Privacy policy

Sharp in Five is run by Sebastián Araos, who decides how your personal data is used (the "controller"). For any question or request about your data, write to hola@sebastianaraos.com.

• When you subscribe: your email address, the topics you get (all of them to start with, until you narrow them), how you found us and, if a reader invited you, their referral code.
• If you sign in with Google: Google shares your name, email address and profile picture, and we store them with your account. We don't use your name or picture for anything.
• If you arrive from an ad or a tagged link: the campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content and utm_term), Meta's click ID (fbclid) and when you clicked. We save them with your subscription to count how many readers each campaign brings.
• The 1-minute check at /start: your answers (your role, how often you use AI, which tools, how big the gap feels, your goal, your topics and whether you want a course), and the AI level and course we recommend from them.
• Your preferences and activity: your topics, the keywords you ask us to watch, whether emails are on, the courses you join and your answers to their lessons, the stories you like or dislike, the suggestions you send us and the briefs you open on the site.
• Email activity: our email provider tells us when an email is delivered, opened, bounces or is marked as spam. Links in the brief pass through our site, so we know which story you clicked.
• Signup steps: a random ID in your browser lets us count how many visitors reach each step of signing up. It isn't linked to you until the step where you subscribe.
• Ad measurement, only where allowed (see Cookies): Meta's pixel receives the address of the pages you visit, plus an event when you subscribe and when you open the playbook checkout. When your subscription is confirmed, our server also sends Meta your email address scrambled with SHA-256 (a one-way code, not the address itself), a scrambled version of your subscriber ID, your IP address and browser details, Meta's _fbp and _fbc cookies or the click ID, the page and the time. This tells Meta that one of its ads led to a signup.
• Newsletter recommendations (SparkLoop): right after you subscribe, we may show you other free newsletters suggested by SparkLoop. To choose them, SparkLoop's script on that page gets your browser details, an identifier it derives from your browser and the campaign tags of the link you arrived from, but not your email address. If you tick some and press Subscribe, your email address is shared with SparkLoop and with the newsletters you picked, which subscribe you, and SparkLoop may pay us for the recommendation. We save which newsletters you picked.
• If you buy the playbook: checkout runs on Stripe, which collects your payment details. We receive what Stripe shares with sellers, such as your name, email address, country and what you bought, linked to your subscription. We never see your full card number.
• Technical data: our hosting providers handle your IP address and browser details to serve and protect the site. We use the country your IP address points to only to decide whether to ask for cookie consent, and we don't store it.

• Sending what you signed up for. The daily brief, the Sunday Edition, the courses you join, the welcome email and your account and preferences. Legal basis: providing the service you asked for (article 6(1)(b) GDPR).
• Tailoring and improving the brief. Your topics and keywords shape what the brief covers, and your clicks, likes and dislikes rank the stories you see when you read on the site. Opens, clicks, signup steps, feedback and suggestions show us what works. Legal basis: our legitimate interest in running a newsletter people find useful (article 6(1)(f)). You can object at any time.
• Never emailing people who said no. We keep the addresses that unsubscribed, bounced or reported spam on a do-not-email list. Legal basis: legitimate interest.
• Measuring our ads. In the EU, the EEA, the UK and Switzerland, the Meta pixel and the signup event we send Meta only run if you click Accept (consent, article 6(1)(a)). Elsewhere they run unless you click Reject (legitimate interest in knowing which ads work). Counting signups per campaign with the tags saved with your subscription stays with us and relies on legitimate interest.
• Recommending other newsletters. Showing SparkLoop's suggestions relies on our legitimate interest in funding a free newsletter (article 6(1)(f)); you can object. Your email address only goes to SparkLoop and to another newsletter if you tick it yourself and press Subscribe (consent, article 6(1)(a)).
• Selling the playbook. Processing the purchase and keeping accounting records. Legal basis: the contract, and the legal duty to keep tax records (article 6(1)(c)).

We don't sell your data, and we don't use it to make decisions with legal effects on you.

These providers process data on our behalf, only to provide their service:

• Lovable builds and hosts the app, and runs the Google sign-in, the email-sending connection and the AI connection.
• Supabase stores the database and user accounts.
• Cloudflare runs the network the site is served from, so it sees IP addresses, and tells us your country.
• Resend sends our emails and reports deliveries, opens, bounces and spam reports.
• Google provides Sign in with Google if you use it, and Google Fonts: your browser loads the site's fonts from Google's servers, so Google sees your IP address.
• AI models (Google Gemini through Lovable, with OpenRouter or Google directly as backups) write the brief from news articles. When we plan coverage they also get the text of reader suggestions, never your email address or account.

These companies also use the data under their own privacy policies:

• Meta receives the ad-measurement data described above and also uses it under its own privacy policy.
• SparkLoop runs the newsletter recommendations described above under its own privacy policy. Each newsletter you pick gets your email address and uses it under its own policy.
• Stripe processes payments under its own privacy policy.

Some of these providers process data outside the EU and the EEA, mainly in the United States. When they do, we rely on the EU–US Data Privacy Framework for providers certified under it, or on the European Commission's standard contractual clauses.

• Your subscription: while you're subscribed. If you unsubscribe, emails stop right away. We keep your address on the do-not-email list so you're never emailed by mistake, and the rest of your record until you ask us to delete it. Write to us and we'll erase everything except that do-not-email entry.
• Story ranking on the site: uses your clicks, likes and dislikes from the last 60 days.
• In your browser: signup progress for up to 24 hours, ad campaign tags for up to 7 days, your cookie choice for 6 months (then we ask again), and the signup-steps ID until you clear your browser's storage. Meta's _fbp and _fbc cookies last up to 90 days.
• Purchases: as long as tax law requires us to keep the records.

• Needed for the site to work: your sign-in session, if you sign in; your cookie choice; and the signup progress that carries your subscription across the sign-in link.
• First-party measurement: the random signup-steps ID and the campaign tags of the link you arrived from. They stay with us.
• Meta pixel (_fbp, _fbc): only after you click Accept in the EU, the EEA, the UK and Switzerland; elsewhere unless you click Reject. It never loads on pages whose address carries a private link.
• SparkLoop's script: loads only on the step right after you subscribe, to choose the newsletters it suggests, and may store an identifier in your browser or derive one from it.

You can change your choice at any time: open cookie settings. If you reject after accepting, the pixel stops and its cookies are deleted.

You can ask us to see the data we hold about you, correct it, delete it, limit how we use it, or send it to you in a portable format. You can also object to our use of it, including for tailoring the brief and measuring ads, and withdraw your consent at any time without affecting what happened before. Write to hola@sebastianaraos.com and we'll answer within one month.

If you think we've handled your data wrongly, you can complain to the Spanish data protection authority, the AEPD, or to the authority where you live.

Every email has an unsubscribe link at the bottom. The same emails link to your preferences, where you can turn emails off or change your topics. You can also write to hola@sebastianaraos.com.

Sharp in Five is written for people at work and isn't meant for anyone under 16.

When we change this policy we update the date at the top. If a change matters for how we use your data, we'll tell subscribers by email before it applies.

Back to Sharp in Five