Privacy
What we collect, why, who else handles it, how long we keep it, and how to have it deleted. Last updated 4 October 2026.
- We collect only what the subscription needs: your email address, your portfolio, and where your subscription stands.
- Fungies, our merchant of record, takes the payment. We never see your card details.
- No advertising, no tracking cookies, and we never sell your data or share it for marketing.
- There is one cookie, set only when you sign in, and it keeps you signed in.
- The free list keeps an address only after it is confirmed, and every email has a link that stops them and deletes it.
- To get a copy of your data, or have it deleted, write to hello@purpleturtle.io.
Who is responsible
Purple Turtle is produced by Christian Mortensen, Pakhusgården 28, 5000 Odense, Denmark. The producer is the controller for the personal data described here and handles every request personally. Write to hello@purpleturtle.io about anything on this page.
What we collect, and why
Visiting the site
- What
- Your IP address, browser and the pages you request, as every web server receives them.
- Why
- To deliver the pages and protect the site from abuse.
- Legal basis
- Legitimate interests
- How long
- Our host keeps request logs for one hour.
Visitor statistics
- What
- Pages viewed, the site that sent you, country, device and browser type, and how fast pages load. Collected without cookies and without identifying you.
- Why
- To see which pages are read and whether they load quickly.
- Legal basis
- Legitimate interests
- How long
- Only totals are kept. The anonymous visitor marker is discarded after 24 hours.
Visits, checker uses and subscribe-button presses
- What
- The site or link that sent you to us (for example reddit.com), counted once when the first page opens. When you use the checker, only the fact that it was used, with the same source: the companies you type are checked in your browser and never sent to us. When you press a subscribe button, which button, portfolio and plan, with the same source. The source is read in your browser and kept in its memory only. Nothing that identifies you.
- Why
- To learn which pages and channels bring readers, whether the checker is used, and which lead people to subscribe.
- Legal basis
- Legitimate interests
- How long
- Only daily totals are kept, for 400 days. For up to two hours a press is held, with no identifier, so a subscription that follows can be counted against the same channel.
Your country
- What
- The country your IP address points to, checked on each request.
- Why
- To offer the subscription only where we may sell it. It is not offered to UK persons.
- Legal basis
- Legitimate interests
- How long
- Not stored. We keep only a daily count of checkouts turned away.
Signing in
- What
- Your email address, and the IP address the request came from.
- Why
- To email you a one-time sign-in link, and to limit how many links can be requested, so the form cannot be used to flood anyone's inbox.
- Legal basis
- Contract; legitimate interests for the limits
- How long
- The limits are kept for one hour. A link works once and expires after 15 minutes, or after three days if it came inside one of our emails.
The sign-in cookie
- What
- A signed token holding your email address and your portfolio.
- Why
- To keep you signed in.
- Legal basis
- Contract (strictly necessary)
- How long
- 90 days, or until you sign out.
Your subscription
- What
- Your email address, your portfolio, the subscription's status, its trial and renewal dates, the payment provider's subscription and customer numbers, and whether you agreed to marketing at checkout.
- Why
- To give you access, and to send the emails that are part of the service: sign-in links, the welcome, the trial reminder, the twice-yearly review and notices about corporate actions.
- Legal basis
- Contract
- How long
- While you subscribe, and for 12 months after the subscription ends, so a renewal, refund or dispute can be matched to it. Then it is deleted.
Payment notifications
- What
- Messages from Fungies about your subscription: your email address, plan, status and dates.
- Why
- To keep your access in step with your payments.
- Legal basis
- Contract
- How long
- They update the record above. A daily log of them, without your email address, is kept for 21 days. While a problem with them is being fixed, complete copies may be kept for up to 24 hours.
The list
- What
- Your email address, when you asked and when you confirmed, the words you agreed to, the page you signed up on, and the site or link that sent you (for example reddit.com). While a sign-up waits for confirmation, your IP address is used to limit how often sign-ups can be asked for.
