Last updated 2026-11-11 · Questions: billing@reloadingcalc.com
Short version. You give us one email address to start a trial. We use it to create your billing record at Stripe, to remember that your subscription is paid so the site can unlock the charts, and to send you billing notices. If you ask us to on the launch list, we also send you one note when the product leaves beta. That is all. Your card goes to Stripe and never touches our systems. Your calculations are not stored in a profile of you; one anonymous usage log line per calculation (caliber, bullet, powder, charge, barrel length, outcome — no email) is kept for 90 days to debug the service. Site statistics and a handful of named usage events are collected by our own self-hosted, cookieless Plausible server on a machine we own — not by any third party, and no event carries your email, your card, or the load you calculated. We do not sell, rent, broker, or advertise against you, and there is no tracking cookie on this site at all. To leave, cancel in the billing portal; to be forgotten, email us and we delete the row.
This policy covers https://reloadingcalc.com (the calculator, its static
pages, and the billing pages under /billing/) and the accounts created
through it. It does not cover other websites you visit from a link here.
The developer surfaces (/v1 API, /mcp MCP server) are not enabled —
they return 404 today. If they are switched on, §5 describes the additional
data they will handle, and a separate developer agreement applies to those
users.
Who is responsible. The Service is operated by Withywindle Farms, which is the controller of the personal data this policy describes and the party a customer contracts with under the consumer Terms. If a limited-liability company replaces it at or before launch, the name in this one section is what changes. The privacy contact is billing@reloadingcalc.com (§7, §13) — email only, no postal address.
| What | Where it lives | Why | How long |
|---|---|---|---|
| Your email address (the only personal identifier we hold) | Our subscription database (DynamoDB, AWS us-west-2), keyed by the lowercased address | To create your billing record, decide whether you may see paid results, and send billing notices | Until you ask us to delete it — see §7. There is no automatic expiry on this row . |
| Your launch-list address (only if you asked for the launch note) | Our launch-list database (DynamoDB, AWS us-west-2), keyed by the lowercased address, plus the page you joined from and the join date | To send you the single launch note when the product leaves beta — the only email beyond billing notices we will ever send | Until you ask us to delete it — see §7 |
Subscription state: status (none/trialing/active/past_due/canceled), Stripe subscription id, Stripe customer id, updated_at, and three Stripe event-id markers used to stop us emailing you the same notice twice |
Same database row | To answer "is this person entitled right now?" without trusting webhook timing | Same as the email row |
A signed session cookie, ibc_ent |
Your browser | To let the server see that your subscription is current so paid results load | 1 hour, re-minted each time your status is checked. Our server clears it when it has just told you that you are not entitled. "Sign out" removes the address your browser stored and stops status polling, but it cannot delete this cookie — page scripts cannot read or remove an HttpOnly cookie; it lapses within the hour on its own |
Convenience storage, in your browser's localStorage: ibc_email (so the site remembers the address to poll your status), ibc-stash (the components you picked and their last results), ibc-units (imperial/metric), ibc_returned (a one-time banner flag) |
Your device only. Nothing here is sent to us until you submit it. | To keep the calculator usable between visits | Until you clear site data or press "Sign out" (which removes ibc_email) |
| One usage log line per calculation | Our hosting provider's log store (Amazon CloudWatch Logs, us-west-2) | To answer "did anyone run a load, and what did they reach for?" and to debug failures | 90 days, then deleted by the provider automatically (production log-group retention is set to 90 days) |
| Aggregate page statistics and named usage events | Our own self-hosted Plausible server, stats.reloadingcalc.com (an EC2 instance in our AWS account, us-west-2) |
To know which pages and features get used, and where people stop on the free-to-trial path — every event name is listed below | Kept on our own server for as long as the site runs — there is no third party involved, and it is deleted within 30 days of a deletion request (§7) |
| Payment records | Stripe, our payment provider | Billing, receipts, taxes, fraud prevention | Stripe's own retention; we cannot delete Stripe's records for you and they will not be deleted just because ours are — see §7 |
If you use the load logbook, we store your saved loads on our server, keyed to a random ID — no name or email required on the free tier. Deleting a load removes it permanently, and emailing billing@ wipes everything tied to your device.
