Privacy Policy

Information collection and usage

You can join our newsletter through the signup forms on this website. The only thing we ask you to type is an email address. Alongside it we record how you arrived: which form you used, the kind of page it was on, its topic, an experiment variant, the date, the version of the consent wording shown to you, and the most recent form you have used. We record those so we know where a signup came from and so we have an accurate record of what you agreed to. Everyone receives the same newsletter.

A signup passes through our own servers first, where the address is checked for a valid format, counted against the abuse limits described below, and used to look up whether you are already subscribed. We do not keep it: the subscriber record itself is created and stored by MailerLite, our email service provider, and their handling of it is governed by their privacy policy. If tracking is enabled on a given campaign, MailerLite also records whether you opened an email and which links you clicked.

We never attach a domain you valued, a portfolio total, or any valuation figure to your subscriber record. Your address is never shared with sponsors.

We use Google Analytics to help us understand how our website is being used. Google Analytics may collect information about your interactions with our website, such as your IP address and other usage data. To learn more about how Google Analytics collects and processes data, see google.com/policies/privacy/partners.

Google Analytics sets its own first-party cookies, _ga and _ga_<id>, so that repeat page views can be counted as one visit rather than several. They hold a random identifier and nothing else, they are readable only on this site, and clearing your browser cookies removes them. We do not permit Google to use anything collected here for advertising or ad personalisation: those signals are switched off on every page, and there is no advertising on this site to switch them on for.

When you request an estimate, the domain name you entered is sent to Replicate, the third-party model host that runs our estimate model, so the figure can be produced. Only the domain name itself is sent. We separately check the domain's registration status by querying the registry, and that lookup is routed through a proxy provider, which sees the domain being checked.

Domain names submitted for an estimate are not linked to a personal profile, and we do not build a history of what you have estimated. Your own browser keeps a short list so you can return to recent work; it is described under Local storage below, it never reaches our servers or Google Analytics, and there is a visible control to clear it.

Partner links and click measurement

Commercial links on HumbleWorth (registrars, marketplaces, brokers, hosting, transfers, and escrow) pass through a HumbleWorth address of the form /go/… before redirecting you to the provider. See our Affiliate Disclosure for what those relationships are.

When you follow one of those links, our server records:

• which offer, placement, and provider the link belonged to;
• the domain name in the link, where the action relates to a specific domain;
• a randomly generated click reference, which may be passed to the provider so a commission can be attributed;
• a coarse classification of whether the request looked like a person or an automated one, so that bot traffic can be excluded from our reporting.

These are stored as daily aggregate counters, not as an individual browsing history, and are kept for up to 120 days. We do not attach your IP address or an identifier for you to them.

Once you land on the provider's site you are subject to their privacy policy and their cookies, not ours. We have no control over, and no visibility into, what they collect.

To measure whether a commercial placement was actually seen, the page also reports anonymous impression counts for the same offer and placement identifiers. These carry no identifier for you.

Local storage

We store a small record in your browser's local storage under the key hw:visitor. It contains a random identifier, the date of your first visit, and per-day counters used to stop the same recommendation being shown to you repeatedly.

That identifier is generated locally, is never sent to our servers or to any third party, and cannot be used to recognise you on any other website. Clearing your browser storage removes it, and the site works normally without it.

If you submit the newsletter form we also store hw:newsletter, holding whether this browser has confirmed a subscription or is still waiting on the confirmation email, when that happened, and which form it came from, so that we stop asking you. An unconfirmed submission is forgotten after seven days and the form may appear again. A companion hw:newsletter.session record lasts only for the current tab session and notes which signup forms you have actually seen or interacted with, which is what stops a second form appearing further down the same page. Neither one holds your email address. Clearing them makes the site forget you subscribed; it does not unsubscribe you.

Three records exist purely so you can pick up where you left off. hw:recent-domains holds up to ten domains you have estimated and when, for thirty days, with no estimated values attached; wherever it is shown there is a Clear control beside it. hw:gems holds which Daily Gems list you last saw and which tab you were on (never the names on it) and is replaced each time you visit that page. humbleworth:bulk-draft keeps the list you pasted into the portfolio tool for the current tab session, so a reload does not lose it.

