Privacy Policy
Effective July 16, 2026. Last updated July 16, 2026.
The short version
We collect the least we can get away with, we do not sell it, and we do not run you through a drip campaign. If you want your data gone, email privacy@driftboundmedia.com and it is gone. No form, no retention specialist, no “we’re sad to see you go” sequence.
The long version exists because different sites do different things, and one of them is a privacy tool that would be embarrassing to be vague about. If you are in the 1% who reads these, you deserve better than boilerplate. Hello. There are jokes.
Who we are
DriftBound Media, LLC is a Washington limited liability company running a marketing and AI consulting practice out of Ellensburg, Washington. Our main site is driftboundmedia.com.
We also build and run software. This policy covers all of it:
| Site | What it is |
|---|---|
| driftboundmedia.com | The consulting practice, the blog, and two free tools |
| kippwit.com | A browser-based tool that strips personal details out of spreadsheets |
| storyopolis.app | A content production platform |
| studyier.com | A study platform built on spaced repetition |
This policy lives at driftboundmedia.com/privacy-policy and the other three sites link here rather than keeping their own copies, which would drift out of sync within a year and contradict each other by the second. One document, one truth, one place to fix it.
Where the sites behave differently, we say so by name below. “We” means DriftBound Media, LLC.
What each site collects
driftboundmedia.com
If you just read things, our host records standard server logs: IP address, browser type, pages requested, timestamps. This is how web servers have worked since roughly forever, and it is how we notice when the site is on fire.
If you leave a comment, we collect what you type into the comment form, plus your IP address and browser user agent string, which helps catch spam. An anonymized string created from your email address (a hash) may be sent to the Gravatar service to see whether you use it; their privacy policy is at automattic.com/privacy. If you have a Gravatar, your profile picture becomes visible next to your approved comment. If you do not, nothing happens, which is the correct amount of drama for a comment form.
If you use the AI Policy Builder, we collect your name, email, organization name, the answers you select, and a copy of the policy it generates. Worth knowing: the Policy Builder writes your document in your own browser. Your answers are not sent to any AI model. The tool is a very opinionated set of if-statements wearing a nice coat.
If you use the Process Map, we collect your name, email, business name, your thirteen answers, and the report produced. Your answers do get sent to an AI provider (Google Gemini or Anthropic Claude, depending on how we have it configured that week) to generate the report. Your name and email do not go with them. The tool also saves your progress in your own browser (localStorage) so you can leave mid-map and come back; that stays on your machine, is cleared when the report generates, and you can nuke it any time by clearing your browser data.
Both tools ask for an email because we would like the chance to earn your business. That is the whole reason. We may email you once about what you generated. If that once is one too many, say so and we will stop.
kippwit.com
This is the short section.
Kippwit anonymizes spreadsheets. It does that work entirely inside your browser. Your file is never uploaded, never transmitted, never stored on our servers, and never seen by us, because there is no “us” in the loop. We could not hand your data to anyone if a court asked nicely, because we do not have it.
What we do get: standard server logs when your browser loads the page, and Google Analytics, which counts visits and tells us which pages people actually read.
Yes, we notice the irony of running analytics on a privacy tool. Here is the distinction that matters: Analytics sees that a browser loaded a page. It does not see your spreadsheet, because your spreadsheet never leaves your machine. A privacy tool that quietly phoned home with your data would be a special kind of insult. This one does not.
storyopolis.app
Storyopolis needs an account, so it collects more.
- Account data: your name, email, password (stored hashed, never in plain text, never visible to us), and organization details you enter.
- Content you create: briefs, transcripts, uploaded files, generated drafts, and your stored voice and style preferences.
- Usage data: what you generated and when, which is how billing and quotas work.
Your content is processed by AI models (Google Gemini and Anthropic Claude) to produce the output you asked for, which is the entire point of the product.
We do not use your content to train AI models, and we do not read your drafts for fun. Your material is yours.
studyier.com
- Account data: name, email, password (hashed).
- Study data: your decks, cards, answers, confidence ratings, review history, and target grade.
- Source material you provide for AI deck generation, which is sent to Google Gemini or Anthropic Claude to produce the cards.
- Payment data when you owe the Success Jar: handled by Stripe, who collects your card details directly. We never see or store your card number. We see that a payment happened and how much. Stripe’s privacy policy is at stripe.com/privacy.
Your study data is what makes spaced repetition work; the schedule depends on knowing what you got wrong last Tuesday. It is not sold, and it is not shared with your school unless you explicitly connect one.
Studyier is built for college students and adult learners, and you must be 18 or older to have an account. See Children and age below.
Media
If you upload images to any of our sites, avoid uploading images with embedded location data (EXIF GPS). Visitors can download images and extract that data. We do not do this, but the internet contains people who would, and your camera has been quietly writing your coordinates into your photos this whole time.
Cookies
If you leave a comment, you may opt in to saving your name, email, and website in cookies, so you do not retype them next time. These last one year.
If you visit our login page, we set a temporary cookie to check whether your browser accepts cookies. It contains no personal data and vanishes when you close your browser.
When you log in, we set cookies to remember your login and screen display choices. Login cookies last two days, screen options a year. Pick “Remember Me” and your login persists two weeks. Log out and the login cookies are removed.
If you edit or publish an article (which means you work here), an extra cookie stores the post ID of the thing you just edited. No personal data. Expires after a day.
Storyopolis and Studyier set session cookies to keep you logged in. Without them the apps do not work, which is why there is no “reject” button for these specific ones: it would be a button that logs you out.
