Privacy
Last updated: May 2026
Boringdots is a personal portfolio and product lab operated by Harry Jay in Malaysia. It collects as little personal data as possible. Boringdots is currently in public beta. This notice tells you what is collected, who processes it, where it goes, and how long it is kept.
What is collected
When you create a Boringdots account, Clerk collects your email and the metadata needed to sign you in: a session token, the sign-in methods you used (password, Google, GitHub), your first and last name if you provide them, and timestamps of sign-in events.
If you subscribe to the newsletter, Boringdots collects your email address through Kit.
If you buy Boringdots Operator, Stripe processes the payment and Boringdots receives the checkout email, your name, and Stripe customer and subscription identifiers needed to issue and manage access. The Boringdots Operator backend also stores entitlement records, a hashed API-key record, quota and rate-limit counters, and redacted request audit lines. Raw API keys are delivered once by email and are not stored in plaintext.
How it is used
Your email is used to sign you in, to send occasional notes if you subscribe to the newsletter, and to deliver and manage Boringdots Operator access if you buy it. Access data is used to authenticate requests, enforce rate limits and quotas, revoke cancelled access, and investigate abuse or support issues. None of it is sold, rented, or shared for unrelated marketing.
Your Clerk session cookie keeps you signed in across page loads. Signing out clears it.
Who processes it
- Clerk: handles sign-in, sign-up, sessions, and user identity. Stores your email, name, sign-in methods, and session metadata. Servers based in the United States. See Clerk's privacy policy.
- Kit (ConvertKit): stores the newsletter subscriber list and sends the emails. See Kit's privacy policy.
- Stripe: processes payments, subscriptions, receipts, and cancellation links. See Stripe's privacy policy.
- Brevo: sends the Boringdots Operator access email. See Brevo's privacy policy.
- Vercel: hosts the site. See Vercel's privacy policy.
- Render and the configured Upstash KV store: host the Boringdots Operator endpoint and access records when Operator is enabled.
Where data is processed
Some of your data is processed outside Malaysia. Clerk, Vercel, and Upstash host primarily in the United States. Brevo hosts in the European Union. Stripe operates globally. By using Boringdots you accept that your data may be transferred to and processed in these jurisdictions, subject to each provider's own safeguards.
How long it is kept
If you do not sign in for 12 months, Boringdots deletes your account, your entitlement records, and any audit data linked to you. You can request deletion at any time before that window by emailing hi@boringdots.com.
Newsletter subscriptions are managed by Kit on its own retention schedule and are independent of your Boringdots account. Unsubscribing from the newsletter does not delete your Boringdots account, and deleting your account does not unsubscribe you from the newsletter. Both must be done separately if you want both.
Stripe records (payments, invoices) are retained by Stripe as required by tax and accounting law.
Security
Connections to Boringdots use HTTPS. Passwords are hashed and managed by Clerk. API keys are hashed at rest in the entitlement store. Boringdots does not run analytics, tracking pixels, or third-party ad networks.
Your choices
You can unsubscribe from the newsletter at any time using the link at the bottom of any newsletter email. Boringdots Operator subscriptions can be cancelled from the link in the Stripe receipt. To request access to, correction of, or deletion of your data, email hi@boringdots.com.
Jurisdiction
This notice is provided in the spirit of Malaysia's Personal Data Protection Act 2010 (PDPA). Boringdots is a personal project operated by Harry Jay.