Your information, in plain view.

Effective date: September 1, 2026

1. Scope

This Privacy Policy applies to personal information processed by Vegas Retold LLC through vegasretold.com and related Account, Pass, correction, support, and service communications (together, the “Service”). It does not govern websites or services operated by Amazon, Stripe, social networks, mapping providers, archives, or other third parties.

2. Personal information we collect

Information you provide

• Account information: your email address, email-verification state, Account identifier, and Account timestamps. Sign-in uses a one-time code rather than a Vegas Retold password.
• Purchase information: Stripe customer, Checkout, payment, and price identifiers; purchaser email; amount, currency, purchase status, policy-acceptance version and time, and transaction timestamps. Stripe processes payment-card details; Vegas Retold does not receive or store full card numbers.
• Correction and source information: the page or record concerned, your message, an optional supporting-source URL, and an optional email address for follow-up.
• Communications: information you include in support, privacy-rights, legal, or other messages to us.

Information collected through the Service

• Request and device data: IP address, browser and device type, operating system, requested pages, timestamps, referring page, and security or delivery information processed in Cloudflare and application logs.
• Account and Pass state: an essential Account session cookie and, after Pass activation, a random device token stored in an HTTP-only cookie. Vegas Retold stores a one-way hash of that token to enforce the one-active-device rule.
• On-device reading state: saved-Story and marked-read choices stored in your browser’s local storage. This state stays on that browser unless a feature says otherwise.
• Limited analytics: selected product events may be sent to PostHog. The current integration disables automatic event capture, automatic pageview and page-leave capture, exception capture, session recording, and person profiles.

The Service does not require device-location permission to read a Story and does not currently collect precise location. If that changes, we will update this Policy and request permission before collecting precise location.

3. How we use personal information

• Provide, secure, maintain, personalize, and troubleshoot the Service.
• Verify Accounts and deliver requested sign-in codes and service messages.
• Start Checkout, record purchases, activate Pass access, and prevent fraud or duplication.
• Associate Pass access with one active device and provide access recovery and support.
• Review correction and source submissions without changing editorial pages automatically.
• Measure selected product use and improve accessibility, reliability, and content.
• Comply with law, enforce our Terms, resolve disputes, and protect people and the Service.

4. How we share personal information

We may disclose only the information reasonably needed to:

• Service providers: Cloudflare for hosting, delivery, security, and email routing; the transactional-email provider for Account codes; Stripe for payment processing; and PostHog for the limited analytics described above.
• Professional advisers and authorities: lawyers, accountants, insurers, auditors, law enforcement, courts, or regulators when reasonably necessary or legally required.
• Business transfers: parties involved in evaluating or completing a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate safeguards.
• At your direction: a third party you ask or authorize us to involve.

We do not sell personal information, use it for targeted advertising, or use it to make decisions that produce legal or similarly significant effects. We do not provide personal visitor data to sponsors or distribution partners. Third parties may process activity over time only as needed to provide the Cloudflare, Stripe, email, and limited PostHog services described here; we do not run social-media tracking pixels or cross-site advertising trackers.

5. Cookies, local storage, and your choices

Essential cookies keep an Account signed in and bind an activated Pass to one device. Local storage remembers saved and completed Stories on that browser. Limited analytics may use browser storage. You can clear cookies and local storage through your browser, but doing so may sign you out, remove local reading choices, or require Pass recovery.

We do not currently respond to browser “Do Not Track” signals because there is no common standard for them. Because we do not sell personal information or use targeted advertising, we do not currently offer a separate advertising opt-out control.

6. Retention and security

One-time sign-in codes expire after five minutes. We keep Account and active-session records while needed to provide and secure the Account; purchase and acceptance records as needed for access, fraud prevention, disputes, tax, and accounting obligations; correction submissions as part of the editorial audit record; and operational logs and analytics only for as long as reasonably needed for security, reliability, and measurement. We delete, anonymize, or isolate information when it is no longer reasonably required, subject to legal holds and non-waivable recordkeeping duties.

We use technical and organizational safeguards designed to protect personal information, including restricted administrative access and one-way hashing of Pass device tokens. No internet service can guarantee absolute security.

7. Your privacy rights

Depending on where you live and the law that applies to us, you may request access to, correction of, deletion of, or a portable copy of personal information, or appeal a decision about a request. Nevada residents may also direct us not to sell covered information. We do not currently sell such information.

Email privacy@vegasretold.com to make a request. Describe the request and provide the email associated with your Account, if any. We may verify control of that email or request other proportionate information before acting. We will not request government identification unless it is reasonably necessary and permitted by law. Authorized agents may also contact us; we may verify their authority and the identity of the person they represent.

We will respond within the time required by applicable law. Rights are not absolute, and we may retain information where an exception or legal obligation applies. We will not discriminate against you for exercising a privacy right.

8. Children and international visitors

The Service is a general-audience history service and is not directed to children under 13. Children under 13 may not create an Account, buy a Pass, or submit personal information. Accounts and Pass purchases are limited to people who are at least 18. If you believe a child has provided personal information in violation of this Policy, contact us so we can investigate and take appropriate action.

Vegas Retold is based in the United States. Information may be processed in the United States and where approved service providers operate. The Service is not currently directed to residents of the European Economic Area, United Kingdom, or other jurisdictions that require a different privacy notice.

9. Changes to this Policy

We may update this Policy as the Service changes. We will post the revised effective date and, when appropriate, provide a prominent Service or email notice before a material change applies. A material change will not retroactively expand our use of previously collected information without any consent required by law.

10. Contact us

For privacy questions or requests, email privacy@vegasretold.com. For Account, purchase, or access help, visit Support.

This Policy was adapted from the U.S. Privacy Policy template published by General Legal under CC0 1.0.