Privacy Policy

Our Privacy-First Approach

Laksa is designed with privacy in mind. On a site’s pages we count what is read, not who reads it: we don’t build behavioral profiles, we don’t track you across sites, and we don’t sell your data to advertisers. Email and personal links work differently, and are described below.

Key Principles:

• Content-focused analytics: On a site’s pages we measure how content performs, not how individuals behave
• Minimal data collection: We only collect what’s necessary to provide our services
• No cross-site tracking: Your activity stays private to each site
• No advertising network: We don’t participate in ad tracking ecosystems
• You can ask: Email us for a copy of your data, a correction, or its deletion

This policy explains what data we do collect and how we use it.

Introduction

Laksa is a content management and newsletter platform operated by Geodica Ltd. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our services.

Information We Collect

Account Information

When you create an account on Laksa to run a site, we collect:

• Email address
• Name, and any profile details you add (bio, website, social links)
• Password, if you set one (stored as a one-way bcrypt hash, never in readable form)
• Account settings
• When you last signed in, and how many times you have

Newsletter Subscription Information

When you subscribe to a newsletter on a Laksa-powered site:

• Email address
• When you subscribed, when you confirmed and, if you do, when you unsubscribed

You sign in with a link we email you; there is no password.

Purchases

If you buy a course on a site that sells one, we keep your email address, what you bought, the amount, and Stripe’s reference for the payment, so that you can reach what you bought. Stripe takes the payment; we never see your card details.

Counting What Is Read

On a site’s pages, Laksa counts content, not people. We count page views, link clicks and votes. Each count records the page or link and the time, and nothing that identifies you: no IP address, no browser details and no referrer.

Vote Deduplication: If you vote on a post, we set one cookie, __Host-laksa_voter_id: a random identifier, kept with your votes on that site so that each counts once. It lasts a year and is not used for anything else.

Personal Links: If a site sends you a personal link, for example to a CV, it records views through that link as yours.

Your Connection

Like any website, ours sees the IP address each request comes from. We use it only while handling the request, to limit abuse, and do not store it with anything we record.

How We Use Your Information

We use the collected information to:

• Provide Services: Deliver newsletters, manage subscriptions, and display content
• Improve Content: Help content creators understand what resonates with their audience
• Communicate: Send transactional emails (subscription confirmations, sign-in links, notifications)
• Security: Detect and prevent fraud, abuse, and security incidents
• Compliance: Meet legal obligations and enforce our Terms of Use

We do not use your information for:

• Behavioral advertising
• Cross-site user tracking
• Building detailed user profiles
• Selling or renting to third parties

Email Tracking

Our email provider, MailerSend, sends our email for us, and tracks it. Each newsletter issue carries a tiny image and links that pass through MailerSend on their way, so that MailerSend records when the issue is opened and which of its links are clicked. That record is kept by MailerSend, in our account with it, and can include the email program or device you used and your approximate location.

Each newsletter issue also carries Laksa’s own tiny image and links, which pass through us, so that we can tell whether you opened it and whether you clicked a link in it. We keep the time you first opened each issue and the time you first clicked in it, with your subscription, and the site’s owner can see them.

MailerSend tracks the other emails we send, such as sign-in links and subscription confirmations, in the same way.

Tracking is on for every newsletter. If your email program does not load images, an open cannot be recorded.

Data We Deliberately Don’t Collect

As part of our privacy-by-design philosophy:

• No behavioral profiles: We don’t build profiles of individual user interests or behavior
• No cross-site tracking: We don’t track users across different Laksa-powered sites
• No advertising identifiers: We don’t use or support third-party advertising tracking
• No location tracking: We do not work out where you are (MailerSend’s record of an email, described above, can include your approximate location)
• No browsing history: We record that a page was viewed, never who viewed it or for how long (except a personal link, above)

Data Sharing and Disclosure

We do not sell your personal information. We may share data in these limited circumstances:

• Service Providers: Third-party services that help us operate Laksa (hosting, email delivery, payments). See our Service Providers page for the current list and what each receives.
• Gravatar: When you are signed in, your browser asks Gravatar (Automattic) for your profile picture, which sends it a hash of your email address.
• Site Owners: Content creators can see aggregate statistics and subscriber lists for their sites. They can see newsletter opens and clicks tied to email addresses, but cannot access other sites’ data.
• Legal Requirements: When required by law, court order, or government request
• Business Transfers: In the event of a merger, acquisition, or sale of assets

Your Rights

GDPR Rights (European Users)

If you are in the EU/EEA, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data (“right to be forgotten”)
• Restriction: Limit how we process your data
• Portability: Receive your data in a machine-readable format
• Object: Object to processing based on legitimate interests

All Users

Regardless of location, you can:

• Unsubscribe: Use the unsubscribe link in any newsletter
• Manage Subscriptions: View and manage your subscriptions on a site at /account/subscriptions
• Get a Copy of Your Data: Email us and we will send it to you
• Delete Your Data: Email us and we will delete it

To exercise any of these rights, email privacy@geodica.com.

Data Retention

We retain your information for as long as:

• Your account is active
• Needed to provide services
• Required for legal, tax, or accounting purposes

Newsletter Opens and Clicks: Laksa’s own record is kept for as long as the site keeps that issue. MailerSend’s record of each email is kept under MailerSend’s own retention. Ask us and we will delete what we hold.

Unsubscribed Users: We keep a record that you unsubscribed, so that we do not email you again unless you resubscribe.

Counts of What Is Read: these hold nothing that identifies you, so they are kept as the site’s statistics.

Cookies

A page you simply read sets no cookie. Laksa sets at most three, each needed for something you are doing:

• __Host-laksa_session: set on pages with a form, and when you subscribe, sign in or manage your subscriptions. It keeps the site secure, by protecting its forms against forgery, and keeps you signed in while you use it. It is deleted when you close your browser.
• __Host-laksa_voter_id: set only if you vote on a post, as described above.
• __Host-laksa_public_remember: set only if you choose to stay signed in when you sign in. It keeps you signed in to that site, and no other, until you sign out, for up to a year after your last visit.

Your browser may also keep, on your own device, your light or dark theme choice and whether you have dismissed a notice. These are never sent to us.

We do not use:

• Analytics cookies
• Advertising cookies
• Cross-site tracking cookies

Children’s Privacy

Laksa is not intended for users under 16 years of age. We do not knowingly collect information from children. If you believe we have collected information from a child, please contact us immediately.

Security

We protect your information with:

• Encrypted data transmission (HTTPS/TLS)
• One-way hashed password storage (bcrypt)
• Passwordless sign-in links for subscribers, and API keys stored only as hashes
• Regular updates to the software we run

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

International Data Transfers

Laksa is operated from the United Kingdom, and the application runs in London. Some of our service providers process data outside the UK, including in the United States.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we update the “updated” date and version number and post the new version here, and for significant changes we may also email registered users.

Your continued use of Laksa after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

Privacy Inquiries: privacy@geodica.com General Support: help@laksa.io

Mail: Geodica Ltd The London (W1W 5PF) Office 5th Floor 167-169 Great Portland Street London, W1W 5PF United Kingdom

Company Registration: 09960797

This policy is effective as of September 25, 2026.