Privacy Policy
Effective July 29, 2026 · Last updated August 26, 2026
The short version
This site collects one thing, and only if you hand it over: an email address, so we can tell you when the packets are ready.
Some packets are sold. Those are bought through Payhip, on Payhip's own pages, not here. We never see your card. Nothing loads from Payhip while you are reading this site: the buy links are ordinary links, and Payhip is involved only once you follow one.
Every book page links to Bookshop.org, and we are a Bookshop affiliate, so a purchase made through one of our links earns us a small commission. It is paid by Bookshop out of its own margin, not added to what you pay: the price is the same whether you use our link or walk into the store yourself. Nothing loads from Bookshop while you are reading this site. Those are ordinary links too, and Bookshop is involved only once you follow one, under their privacy policy rather than this one. Borrowing is still listed first on every book page, and it is still free.
There is no analytics, no advertising, no tracking pixel, and nothing is ever sold or shared for marketing. No student data is collected here at all. You can be removed at any time by replying to any email or writing to the address at the bottom.
Who runs this site
The Fiction Laboratory is operated by Cory Ottenwess, based in Chicago, Illinois. Questions about this policy, or requests about your own information, go to Inquiries@fictionlaboratory.com.
What is collected
Your email address, if you choose to give it
The signup form on the home page asks for an email address and nothing else. No name, no school, no role. It is used for one purpose: to let you know when The Fiction Laboratory launches, and occasionally to share progress on it. You gave it voluntarily, and you can take it back at any time.
Anything you write to us
If you email us, we have your message and your email address, for as long as that conversation is useful. That is how email works, and we mention it only because a privacy policy that pretends otherwise is not being straight with you.
Standard server records
This site is hosted on GitHub Pages, operated by GitHub, Inc., a Microsoft company. GitHub processes ordinary web server information for security and abuse prevention, which typically includes IP addresses, the time of a request, and which page was requested. Their handling of it is described in the GitHub Privacy Statement.
Worth being clear about: we never see any of it. GitHub Pages gives a site owner no access to visitor logs, so there is no traffic data on our end to analyze, profile, or connect to your email address, whether or not we wanted to.
The signup form loads code from another company
The email form is provided by Kit (the service formerly called ConvertKit). To make the form work, this page loads a small script from Kit's servers. That happens on every visit, not only when you submit the form, which means Kit's servers can see your IP address even if you never sign up, and Kit may set cookies in your browser.
We are telling you this plainly because it is the only code on this site that reaches a third party before you ask it to. Kit's own privacy policy governs what they do with it, at kit.com/privacy.
If you buy a packet
Some packets are free and some are sold. The paid ones are sold through Payhip, which runs the checkout and delivers the files. The payment itself is taken by Stripe or PayPal, whichever you pick at checkout. The purchase does not happen on this site. A buy link is an ordinary link that takes you to Payhip, so nothing is loaded from them, and nothing is disclosed to them, unless you follow one. If you never click a buy link, Payhip learns nothing about you from us.
Once you are on Payhip, they collect what a shop needs: your email address, your name if you give it, your billing country for tax, and your payment details. Your card number never reaches us. It goes to Stripe or to PayPal, depending on which you chose, and we have no access to it, ever. What we can see, in our own Payhip account, is the order record: what was bought, when, for how much, and the email address it was sold to. We use that to deliver the packet, to answer you if something goes wrong, and to keep the records a business is required to keep.
Payhip's handling of all of this is governed by their own policy, at payhip.com/privacy.
After checkout you may be returned to a thank-you page on this site. That page is ordinary text. It sets nothing, loads nothing from anyone, and does not know who you are or what you bought.
Buying a packet does not put you on the mailing list. The two are separate, and one will never be used to populate the other. If you want the list, you have to ask for it.
What is not collected, and not done
- No analytics. No Google Analytics, no Plausible, no Matomo, nothing. We genuinely do not know how many people visit.
- No advertising or tracking pixels. No ad networks, no retargeting, no social media trackers.
- Nothing is sold, rented, or traded. Not now, not later. If that ever changed, it would require your consent first, and this policy would say so before it happened.
- No profiling. Your email address sits on a mailing list. It is not scored, segmented by inferred behavior, or enriched with data bought from anyone.
- No fonts loaded from Google. The typefaces are served from this site, so visiting this page does not tell Google anything about you.
