Privacy
Last updated: 31 July 2026
Who is responsible
Crabhaus is run by Vatsal Mishra, based in Dublin, Ireland. For any question about your data, or to request access or deletion, contact [email protected].
What we collect when you subscribe
Your email address, the time you signed up, and the exact consent wording and version you agreed to. We also record basic attribution: which page you subscribed from, any campaign parameters in the link you followed, and the hostname of the site that referred you. We store the referring hostname only, never the full page address.
Why we are allowed to do this
We rely on your consent (Article 6(1)(a) GDPR). You gave it by ticking the consent box and confirming your address. You can withdraw it at any time by unsubscribing, which is a one-click link in every edition.
Abuse prevention
When you submit the form, your IP address is combined with a private salt and hashed. The raw IP address is never written to our database. The hash is kept in a separate rate-limiting table and is deleted once it is more than 24 hours old, which happens the next time the service handles traffic. It is not stored alongside your subscription. When you subscribe, your IP address is also passed once, over an encrypted connection, to our email provider Buttondown so it can check that the signup is legitimate and not automated abuse. We do not keep the raw address ourselves.
Who else processes your data
We use Buttondown (Buttondown LLC, United States) to send email and manage subscriptions. Your email address, a signup source tag, any campaign parameters, and the referring site are shared with Buttondown so it can send you the newsletter. Buttondown also records its own information about your subscription, including the IP address you subscribed from (which we pass to it for spam prevention), a country inferred from that address, a spam-risk score, and — once we begin sending — whether you opened an edition or clicked a link in it. This means your data is transferred to and stored in the United States.
Our website loads fonts from Google Fonts. Your browser contacts Google's servers to fetch them, which means Google receives your IP address when you view a page. We use no analytics, no advertising trackers, and no cookies.
We do not sell your data to anyone.
Feedback on an issue
If you rate an issue useful or leave a comment, we store the issue number, your rating, your comment, and the time. That record is anonymous — it is not linked to your email address, your subscription, or any identifier. Please avoid putting personal information in the comment box, since we cannot connect it back to you in order to remove it.
How long we keep it
Your subscription record is kept until you unsubscribe or ask us to delete it. Rate-limiting hashes are deleted after 24 hours. Feedback records are kept indefinitely in anonymous form.
Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete it, by emailing the address above. You can unsubscribe from any edition without contacting us. If you think we have handled your data improperly, you can complain to the Irish Data Protection Commission at dataprotection.ie.