Privacy Policy

Privacy Policy

Version 1.0.1

Effective Date: October 8, 2026

This Privacy Policy explains how we collect, use, and share Personal Information when you visit the Site, use the Contact form or the Feedback form, download the Freeware or the Plugins, or make a payment to us. Bristlecone IT Services (“BITS,” “we,” “us”) is operated by Corey J. Mahler. This Privacy Policy replaces the earlier version posted at this address. Capitalized terms that are not defined here have the meanings given in our Terms of Service.

“Personal Information” means information that identifies, relates to, or could reasonably be linked to you.

Summary

  • We do not sell your Personal Information, we do not use it for advertising, and we run no advertising on the Site.
  • We collect what you send us through our forms, basic analytics through first-party cookies, and the technical information our service providers need to deliver and protect the Site.
  • Our analytics run without a consent prompt and do not respond to Do Not Track or Global Privacy Control signals. You can block them in your browser.
  • Stripe processes payments made directly to us. We do not store full card numbers.
  • Product privacy policies, such as the zDiary Privacy Policy, control for their Products.

This summary is for convenience. The full Privacy Policy below controls.

Scope and Product Privacy Policies

This Privacy Policy covers the Site and the Services, including the zDiary pages on the Site and the zDiary Beta Feedback form.

It does not cover Products that have their own Product Terms. The zDiary Privacy Policy (https://bristleconeit.com/zsuite/zdiary/privacy/) describes how the zDiary app handles your information, and it controls for the app. If this Privacy Policy conflicts with a product privacy policy, the product privacy policy controls for that Product.

The Plugins run on your own WordPress site. Bristlecone Markdown does not track you and does not “phone home.” Bristlecone Admin Styles serves its fonts from your own site and does not load fonts from a third-party font service. The Freeware runs on your own Mac. If you get a Plugin from WordPress.org or GitHub, those sites’ own privacy policies apply to that download.

Information We Collect

Information You Give Us

  • Contact form: your name, your email address, and your message.
  • Feedback form: the feedback type and your feedback. You may also choose to give your name, your email address, the app version or build, your iPhone model and iOS version, the area of the app your feedback is about, and whether it is OK to contact you about your feedback.
  • Mail: whatever you include in a letter you send to our mailing address.
  • Payments: the information you enter on Stripe’s payment page. See the Payments section below.

Information Collected Automatically

  • Form technical data. When you submit a form, it also sends the address of the page you submitted it from, the page that referred you to it, form and page identifiers, and a security token that helps block forged submissions. Each form also contains a hidden field that people do not see. If that field is filled in, we treat the submission as automated spam. This hidden field is the only spam protection on our forms; they do not use CAPTCHA. Our form software also records your IP address with your submission. That IP address is kept for up to 30 days and then anonymized.
  • Site analytics (WPMU DEV Analytics, based on Matomo). WPMU DEV Analytics is operated by WPMU DEV. When you load a page, your browser loads the analytics script from a content delivery network, BunnyCDN, which receives your IP address and browser information when it delivers the script. Your browser then sends WPMU DEV a page-view record. That record can include the page title and address, the referring page, browser information (such as browser type, version, and language), device and screen details, the time of your visit, your IP address, and a visitor ID stored in a first-party cookie. Whether your IP address is masked, and how long analytics data is kept, are governed by WPMU DEV’s practices. Those settings are controlled by WPMU DEV and are not visible to us. The Site does not show a consent prompt before analytics runs, and the analytics do not respond to Do Not Track or Global Privacy Control signals. See our Cookie Policy.
  • Cloudflare. All traffic to the Site passes through Cloudflare, which provides content delivery and security for the Site. Cloudflare processes your IP address, browser information, the address requested, and other request data to deliver, cache, and protect the Site. Cloudflare Web Analytics also collects page-load and performance measurements. Cloudflare Web Analytics does not use cookies. Your browser may also send Cloudflare reports about failed connections to the Site (called Network Error Logging), which help keep the Site reachable.
  • Hosting. The Site is hosted by WPMU DEV on servers in a Vultr data center. Our host may keep server logs that include your IP address, browser information, and the pages you request.
  • Security. We use Defender, a WordPress security plugin from WPMU DEV, to protect the Site. It logs IP addresses in connection with login lockouts and 404 lockouts, which block visitors after repeated failed login attempts or repeated requests for pages that do not exist. It also keeps an activity audit log of events on the Site, and it sends the Site’s firewall logs to WPMU DEV.
  • Downloads. The Freeware files are served from Cloudflare R2 through Cloudflare’s network. Cloudflare sees your IP address and other request data when you download them.
  • Emoji images. If your browser cannot display emoji on its own, WordPress may load emoji images from WordPress.org’s servers, which then receive your IP address and browser information. Most current browsers do not need these images.