- Why
- To send what you asked for: the new exclusion list when it changes, in January and July, and at most one short note a month.
- Legal basis
- Consent, which you can withdraw at any time with the link in every email, or by writing to us
- How long
- Until you stop the emails; then the address is deleted. An address that is never confirmed is deleted after 48 hours. The limits on sign-ups are kept for one hour.
Emails you send us
- What
- Your message and your address.
- Why
- To answer you.
- Legal basis
- Legitimate interests, or contract if it is about your subscription
- How long
- As long as it takes to deal with your message and any follow-up.
The list is the only email we send that is not part of a subscription, and it goes only to addresses that asked for it and confirmed. Agreeing to marketing at checkout does not add anyone to it: that choice is recorded with the subscription, and nothing is sent on the strength of it.
Payments
Fungies (Fungies Inc. and Fungies Europe PSA) is the merchant of record. It sells the subscription to you, takes the payment, issues the invoice and handles VAT, and it decides how your payment details are processed, under its own privacy policy. We receive your email address, your plan, and the subscription’s status and dates. Never your card details.
Public Reddit posts we answer
Purple Turtle publishes free articles that answer questions investors ask in public Reddit communities. The producer replies to some of those threads from an account that discloses the connection.
Posts chosen to answer
- What
- The title, text and address of a public post the producer chooses to answer. A post can contain personal details its author chose to share. We do not record who wrote it.
- Why
- To draft an answer to the question. The article answers the general question; it does not quote or identify anyone.
- Legal basis
- Legitimate interests: answering a question that was asked in public
- How long
- The post's text is deleted automatically within 30 days. The question itself, in a line and without the post's text, is kept for up to 90 days, so the same question is not answered twice.
We weighed this against the interests of the people who wrote the posts. The posts are public, threads are chosen by hand, usernames are not recorded, nobody is profiled or contacted, and the text is deleted within 30 days. Drafts are written with Anthropic’s AI models, which do not train on what we send. We cannot tell each author individually, because we do not record who they are. If a post of yours is in our drafting tool and you want it removed, send its address to hello@purpleturtle.io and everything relating to it will be deleted.
Who else handles your data
Each of these works on our behalf, to provide its service to us:
- Vercel Inc. (United States) hosts the site and runs its code, and provides the request logs and visitor statistics described above.
- Upstash, Inc. (United States) runs the database that holds subscription records, the list, sign-in limits and the article drafts.
- Resend (United States) delivers our emails.
- ImprovMX forwards email sent to our addresses to the producer’s inbox.
- Anthropic PBC (United States) processes the Reddit posts described above, to draft answers.
Fungies is not on this list because it decides for itself how it handles payments; see Payments above. We do not sell personal data, and we do not share it with advertisers.
Transfers outside the EU
Vercel, Upstash, Resend and Anthropic are US companies, so your data may be processed in the United States. Those transfers rely on the EU–US Data Privacy Framework where the company is certified under it, and otherwise on the European Commission’s standard contractual clauses.
Cookies
One cookie, pt_session, set only when you sign in. It keeps you signed in, so it needs no consent. We use no advertising or analytics cookies, and the visitor statistics work without cookies.
Decisions made automatically
Whether checkout is open to you depends on the country your IP address points to, because the subscription is not offered everywhere. That is a rule about where we sell, not an assessment of you. If it has your country wrong, write to hello@purpleturtle.io.
Your rights
You can ask for a copy of your data, have it corrected or deleted, limit how we use it, or receive it in a format you can take elsewhere. Where we rely on legitimate interests you can object, and we will stop unless we have compelling grounds to continue. Write to hello@purpleturtle.io. We answer within a month.
Deleting your data does not cancel a running subscription: cancel it first from your subscription, or ask us to. Otherwise the payment provider’s next notification creates your record again.
You can also complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk, or to the data protection authority where you live.
Children
The service is for adults. We do not knowingly collect data from anyone under 18.
Changes
If this notice changes in a way that matters, the date at the top changes, and subscribers are told by email.