None of the three is transmitted anywhere as a record. Two qualifications, because "never leaves your browser" would not be quite true:

• The most recent domain in hw:recent-domains is used on the homepage to make one recommendation about that specific name. If you click it, that domain travels with the click exactly as it would from a report: through our /go address and on to the provider. Nothing travels unless you click.
• Google Analytics receives coarse derivatives of this activity: that a recent domain was reopened and its position in the list, how far down Daily Gems you scrolled, never the domains themselves. This is the same rule as everywhere else on the site.

Clearing your browser storage removes all three.

Unlike the visitor identifier above, whether this browser has confirmed, is awaiting confirmation, or has done neither is included in the Google Analytics events described earlier, so we can tell how often a form is shown to somebody who has already signed up. Your address is not part of that.

Advertising

We run no third-party advertising. There are no ad networks on this site, no ad slots, and nothing that profiles you in order to choose what to show you.

The only commercial placements are our own sponsored and affiliate modules, rendered directly by HumbleWorth. They load no third-party script, image, or tracking pixel, and each one is labelled on the page so you can tell what it is.

Data retention

For newsletter subscribers, your address, signup attribution, and any open and click data are retained by MailerLite for as long as you remain subscribed. Unsubscribing stops future newsletter sends. If you want the record deleted outright rather than marked unsubscribed, email us and we will remove it.

Aggregate impression and click counters for commercial placements are retained for up to 120 days and then expire automatically. Registration-status lookups are cached for a few hours at most.

To stop automated abuse of the estimate, registration-status, impression, and newsletter signup endpoints, we count requests against your IP address. Each of those counters is keyed to the IP address, holds nothing but a number, and expires between 60 seconds and 10 minutes after the first request in its window, depending on the endpoint.

The newsletter signup endpoint also counts attempts against a one-way hash of the email address, so that one address cannot be submitted over and over from different connections. That counter holds nothing but a number, your actual address is never used as a key, and it expires an hour after the first attempt in its window.

Data security

Data you provide to us directly is stored securely on our servers. We take precautions to protect your information from unauthorized access, disclosure, alteration, or destruction. Our site and its data stores run on Vercel and Upstash, whose regions are listed with the third parties below. Newsletter subscriber data is the exception: it is held by MailerLite on their infrastructure, under their security practices.

Access, update, and deletion

You can unsubscribe at any time using the link in the footer of every newsletter we send, which stops future newsletter sends. To see, correct, or permanently delete what we hold, email us at hello@humbleworth.com and we will action it in MailerLite.

Age restrictions

The newsletter is free and we do not ask your age when you subscribe. The age requirements in our Terms of Service apply to it as they do to the rest of the service.

Data breach notification

In the event of a data breach, we will notify affected newsletter subscribers via email. We do not store passwords.

Data transfer and third parties

We do not sell user data. Newsletter subscriber details are shared with no one except MailerLite, which stores and sends the newsletter on our behalf and is listed below; in particular they are never shared with sponsors or advertisers. We currently have no plans to sell HumbleWorth.

The third parties that do process data on our behalf, or receive it, are:

• Google Analytics: aggregate usage analytics, including the anonymous placement and offer dimensions described above.
• Cloudflare Turnstile: bot protection on the bulk estimate form.
• MailerLite: stores and sends the newsletter. Receives your email address and, so we know where the signup came from, the form you used, the type of page it was on, its topic, the date, an experiment variant, and the version of the consent wording shown to you. It also receives open and click data on campaigns where tracking is enabled.
• Replicate: hosts and runs the estimate model. Every domain name submitted for a single or bulk estimate is sent there. Nothing else about you is included.
• Webshare: the proxy network our registration-status queries are routed through on their way to the registry. It sees the domain being checked, not who asked.
• Vercel and Upstash: hosting and data storage for the site itself.
• Affiliate and sponsor partners: only when you click through to them, and only the click reference described above.

Some of these operate infrastructure outside your own country. Where an affiliate network requires it, an anonymous click reference is passed so a commission can be attributed. No name, email address, or account information is included.

Employee and contractor compliance

HumbleWorth is a one-person operation. All work done by contractors, such as design work, is completed independently and without access to user data.

Policy updates

We have no plans to update this privacy policy. However, if we make any changes that affect our newsletter subscribers, we will notify them via email.

Contact

If you have any questions or concerns about our privacy policy, please contact us at hello@humbleworth.com.