Information From Others

  • Stripe. When you make a payment to us, Stripe tells us that the payment went through and gives us limited details about it, which may include your name, email address, billing address, the amount and date, and the card brand and last four digits.
  • Apple. For Apple-Billed Products, Apple processes the purchase. We do not receive your card details. See the product’s privacy policy for what we do receive.

Where Form Submissions Go

Our forms run on Forminator, a WordPress plugin. Contact form and Feedback form submissions are stored in the Site’s WordPress database on our web host’s servers. Contact form submissions stay in the Site’s WordPress dashboard. When someone submits the Feedback form, a notification of the submission is also sent to our company mailbox, which is hosted by Proton Mail.

How We Use Information

We use Personal Information to:

  • Read and respond to your messages and provide support.
  • Improve our Products using Feedback form submissions. We contact you about your feedback only if you check “OK to contact me about this feedback.”
  • Understand which pages people use, so we can improve the Site.
  • Protect the Site and the Services, prevent spam and abuse, and keep them working.
  • Process payments, send receipts, keep records, and handle payment disputes and the correction of billing errors.
  • Comply with the law, enforce our Terms of Service, and protect our rights and the rights of others.

We do not use Personal Information for advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Legal Bases for Processing (EEA, UK, and Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on these legal bases:

  • Contract: to process a payment you make or to provide something you ask for.
  • Legitimate interests: to respond to messages, improve the Site and the Products, measure Site use, and protect the Site. We weigh these interests against your rights.
  • Consent: to contact you about your feedback when you check the “OK to contact” box. You may withdraw this consent at any time.
  • Legal obligation: to keep records and respond to lawful requests.

How We Share Information

We do not sell your Personal Information, and we do not share it for cross-context behavioral advertising. We share it only as described below.

Service Providers

We use these service providers to run the Site and the Services. They process information to provide their services to us, under their own terms and privacy policies.

  • WPMU DEV: hosts the Site on Vultr infrastructure, provides the Site’s analytics (WPMU DEV Analytics), and receives the Site’s security firewall logs.
  • Cloudflare: provides content delivery and security for the Site, provides Cloudflare Web Analytics, and delivers Freeware downloads from Cloudflare R2. Cloudflare can see visitors’ IP addresses.
  • BunnyCDN: delivers the analytics script to your browser.
  • Proton Mail: hosts our company mailbox, which receives Feedback form notifications.
  • Stripe: processes payments made directly to us.

Email from the Site is sent through our web host’s own server mail. We do not use a third-party email delivery provider.

Other Sharing

  • Legal and safety reasons. We may disclose information if we believe in good faith that the law requires it, or that it is needed to protect the rights, property, or safety of BITS, our users, or others, or to prevent fraud or abuse.
  • Business transfers. If the business of BITS is transferred, including to a business entity formed to carry on the business of BITS, or as part of a merger, reorganization, or sale of assets, information may be transferred as part of that transaction and will remain subject to this Privacy Policy.
  • Future affiliated entities. We do not share Personal Information with any affiliated companies today. If BITS later forms or joins affiliated entities, we may share information with them under this Privacy Policy, and we will update this Privacy Policy when that happens.
  • With your consent. We may share information when you ask us to or agree to it.

Payments

Stripe processes payments made directly to us, such as Voluntary Contributions. Payments are processed in the name of Corey J. Mahler, as the individual operator of BITS. Your receipt or card statement may show “BITS,” “Bristlecone IT Services,” or the name of a BITS product as the descriptor. These charges are from us.

Stripe handles your card data. We do not store full card numbers. Stripe’s privacy policy governs how Stripe handles the information you give it.

