Draft for review. This wording has not yet been approved.

Privacy

Last updated October 17, 2026.

A security playbook holds sensitive details, so we built it to keep them with you.

What we never see

• What you type into the playbook: phone numbers, account names, devices, notes. It is built in your own browser and stays on your device.
• Your card number. Payment is handled by Stripe; we never see or store card details.

What we keep, and why

• Your email address and order details, from Stripe, so we can send your playbook link, resend it if you lose it, and answer questions.
• A scrambled fingerprint of the name on each playbook. It lets us check that a purchase covers the right number of people. The name itself is never sent to us, and the fingerprint cannot be turned back into the name.
• Your mailing address and phone number, only if you order a printed copy, so it can be shipped.
• A printed copy's PDF, only if you choose "Send for printing". It is stored privately and deleted once your copy ships or is cancelled, and in any case within 14 days.

Who else is involved

• Stripe processes payments.
• Cloudflare runs this website.
• Resend sends our emails, such as your playbook link.
• For printed copies, our printer, Lulu (Lulu Press, Inc.), receives the PDF, your mailing address and phone number to print and ship it. The phone number is only for the delivery carrier.
• HubSpot keeps our customer records for business purchases only (organization plans, code packs and the Small Office Security Playbook): the buyer's name, email, organization and what was bought. Family purchases are not added, and nothing about the people an organization sends codes to, or anything typed into a playbook, ever goes to HubSpot.
• If your playbook came from an organization that prints copies through its own Lulu account, the PDF and the mailing address you type go to that organization's Lulu account instead, so it can print and ship your copy.

We don't sell your information, we don't use advertising trackers, and this site doesn't set cookies for marketing.

We count visits to our public pages with GoatCounter, which doesn't use cookies and doesn't collect personal information. It records the page, the site that sent you, and your screen size, and it respects your browser's Do Not Track setting. It never runs on the pages where you build your playbook.

The scam quiz, the Small Office Security Checkup and the practice calls run entirely in your browser. Your answers are never sent to us. The quiz and the checkup keep a short results code in your own browser for 60 days, so the playbook can start from your answers if you build one; the "Forget my answers" button deletes it, and the playbook only uses it when you choose to. GoatCounter counts only that a quiz was finished, with its overall result (for example "a good start, with gaps"), or which practice call was opened. The monthly task emails: if you're on a yearly plan, or sign up through an organization, we keep your email address, the organization it came through, and the last month we sent, only to send one task a month. Every email has a link to stop, and stopping deletes your address from the list. We never sell or share it. The Small Office Security Playbook works like the family playbook: what you type stays in your browser, and only a scrambled fingerprint of your organization's name is sent to confirm your purchase.

About two weeks after you buy, we send one email to check the playbook is done and to offer help. If you choose to share a few words about it, we keep them with your first name and state, and they appear on this site only if you ticked the box and we approve them. Every follow-up email has a link to stop it.

When you use a business's own copy of the quiz, practice calls, checkup, drill or Readiness Check, we count that it was used (for example, "one quiz finished this month") so the business can see its tools are helping. The count has no answers, name, email or address in it.

Some businesses that offer our playbooks also offer a Security Readiness Check with their name on it. It also runs in your browser. Your answers are sent only if you tick the box to send them, and then our email service passes them on to that business. We don't keep a copy, read them or add you to any list. That business's own privacy policy covers what it does with them.

Your choices

To ask what we hold about you, or to have it deleted, email jeff@jcady.org. We may need to keep order records for tax and accounting.

Contact

JCady LLC, Maricopa County, Arizona. jeff@jcady.org · (520) 223-9878 ext. 800.