Privacy policy

Last updated: October 23, 2026.

About this policy

GuidePebble is an independent informational website primarily serving readers in the United States. This policy describes this website's data handling. Contact [email protected] with privacy questions or requests, or [email protected] for general inquiries; no public user registration is offered.

Calculators and search

Calculator values are processed in your browser. The calculator application does not transmit your entries to our database or store them in browser storage. Results are not submitted as contact messages. Your device, browser extensions, or third-party services you choose to use have their own behavior.

Search terms and directory filters appear in URLs. Requested URLs may be included in browser history, server logs, or infrastructure records. Avoid putting sensitive information into search fields.

Contact form submissions

If you use our form, we store your email address, subject, message, and receipt date in our SQLite database. Required fields let us understand and respond to the inquiry. Submitting a message is voluntary; please do not include passwords, payment credentials, identity documents, or other sensitive information.

The administrator can read and delete submissions in a protected inbox. We use messages to handle inquiries, corrections, privacy requests, and related follow-up. The form stores a submission in that inbox; it does not forward it by email or send an automatic email receipt. Basic form validation, an anti-spam field, and global submission limits help reduce misuse.

Email sent directly to us

Messages sent to [email protected], [email protected], or [email protected] are received and forwarded through Cloudflare Email Routing to a receiving mailbox. They can include your address, message, attachments, and email headers. Cloudflare and the receiving email provider process that correspondence under their own services and settings. Email correspondence is separate from the website's administrative inbox.

Cookies, administration, and analytics

The application uses a session cookie for administrator sign-in. In production it is HttpOnly, Secure, and SameSite=Strict, scoped to the admin area, with an eight-hour expiration. The database stores a digest of the session token and its expiration, not the raw token. Administrator passwords are hashed. Expiration prevents further authentication; it does not by itself erase every stored session record.

Login and contact rate limits store global counters and reset times, without visitor IP addresses in those application counters. Infrastructure providers may process operational traffic information or set security cookies depending on enabled features; we do not claim their logging or cookies are disabled.

Optional Google Analytics

When configured, we offer Google Analytics 4 to understand which public pages are useful. It stays off until you choose Accept analytics. Rejecting analytics does not limit access to the site. We also keep it off when a supported browser sends Global Privacy Control or Do Not Track. No Google Analytics tag or measurement request is loaded before consent.

After acceptance, Google receives pageview information such as the public page title and URL, timing, browser/device information, and pseudonymous cookie identifiers. Google necessarily receives connection information, including your IP address, when your browser contacts its services. We do not describe this processing as anonymous. See how Google uses information from sites using its services and Google's privacy policy.

Our implementation removes URL query strings and fragments and does not forward external referrer URLs. Search and contact pages, administrative routes, and affiliate redirects are excluded. We do not send calculator inputs, contact form fields or message contents, email addresses, account identifiers, or other user-entered personal information as analytics events. Automatic enhanced measurement is disabled for this stream; our application sends controlled pageviews. Google signals and advertising personalization are disabled, and advertising consent remains denied.

Your analytics choice is stored in this browser's local storage until you change it or clear browser data. After acceptance, Analytics may set cookies with names beginning _ga. Our tag requests a 90-day cookie lifetime without refreshing that expiry on subsequent visits. Google's server-side retention depends on the Analytics property's settings; we do not promise a verified deletion period for those records here.

Use Cookie preferences in the footer to change your choice. Withdrawing consent disables collection, removes accessible first-party Analytics cookies, and reloads the page to unload the Google tag. It does not retroactively delete data already received by Google. Contact [email protected] with questions about information relating to you. If the measurement ID is absent, optional Analytics is disabled.

Affiliate links and third-party websites

If an approved affiliate redirect is enabled, we store the associated link, UTC date, and aggregate click count. The application does not attach IP addresses, user-agent strings, or visitor identifiers to these counts. Direct affiliate links are not counted by our redirect system. Counts remain until removed administratively or the related affiliate link is deleted.

Following an external link sends you to another website, whose provider may receive connection information and use cookies or affiliate attribution under its own policy. GuidePebble does not control those practices. Read our affiliate disclosure. Published images are served locally; if an externally hosted image is used, your browser also contacts that host.

Infrastructure and service providers

The Next.js application and database are hosted on a VPS. When traffic passes through Cloudflare, it may process IP addresses, requested URLs, browser information, and security signals to deliver and protect the site. Cloudflare also processes incoming email through the routing service. See Cloudflare's privacy policy.

Hosting, network, and email providers can process information in countries other than yours, depending on their service locations. Exact infrastructure-log settings, processing locations, and backup/mailbox retention depend on the services and configuration in use and have not all been confirmed. We do not publish an unverified hosting location or promise that information stays in one country.

Retention and deletion

No fixed automatic deletion period is currently enabled for contact submissions or expired administrative session records. They can remain until deleted through administration or a separately configured retention cleanup. We have not yet established fixed retention schedules for infrastructure logs, forwarded email, or backups. These unresolved operational details are not an assurance of immediate or time-limited erasure.

Deleting a message from the live inbox does not necessarily remove copies from existing backups or related email correspondence. Backup copies remain until those backups are removed. We limit administrative access, but no security measure is an absolute guarantee.

Privacy requests

Email [email protected] to ask about, correct, or request deletion of information you submitted. Identify the relevant message or page and provide only the details needed to locate it. We may need enough information to confirm the request concerns you. We will assess the request under applicable requirements and explain our response. Some requests may require identity verification or involve copies we cannot remove immediately; this policy does not limit rights provided by law.

The site is not directed to children. If you believe a child submitted personal information, contact us so we can assess and remove it as appropriate.

Policy updates

Changes to data handling will be reflected here with an updated date. Questions about this policy can be sent directly to [email protected] or through the contact page.