The analytics events, named one by one, because "aggregate counts" stopped being the whole answer when we wired the trial funnel. Each of these is a plain name, sent to our own Plausible server:
| Event | When it fires | What travels with it |
|---|---|---|
| page view | you open /, /data/, or /methodology.html |
the URL, referrer, and the coarse user-agent-derived device/browser/country Plausible derives |
simulate |
a calculation completes | one property: whether the session was paid or free. Never the caliber, bullet, powder, or charge |
paywall_shown |
the locked offer actually entered your viewport (an impression, not a page view), once per page load | nothing else |
upgrade_viewed |
a free calculation finished, so you met the paid ceiling | nothing else |
checkout_started |
Stripe handed back a checkout URL, immediately before the browser leaves our site | nothing else — the session id is not sent |
trial_started |
you came back from Stripe and our server confirmed the subscription is in trialing |
nothing else |
waitlist_join |
you submit the launch-list form on / or /data/ — only after our server confirmed it saved |
nothing else — the address itself goes only to our launch-list database, never to the stats server |
Three things about that list are worth saying out loud, because they are decisions and not accidents:
simulate./billing/ carry no analytics code at all, on
purpose. Stripe returns you to /billing/success?session_id=cs_…, and our
own stats server reporting that URL verbatim would hand it a session
identifier that maps to an email inside our Stripe account. So the conversion
is counted from the server-confirmed trialing state instead of from the
redirect page. Fewer bytes leaked, and a more honest count.That is the entire telemetry surface. There is no session replay, no heat map, no ad pixel, no A/B cookie, and no server-side join between an analytics event and your email.
What we do not collect: your name, postal or email-delivered address, phone
number, date of birth, password (there are no passwords), card number, expiry
date, or CVC. We have no analytics that identifies you, no advertising
networks, no social plugins, no chat widget, no web fonts, and no newsletter.
The only script loaded from another hostname is our own analytics server
(stats.reloadingcalc.com), which runs on a machine we own and provision — see
§6; there is no third-party script of any kind on this site. We do not use your
email for marketing: outside billing notices, the only email we ever send is
the single launch note you explicitly asked for on the launch list.
Card details are typed on Stripe's own checkout page
(checkout.stripe.com). This site never sees, transmits, or stores card data —
in payment-industry terms, we hold no PAN (no primary account number, no
expiry, no CVC) and have no card database, so there is no card data here to
breach. We do not receive it in our payment webhooks either: what comes back to
us is only opaque Stripe identifiers (customer id, subscription id), a status,
an amount due, and the email you gave us. Cancelling and updating a card happen
in the same Stripe-hosted billing portal — reached today from the account panel
on the calculator page. If you want the card data itself
handled, that is a request for Stripe; we can give you the pointer, not the
delete.
Because "we use a cookie" means different things, here is the whole of it.
ibc_ent. Purpose: functional — access control for paid
results. Not used for advertising, analytics, or cross-site tracking.HttpOnly (not readable by page scripts), SameSite=Lax,
Path=/, Secure (HTTPS only)./v1, /mcp) are enabledCurrently dark; disclosed now so that switching them on is not a surprise change of policy. When enabled, the API:
anon ip:<client-ip>),
stored in a DynamoDB table that has automatic expiry (end of UTC day plus a
two-day grace). The IP is used for rate-limiting, not profiling.We do not "share" in the sense of selling or handing your data to advertisers. We do send it to the infrastructure that makes the site work, each under its own provider terms:
| Processor | What they get | Why |
|---|---|---|
| Stripe, Inc. | your email, subscription/invoice state, and everything you type at checkout | payment processing, billing portal, receipts, fraud screening |
| Amazon Web Services (us-west-2) | hosting: the app (Lambda), your subscription row (DynamoDB), usage log lines (CloudWatch Logs, 90 days), our infrastructure state | running the site |
| Amazon SES | your email address + the contents of billing notices | sending those notices (sender billing@reloadingcalc.com) |
| Our own Plausible CE server — a machine we own, not a vendor | page URL, referrer, a coarse device/browser/country derived from the user agent, and the event names listed in §2 — nothing that identifies you, and never an email, a load, a price, or a cart | aggregate traffic counts and funnel counts |
No other recipient. We do not respond to data requests for advertising, we do not take part in ad exchanges or data-broker feeds, and if we ever had to disclose data to a lawful request we would tell you unless legally forbidden.
