The boring but important bit.
Who we are
40 for 40 is a community project run from London. For anything about your data, email help@build40for40.com.
What we collect
What you type into our forms: your name, email, company or role, and the note, problem or availability you send.
When you pay, Stripe collects your card and billing details. We never see your card number. We receive your name or company, the amount, and how you chose to be credited.
Anonymous stats on how the site is used: pages viewed, buttons clicked, forms sent and payments made. They include which boxes you ticked, but never your name, email or anything you wrote.
Why we use it
To reply to you, plan the 40 days, credit you on the day you backed (unless you chose anonymous) and send receipts. Our lawful bases under UK GDPR are your consent and our legitimate interest in running the project.
Problems you send us go on the site so people can sponsor them, with your first name if you gave one. Your email never does.
Guest names and photos only appear on the site with written consent.
The anonymous stats tell us which bits of the site work, under our legitimate interest in running it.
Who we share it with
Stripe for payments, PostHog (hosted in the EU) for the anonymous stats, and the email and spreadsheet tools we use to read your messages. We don't sell your data or share it with advertisers.
Substack sends our newsletter, but only if you tick the newsletter box. We give them your email so they can send it, and you can unsubscribe from any issue.
TypeSafe ranks searches in the problems pool. They get the words searched for and the title and text of matching problems, never a name, email or payment.
Cookies
This site sets no cookies of its own. The only thing it keeps in your browser is whether you switched the pool's motion or tilt on or off. PostHog counts visitors without cookies, using a one-way scramble of your IP address and browser that resets every day, so it can't recognise you from one day to the next.
The Twitch player only loads if you press play, and Twitch then sets its own cookies.
How long we keep it
Form submissions are deleted 12 months after the project ends. Payment records are kept as long as the law requires.
The Naughty List browser extension
The Naughty List shows reviewed business information while you shop. It reads product and offer metadata, price elements and purchase controls on HTTPS pages inside your browser to detect likely shopping pages. It also checks page navigation locally to keep its information stamp up to date.
On a likely shopping page, it sends only the website hostname, such as www.patagonia.com, to naughty-list-api.40for40.workers.dev. The service uses it to look up stored business evidence. It does not receive the full page URL, page path, query string, product text, prices, page HTML or shopping signals. Requests omit cookies and referrers.
The service runs on Cloudflare, which processes network connection information, including IP addresses, to deliver and protect the service. The application does not write shopper lookups to its evidence database or log them in application code. This does not mean that Cloudflare has no operational or security logs. For questions about records held by the service, contact us using the address below.
The extension keeps your automatic-check and stamp-position settings on this device. It caches up to 50 hostname assessment results in browser-session storage for five minutes. Expired results are ignored and removed on later cache writes; session storage clears when the browser session ends. Settings and cached results are not synced to other devices.
There is no account, analytics SDK or extension-generated tracking identifier. We do not sell extension data, use it for advertising or use it to build a browsing profile. The website analytics described elsewhere in this notice are separate from the extension.
You can turn automatic checks off in the extension settings to stop new lookups and remove the stamp. This cannot recall a request already sent. You can dismiss the stamp for the current page, clear extension storage or uninstall the extension. For questions, corrections or data requests, email help@build40for40.com.
Your rights
You can ask to see, correct or delete your data, or object to how we use it, by emailing help@build40for40.com. If you're unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.