Privacy Policy
How LanternRack collects, uses, stores, and protects your personal information when you read our guides, download stack compose files, or subscribe to our email updates.
LanternRack ("we", "us", or "our", operated by Craig Davignon at howto.croogserverdude.ca) respects your privacy and builds privacy-by-default into our infrastructure. This Privacy Policy explains how we handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL), the EU/UK General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA/CPRA).
---
1. Data Controller & Privacy Officer
- Organization / Brand: LanternRack (Craig Davignon)
- Jurisdiction: Ontario, Canada
- Privacy Officer Contact: privacy@croogserverdude.ca
- Mailing Address: LanternRack Media · Ontario, Canada
---
2. What Information We Collect & Why
We collect the minimum data necessary to operate this site and deliver requested technical content:
| Data Category | Examples | Purpose | Legal Basis (GDPR / PIPEDA) |
|---|---|---|---|
| Newsletter & Lead-Magnet Subscription Data | Email address, selected stack pack (arr-stack, monitoring, etc.), subscription status | Sending Double Opt-In confirmation, delivering requested docker-compose.yml bundles, and sending the Weekly Rack Digest | Explicit Consent (CASL s. 6 / GDPR Art. 6(1)(a) / PIPEDA Principle 3) |
| Consent Audit Log | ISO-8601 timestamp, consent policy version (2026-11-CASL-PIPEDA-GDPR-v1), signup page URL, cryptographic hash of IP | Demonstrating verifiable proof of opt-in consent as required by CASL and GDPR Art. 7(1) | Legal Obligation & Legitimate Interest (GDPR Art. 6(1)(c) & (f)) |
| Server & Security Logs | Request path, HTTP status, user-agent, truncated/hashed IP | Preventing DDoS abuse, webhook spam, and debugging broken guide links | Legitimate Interest (Infrastructure security) |
| Cookieless Analytics | Aggregate pageviews, referrer domain, device type (no cross-site tracking cookies) | Understanding which Docker guides and stack comparisons are most helpful | Legitimate Interest (Privacy-preserving first-party measurement) |
We do not sell, rent, broker, or trade your email address or personal data to third parties or data brokers.
---
3. Canada's Anti-Spam Legislation (CASL) Compliance
When you subscribe to receive a Stack Compose Pack or the Weekly Rack Digest:
- Express Opt-In Only: Our consent checkboxes are never pre-checked. You must affirmatively opt in.
- Double Opt-In Verification: We send a single transactional verification email containing a unique confirmation token. If you do not click the verification link within 7 days, your pending email record is automatically purged.
- Clear Sender Identification: Every commercial electronic message (CEM) identifies LanternRack, includes our contact email (
hello@croogserverdude.ca) and mailing address, and provides a 1-click Unsubscribe link (List-Unsubscribeheader + web page at /newsletter/unsubscribe/) that processes removals immediately.
---
4. Sub-Processors & Self-Hosted Infrastructure
Where possible, we run our own self-hosted stack on Canadian and North American/EU infrastructure:
- Static Site & CDN: Hugo static pages served via TLS with strict security headers.
- Automation & Email Delivery: Self-hosted n8n workflow automation and transactional SMTP / Listmonk newsletter delivery.
- Third-Party Video Embeds (Opt-In Only): Companion 9:16 shorts hosted on YouTube Shorts or TikTok are blocked from loading third-party tracking iframes unless you explicitly click play or enable embeds in our Cookie & Embed Preferences.
---
5. Data Retention Schedule
- Unconfirmed (Pending) Email Signups: Automatically deleted after 7 days if the Double Opt-In link is not clicked.
- Active Subscribers: Retained while you remain subscribed.
- Unsubscribed Addresses: Upon unsubscribing, your email is immediately moved to a cryptographic suppression list (or deleted upon request) so we never accidentally email you again, while retaining the minimal CASL consent/withdrawal audit log required by law.
- Web Server Security Logs: Rotated and purged every 14 days.
---
6. Your Privacy Rights (PIPEDA, GDPR, CCPA/CPRA)
Regardless of where you live, we extend the following rights to all visitors and subscribers:
- Right to Withdraw Consent / Unsubscribe: Use the 1-click link in any email or visit /newsletter/unsubscribe/ at any time.
- Right of Access & Portability: Request a copy of the personal data and consent audit record associated with your email address in JSON format.
- Right to Erasure ("Right to be Forgotten"): Request complete deletion of your subscriber record.
- Right to Rectification: Update your email address or subscription preferences.
- Non-Discrimination & Do-Not-Sell (CCPA): We do not sell or share personal information for cross-context behavioral advertising.
To exercise any of these rights, email privacy@croogserverdude.ca from the address in question. We respond within 48 hours (and always within the 30-day statutory window).