Google Analytics sets cookies to count visitors and page views across our sites. We use Google Analytics 4, which does not log or store IP addresses. We have not turned on its advertising features, so it is counting readers, not building a profile to sell you shoes. If you would rather not be counted, Google publishes a browser add-on that opts you out everywhere at once: tools.google.com/dlpage/gaoptout. Google’s privacy policy: policies.google.com/privacy.
We do not run advertising or retargeting cookies, because we do not run ads.
Embedded content
Articles on our sites may include embedded content: videos, images, posts from elsewhere. Embedded content from another website behaves exactly as if you had visited that site directly. Those sites may collect data about you, set cookies, embed third-party tracking, and monitor your interaction with the embedded thing, including if you are logged into them. We have no control over any of it. It is the oldest trade-off on the web: you get the video, they get to watch you watch it.
Our sites also load typefaces from Google Fonts, which means your browser talks to Google’s servers and your IP address is visible to them as part of that request.
AI processing, specifically
We build AI tools, so we owe you specifics rather than a shrug.
| Tool | Does it send your input to an AI provider? |
|---|---|
| Kippwit | No. Everything runs in your browser. |
| AI Policy Builder | No. Generated locally in your browser. |
| Process Map | Yes. Your thirteen answers go to Google Gemini or Anthropic Claude. Your name and email are not included. |
| Storyopolis | Yes. Your briefs, transcripts, and uploads are processed by Google Gemini or Anthropic Claude to produce your content. |
| Studyier | Yes, when you use AI deck generation. The source material you provide is sent to Google Gemini or Anthropic Claude. |
Those providers process the data under their own terms and privacy policies, linked in the table below. We use their standard API tiers, which do not train models on API inputs.
Who we share your data with
Nobody buys it, because it is not for sale. It touches these companies because software has to run somewhere:
| Who | Why | Their policy |
|---|---|---|
| Bluehost | Hosts the websites and some of our email | bluehost.com/hosting/info/privacy-policy |
| Google Cloud and Firebase | Run Storyopolis and Studyier | policies.google.com/privacy |
| Google (Gemini API) | Generates AI output where noted above | policies.google.com/privacy |
| Anthropic (Claude API) | Generates AI output where noted above | anthropic.com/legal/privacy |
| Google Analytics | Counts visits and page views | policies.google.com/privacy |
| Google (Gmail) | Sends and receives our mail | policies.google.com/privacy |
| Resend | Sends transactional email, like your tool reports | resend.com/legal/privacy-policy |
| Stripe | Takes payments for Studyier | stripe.com/privacy |
| Automattic (Gravatar) | Comment avatars | automattic.com/privacy |
We will also hand over data if a law requires it, which so far has happened zero times.
If you request a password reset, your IP address is included in the reset email. This is a WordPress thing, and it is in there so you can tell whether the reset was you.
How long we keep things
- Server logs: no more than 120 days.
- Comments and their metadata: indefinitely, so follow-up comments from the same person get approved automatically instead of sitting in a moderation queue.
- Registered user profiles: as long as the account exists. Users can see, edit, or delete their own information any time, except the username, which is load-bearing.
- Policy Builder and Process Map leads: until you ask us to delete them, or until they are old enough that pretending we might still call would be delusional. We review annually.
- Storyopolis and Studyier account data: while your account is active. Delete your account and we delete the data within 30 days, minus anything we are legally required to keep, like payment records.
Your rights
If you are in the EU or UK, the GDPR gives you the right to access, correct, delete, restrict, port, and object to our processing of your data. Our legal bases are: consent (comments, the free tools, analytics, marketing email), contract (running Storyopolis and Studyier for people who signed up), and legitimate interests (spam prevention, security, keeping the servers upright).
If you are in California, the CCPA and CPRA give you the right to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information as those laws define it, so the opt-out is already the permanent setting.
If you are anywhere else, you have these rights too, because running one honest process is simpler than running several and hoping we sorted you into the right bucket.
If you have an account or have left comments, you can request an exported file of the personal data we hold about you, including anything you have given us. You can also request that we erase it, excluding data we are obliged to keep for administrative, legal, or security purposes.
To exercise any of this: email privacy@driftboundmedia.com. A human reads it, and we will respond within 30 days, usually far sooner because the queue is not long.
Children and age
Studyier is built for college students and adult learners. You must be 18 or older to create a Studyier account, and we do not knowingly collect information from anyone younger.
None of our sites are directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us information, email privacy@driftboundmedia.com and we will delete it.
Security
Passwords are hashed. Traffic is encrypted in transit (HTTPS). Access to production data is limited to people who need it, which is currently a very small number of people, one of whom is writing this sentence.
No system is perfectly secure, and any privacy policy claiming otherwise is lying. If something goes wrong, we will tell you what happened, what was affected, and what we are doing about it, without the phrase “an abundance of caution.”
Where your data lives
Our servers and service providers are primarily in the United States. If you are outside the US, your data is transferred there and processed under US law. Where required, transfers rely on Standard Contractual Clauses or an equivalent mechanism through the providers listed above. Several of them, including Resend, are certified under the EU-US Data Privacy Framework.
Changes
We will update this policy when what we do changes. The date at the top will move. For anything significant, account holders get an email rather than a silent edit and a hope that nobody diffs it.
Contact
Questions, requests, deletions, or a correction to something we got wrong here: privacy@driftboundmedia.com
DriftBound Media, LLC 522 W. Riverside Ave, Ste N Spokane, WA 99201
Thanks for reading to the end. Statistically, you are alone. There is no prize, which is itself a kind of prize: we did not put a lead capture form down here.