taps and direction taps. They use no cookies and contain nothing that identifies you, and they're skipped entirely if your browser sends a "Do Not Track" or Global Privacy Control signal.

2. How I use it

To build, host and run websites and dashboards, and to deliver requests, appointments and orders to the business they're meant for.
To send the text reminders you ask for, and the review and rebooking emails a business turns on.
To set up accounts, handle billing and send the emails you'd expect: signup links, receipts and billing notices, booking confirmations and reminders, order receipts and shipping updates, and service updates.
To keep everything secure, and to prevent fraud, spam and unauthorized access.
To improve my service, for example with the pricing feedback clients choose to give.
To keep the records the law requires, such as tax records.

I don't sell or rent personal information or use it to build profiles of people. The only advertising use is the Google tags described in section 5: on collinmallery.com, to measure my own ads, and on a client website only if that business turns them on.

3. Client websites: who decides

When you contact or book with a business through its website, that business decides what to do with your information, like calling you back. I host the website and handle the information on the business's behalf. For questions about how a business uses your information, contact the business directly; I'll help it respond.

I use a few companies to run the service. They handle information only to provide their service to me:

Cloudflare: hosting, the database, photo and file storage, security, backups, email forwarding for business email addresses, and domain registration.
Stripe: payments, and sales tax on online store orders. How Stripe handles card information is in Stripe's privacy policy.
Resend: sending email.
Sendblue: sending texts (iMessage or a regular text): booking reminders, only to people who asked for them, and my personal messages to people who asked me about a website.
EasyPost: if a business ships online store orders with EasyPost, the shipping address and package details go to EasyPost, in that business's own EasyPost account, for shipping prices and labels. See EasyPost's privacy policy.
Shippo: if a business ships online store orders with Shippo instead, the shipping address and package details go to Shippo, in the business's own Shippo account, for shipping prices and labels. See Shippo's privacy policy.
Anthropic: if a business uses its website's Spanish version or automatic photo descriptions, that website's text and photos are sent to Anthropic's Claude to write the translations and descriptions. Visitors' information isn't sent.
Google: Google Analytics and Google Ads on collinmallery.com, and on client websites whose business turns them on (section 5), under Google's privacy policy. Also Google Workspace, if a business chooses it for its email, under Google's own terms.
Domain registries: registering a domain requires the owner's contact details, which go to the registry through Cloudflare Registrar. Cloudflare keeps them out of public lookups where the registry allows.

I may also share information when the law requires it, to protect someone's safety, or as part of a transfer of my business, in which case this policy keeps applying to it.

5. Cookies and Google tags

Google Analytics and Google Ads. collinmallery.com uses them to count visits and to see which ads bring people to the preview form. A client website uses them only if its business adds its own Google IDs in its dashboard; the data then goes to that business's Google accounts. Google sets cookies (like _ga and _gcl_au) to tell visits apart and to match ad clicks to actions, and may use what it receives as described in how Google uses information from sites that use its services.

Your choice: use Cookie choices at the bottom of the page (or the banner, where there is one) to decline. Until you accept on a site with a banner, and anywhere you've declined, Google only gets cookieless, anonymous signals.
Online stores: a client website taking orders asks before Google's cookies are used.
Europe, the UK and Switzerland: Google's cookies are off until you accept.
Global Privacy Control: if your browser sends it, ads cookies are never used for you.
You can also use Google's opt-out add-on and Google's ad settings.

Other cookies are only the ones needed for things to work:

A sign-in cookie for dashboards (up to 30 days), and a short-lived one while you sign up (2 hours).
Your browser remembers which site you picked in the dashboard, for that tab only.
Apart from Google's, the collinmallery.com home page and client websites set no cookies of their own. Your cookie choice, an online store's cart, and your sign-in to a store's account (if you sign in) are kept in your browser's local storage, and stay on your device.
A client website's online store keeps your cart in your browser's local storage (not a cookie) until you check out or empty it. It isn't used to track you.
A store's shop counts, for the business's reports, how many times each day the shop was looked at, a product was opened, something was added to the bag and checkout was started, and the name of the site a visit came from (like google.com or instagram.com). Around a store's drop (a limited release at a set time), the open shop page also says it's still open every 30 seconds, so the business can see about how many people are looking. Only the counts are kept (daily counts for 13 months, the drop count for an hour): nothing that identifies you or your browser.
If a business sends you an early-access link to a drop, the shop keeps that link's code in your browser's session storage while the tab is open, so it still works as you move around the shop.
Stripe's card form may set its own cookies to prevent fraud, under Stripe's policy.

6. How long it's kept

Preview requests and calls: until we're done talking about your website, or sooner if you ask. Deposit records are kept as long as tax and accounting law requires.
Clients: while your plan is active. After a plan ends, your content stays available to download for 30 days, then it's deleted. Nightly backups are kept for up to 30 more days.
Requests and appointments on client websites: until the business deletes them, or its website is removed. Photos attached to a booking are deleted 180 days after the appointment.
Orders on client websites: as long as the business's website is, since they're its sales records.
Text and email opt-outs: kept as long as the business's website is, so they keep being honored. A record of each text sent is kept about 13 months.
Billing records: as long as tax and accounting law requires. Stripe keeps its own records under its policy.
Security records: attempt limits for a day; expired sign-ins are removed nightly.

7. Security

Everything is sent over HTTPS. Passwords are hashed, keys and secrets are encrypted, and sign-in can be protected with a passkey, an authenticator app or emailed codes. Administrative access is limited to me. No system is perfectly secure; if a breach affects your information, I'll tell you promptly, as the law requires.

8. Your choices

Clients can see and change most of their information in their dashboard, and download their content any time from Export.
Anyone can ask me for a copy of their information, to correct it, or to delete it. I may need to confirm it's you, and I'll keep only what the law requires, like invoices.
Wherever you live, including California and Nevada, these choices are yours. I don't sell personal information. To opt out of Google's ads cookies, use Cookie choices or Global Privacy Control (section 5). Nevada residents can also send me an opt-out request, and I'll confirm it.
Billing, security and booking emails are part of the service. If I ever email you about anything else, you'll be able to unsubscribe in one click.
Reply STOP to a text reminder to stop them. Review and rebooking emails from a business each have a link to stop them.

9. Children

These services are for businesses and adults. They aren't directed to children under 13, and I don't knowingly collect their information.

10. Changes

When I change this policy, I'll update the date at the top. For a meaningful change, I'll email clients before it applies.

Contact

Questions or requests? Reply to any email from me, or email collin@collinmallery.com, or call or text (775) 235-8677.