Apple-Billed Products, such as zDiary subscriptions, are billed by Apple under the product’s own terms. Apple handles those payments, and we do not receive your card details.

Cookies and Analytics

The Site sets two first-party analytics cookies (_pk_id, about 13 months, and _pk_ses, 30 minutes) through WPMU DEV Analytics when you visit. It also sets a security cookie (wpdef_lockout_ followed by your IP address, 1 hour) only when a visitor is locked out, and a WordPress test cookie (wordpress_test_cookie, a session cookie) only on the login page. We do not use advertising cookies, and we do not track you across other websites for advertising. Our Cookie Policy (https://bristleconeit.com/cookie-policy/) explains the cookies we use and how to control them.

The Site does not show a cookie consent prompt, and we do not collect consent for analytics. Our analytics do not respond to Do Not Track or Global Privacy Control signals. Because we do not sell Personal Information or share it for advertising, there is no sale or sharing for these signals to stop. To limit analytics, use your browser’s cookie controls or a blocking extension, as described in our Cookie Policy.

How Long We Keep Information

  • Form submissions: Contact form and Feedback form submissions are kept in the Site’s WordPress database and deleted automatically after 24 months, unless we need them longer to resolve a dispute, prevent abuse, or comply with the law. IP addresses recorded with form submissions are kept for up to 30 days and then anonymized. A WordPress personal-data erasure request deletes matching form submissions.
  • Security logs: IP addresses logged for login and 404 lockouts are kept for 30 days. The activity audit log is kept for 6 months. Firewall logs sent to WPMU DEV are kept according to WPMU DEV’s practices.
  • Analytics: the visitor-ID cookie stays in your browser for about 13 months unless you delete it. Analytics data held by WPMU DEV is kept according to WPMU DEV’s practices.
  • Payment records: as long as needed for accounting, payment disputes, and legal obligations.
  • Cloudflare, BunnyCDN, and hosting data: according to those providers’ own retention practices.

Security

We use reasonable measures to protect Personal Information, including encrypted (HTTPS) connections to the Site, Cloudflare’s network protections, and a security plugin with a firewall and login lockouts. No method of transmission or storage is completely secure, so we cannot guarantee security. Please do not send sensitive information, such as passwords, payment card numbers, or government identification numbers, through our forms.

Children

The Site is not directed at children under 13, or under the higher age of digital consent required where they live. We do not knowingly collect Personal Information from children below that age. If you believe such a child has sent us Personal Information, contact us and we will delete it.

Your Choices and Rights

Your choices. You can block or delete cookies in your browser settings, or use a browser extension that blocks analytics, and the Site will still work. The Feedback form fields other than the feedback type and your feedback are optional. If you do not check “OK to contact,” we will not contact you about your feedback.

Your rights under applicable law. Depending on where you live, the law may give you rights over your Personal Information. These may include the right to:

  • Know what Personal Information we have about you and get a copy.
  • Correct inaccurate Personal Information.
  • Delete your Personal Information.
  • Object to a use of your Personal Information, or withdraw any consent you gave.
  • Receive your Personal Information in a portable format, restrict how we use it, or appeal our decision on your request.

We will honor the rights that applicable law gives you where you live.

Voluntary requests from anyone. If the law where you live does not give you these rights, you may still ask us for access to, or deletion of, your Personal Information. As a goodwill gesture, we may consider those requests. This is voluntary. It is not a promise or a legal obligation, and we may decline a request.

How to make a request. Use the Contact form or write to us at the address below. We may need to verify your identity before we act on a request. When we carry out a deletion request, the WordPress personal-data erasure process also deletes matching form submissions. For requests under applicable law, we will respond within the time the law requires. We will not discriminate against you for exercising your rights.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you may also complain to your local data protection authority.

International Users

BITS is based in the United States. The Site is hosted in the United States. Our service providers may process information in the United States and in other countries, where data protection laws may differ from those where you live. By using the Site, you understand that your information will be processed in the United States.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version at https://bristleconeit.com/privacy-policy/ and change the version number and the Effective Date. If a change is material, we will give reasonable notice on the Site before it takes effect.

Contact Us

Corey J. Mahler

PO Box 296

Townsend, TN 37882

Contact form: https://bristleconeit.com/contact/