Leave (stop billing): cancel in the Stripe-hosted billing portal — the working door to it today is the account panel on the calculator page (enter your email, press "Manage subscription"). Cancelling there stops all future charges; because the portal ends a subscription at the close of the period you already paid for, your access runs to that date and then stops, and the session cookie clears itself within the hour after that.
Be forgotten (our systems): email billing@reloadingcalc.com from the address in question and ask. We will delete your subscription row and, if you joined the launch list, that row as well — that removes your email, status, and Stripe identifiers from our database. There is no self-service delete button today; deletion is a human action on request, completed within 30 days of your message.
What deletion here does not do: Stripe keeps its own records (invoices, receipts) as its terms and financial law require, and we cannot erase those; 90-day log lines age out on their own and cannot be picked out of the stream retroactively; aggregate Plausible counts contain nothing about you as a person. Correction: if your email is wrong or stale, tell us and we will move or drop the row.
Access: you can see most of what we hold about you already — your email, your status, and your Stripe ids are returned by the status call the site makes and shown on the billing screen. For a copy in writing, ask.
SecureString parameters and injected at
runtime; they never sit in the source repository, and the deployed
infrastructure marks them sensitive so plan output shows redacted values.What we do not claim: any certification, audit, or compliance program (no SOC 2, no ISO 27001, no PCI level asserted); a backup guarantee (the analytics host's database is not yet backed up off-instance, so its history can be lost — nothing personal, only aggregate counts); or that any system is unbreakable. If we ever have a breach of personal information, we'll email affected subscribers within 72 hours of confirming it, with what was exposed, what we've done, and what to do next. Launch-notice emails count too. We keep very little data — if a breach can't affect you, we'll say so.
The browser opt-out signals (DNT, GPC) are not acted on, because there is
nothing here to opt out of: no cross-site or third-party tracking, no
advertising cookies, no sale of data, no personalized analytics.
The Service is a tool about reloading ammunition, which in the United States means purchasing and possessing smokeless propellant and primers — items with their own age and transport rules. The Service is not directed at children. You must be at least 18 years old (or the age of majority where you live, if higher) to subscribe. We say the floor rather than gate it: the site performs no age verification, and 18 is the age at which smokeless propellant is generally sold at US retail.
Our servers and our log store are in the United States (AWS region us-west-2, US West — Oregon); our payment provider is a US company. Anyone outside the US using the Service is having their data processed there, under the providers' own terms. This policy and any dispute arising under it are governed by the laws of the State of Oregon, USA (venue as set out in the consumer Terms §15). This paragraph remains a location statement, not a legal-framework claim — no adequacy, SCC, or UK/EU transfer mechanism is asserted, and if we market to EU/UK users someone with a licence needs to decide what, if anything, we owe them.
We will change this page as the system changes, and this page is the record: it will not be quietly edited to look like it always said the current truth. The "Last updated" date below changes with every revision, material revisions are also announced on the site and by email to subscribers, and old versions are kept in the repository history. A material change that reduces privacy protection takes effect no sooner than 14 days after we email subscribers and put a notice on the site; a change that increases protection takes effect immediately.
Last updated: 2026-11-11.
Privacy questions, deletion, or a copy of your data: email
billing@reloadingcalc.com. Contact is email only — no postal address is
published — and this page and /data/ must name the same address.