Hidden Gumption

Privacy

Last updated 16 October 2026 · Version française

Who is responsible

Hidden Gumption is run by Samantha Umbdenstock EI (entrepreneur individuel, the French status for a one-person business), registered in France (SIRET 993 972 991 00018). I’m responsible for the information described here. You can reach me at sam@hiddengumption.com. Full business details are on the legal notice page.

Visiting this website

• No cookies, analytics or tracking. I don’t count your visit or follow you anywhere.
• Hosting. Cloudflare hosts the site. It processes technical information, such as your IP address and the time of your visit, to deliver the page and protect it from abuse, and keeps it according to its own policy.
• Fonts. The page loads its fonts from Google Fonts, so your browser sends your IP address to Google.

Writing to me

If you email me, I keep our conversation so I can reply and follow up. My email is handled by Zoho Mail in the EU. I keep correspondence while it’s useful to our conversation, and delete it at the latest three years after our last exchange, unless it’s part of a purchase record (see below).

The beta tester sign-up form

The form runs on Google Forms. If you fill it in, I receive your name, your email address and your answers about how you journal and which devices and browsers you use. I use them only to contact you about Goldilocks, including invitations to try it.

Sending the form is your choice, and you can change your mind at any time: email me and I’ll delete your answers. Otherwise I delete them three years after our last contact.

Buying Goldilocks

Creem is the merchant of record. It takes your payment, issues your invoice and handles tax, under its own privacy policy. I never see your card details.

Creem shares with me what I need to provide your licence and support: your name, email address, country and order details. I use them to deliver what you bought and to help you. Purchase records are kept for as long as French accounting and tax rules require, which can be up to ten years.

Using Goldilocks

• Your entries are files you choose where to keep. They’re saved as text (Markdown) files in a folder on your computer, or in your own Google Drive, Dropbox or OneDrive.
• The app connects to those services directly from your browser, with your permission. Goldilocks is a set of files served by Cloudflare. I don’t run a server that receives your entries, and I can’t read them.
• Your browser keeps a working copy on your device. If your cloud connection lapses, changes are held in your browser and sent when you reconnect.
• If you don’t connect a folder or cloud account, your entries exist only in your browser’s storage, which is easy to lose.
• Clearing your browser data removes the browser copy, including any changes not yet sent. It doesn’t remove files in your folder or cloud account.
• Licence key. To confirm a purchase, the app may check your licence key with Creem. Your entries are never sent.
• Fonts. The app loads its fonts from Google Fonts.

Service providers

These providers handle limited information on my behalf, or as part of a service you choose. None of it is for advertising.

• Cloudflare (United States): hosting for this site and the app.
• Google (United States): fonts and the beta tester sign-up form.
• Zoho (EU): email.
• Discord (United States): optional, only if you join the beta testers’ server, under Discord’s own terms and privacy policy.
• Creem (Estonia, EU): checkout, payment, invoices and refunds.
• Google Drive, Dropbox or OneDrive: only if you connect your own account. Your files stay under that provider’s terms and your control.

Where information goes to the United States, it’s covered by the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

The legal basis

• Purchases and support: to provide what you bought (performance of a contract).
• Accounting records: because French law requires them (legal obligation).
• The beta tester sign-up form: your consent, which you can withdraw at any time.
• Emails and site security: my legitimate interest in replying to you and keeping the site safe.

Your rights

You can ask to see, correct, delete or export the information I hold about you, to restrict or object to how I use it, and to withdraw your consent. Write to sam@hiddengumption.com. I’ll answer within one month, or tell you within that month if a complex request needs longer, as the GDPR allows.

Your entries live in your own folder or accounts, so you delete or export them yourself. I can’t reach them.

If you’re unhappy with my answer, you can complain to the CNIL, the French data protection authority, or to the authority in your own EU country.

Changes

If this page changes, the date at the top changes with it.