Cookies
This site sets no cookies of its own. It has no login and no session to remember, and the shop runs on Payhip rather than here, so no cart of ours follows you around these pages. The Kit script described above may set its own cookies to recognize whether a form has already been submitted from your browser. Your browser settings can block those, and the site works fine without them. Payhip will set its own cookies once you are on Payhip, under their policy rather than this one. Bookshop.org does the same if you follow a book link from here. Their affiliate guide says a referral is cookied for up to 48 hours, which is the mechanism that credits a purchase to us. That cookie is set on Bookshop's site under Bookshop's policy, not ours, and nothing about it comes back to these pages.
Who else can see your information
Three companies in the ordinary course, plus a payment processor if you buy from us and a bookstore if you follow a book link, and no one else:
- Kit (ConvertKit LLC), which stores the mailing list and sends the emails.
- GitHub, Inc., a Microsoft company, which serves these pages through GitHub Pages and processes the server information described above.
- Payhip, which sells the paid packets and delivers the files. This one only ever applies to you if you buy something.
- Bookshop.org, if you follow one of our book links. They see the visit as a referral from us and record the sale so the commission can be paid. This one only ever applies if you click through to them, and what happens after that is under their own privacy notice rather than this one.
- Stripe or PayPal, whichever you choose at checkout, which takes the payment. Only the one you pick sees anything, and neither is involved unless you buy. Their policies are at stripe.com/privacy and paypal.com.
Beyond that, information would only be disclosed if we were legally required to, and we would push back on any request that looked improper.
How long it is kept
Your email address stays on the list until you ask to come off it, or until two years after the last time you opened an email from us, whichever comes first. When you unsubscribe, the address is deleted rather than kept on a suppression list, unless you specifically ask us to keep it suppressed.
Order records are different, and we will not pretend otherwise. A record of a purchase has to be kept for tax and accounting purposes, so it survives a deletion request in a way a mailing list entry does not. It is kept for as long as the law requires and no longer, it is never used for marketing, and it is not added to the mailing list.
Your choices
Whatever jurisdiction you are in, you can do all of the following by emailing Inquiries@fictionlaboratory.com. We are not going to ask you to prove a legal right before honoring a reasonable request.
- Leave. Every email has an unsubscribe link, or just reply and say so.
- See what we have. We will tell you, which for nearly everyone is one email address and a signup date, plus an order record if you have bought a packet.
- Correct it.
- Have it deleted. We will delete it and confirm when it is done. The one exception is an order record, which has to be kept for tax purposes; we will say so plainly rather than quietly keeping it.
Children
This site is meant for teachers and other adults. It is not directed to children, and the signup form is not intended for anyone under 13. We do not knowingly collect information from children under 13. If you are a parent or guardian and believe a child has given us an email address, write to Inquiries@fictionlaboratory.com and it will be deleted promptly.
Students and schools
This is worth being explicit about, because it is the question a district will ask.
No student information is collected by this website. There are no student accounts, no grades, no scores, and no rosters. Buying a packet is a purchase made by an adult, and it collects nothing about a student; a teacher's order record contains their own email address and nothing about anyone they teach. The progress tracker that comes with the curriculum is a spreadsheet that lives on the teacher's own computer or their own cloud storage. Student names and scores entered into it never reach us, and we have no way to see them.
If a future product does handle student information, that would not be governed by this policy. It would require a written agreement with each school or district before any student data changed hands, along with the obligations that come with the Illinois Student Online Personal Protection Act, FERPA, and the equivalent laws of other states. Nothing like that exists today, and this page will be updated before it does.
Security
This site is served over HTTPS. The mailing list lives inside Kit's systems rather than on any machine we run, which means their security controls protect it. We hold no card numbers and no passwords: there is nothing here to log into, and payments are taken by Stripe or PayPal on Payhip's pages, so card details never touch anything we operate. That is a deliberate choice: the least risky way to hold data is not to hold it.
Changes to this policy
If this policy changes, the date at the top changes with it. For a change that actually affects what happens to information already collected, everyone on the mailing list gets an email about it rather than a quiet edit to this page.
Contact
Inquiries@fictionlaboratory.com
The Fiction Laboratory, Chicago, Illinois
Written to be read, not to be defensible in the abstract. If something here is unclear or looks wrong, say so and it gets fixed.