Privacy policy
What we collect, how we use it, and your rights. Last updated 1 September 2026.
What we collect
When you subscribe, we collect:
- Your email address — required to deliver the newsletter.
- Standard server access logs (IP address, user agent, timestamp) — kept by our hosting provider, Vercel, for security and abuse prevention.
- Email engagement events from our email delivery provider, Postmark — opens, clicks, bounces, and unsubscribes. We use aggregate engagement to understand whether the newsletter is reaching readers and to clean dead addresses.
- Advertising measurement data — X's web pixel receives page and device information such as the page URL, referrer, browser, IP address, and an X click identifier (
twclid) when present. When a new subscription succeeds, we also send X a one-way SHA-256 hash of the normalized email address and conversion metadata so X can attribute the signup to an ad. We do not send the raw email address to X.
We do not ask for your name, location, profession, or any other personal information.
How we use it
- To send you the weekly newsletter.
- To detect and remove dead addresses (hard bounces, spam complaints).
- To improve future issues based on aggregate open and click data — never individual behavior.
- To measure newsletter subscriptions attributable to our X advertising campaigns, prevent duplicate conversion counts, and improve campaign performance.
We do not sell your email address or provide your raw email address to advertisers. X receives the limited measurement data described above when its advertising pixel and Conversion API are active.
Who we share it with (sub-processors)
To run this newsletter we rely on a small set of vendors, who each receive only the data they need to do their job:
- Postmark (Wildbit, LLC) — email delivery. Stores your email address and engagement events.
- Upstash — encrypted Redis storage for the subscriber list.
- Vercel — web hosting and serverless functions. Receives standard request metadata.
- xAI — provides the Grok language model used to draft each issue. xAI does not receive subscriber emails or any personal information about readers — only the public news content we synthesize.
- Plausible Analytics — cookieless, privacy-friendly web analytics on the public site. Receives aggregate page-view data only; no personal identifiers, no cross-site tracking.
- X Corp. — advertising measurement and conversion attribution through the X web pixel and Conversion API. See X's privacy policy.
Cookies
Plausible Analytics is cookieless and measures aggregate traffic without cross-site tracking. The X web pixel may use cookies or similar technologies for advertising measurement. If an X ad link includes a twclid, ThaiOutlook stores that identifier in your browser's local storage for up to 30 days so a later subscription can be attributed correctly. You can clear or block this storage through your browser settings. A separate session cookie is set on /admin when the operator signs in; it is not used for advertising.
Your rights
- Unsubscribe at any time. Every issue has a one-click unsubscribe link in the footer. You can also email us.
- Request deletion. Email us and we will remove your address from our subscriber list and Postmark suppression records on request.
- Access. If you'd like confirmation of the subscriber information we have on file, email us.
Children
ThaiOutlook is intended for adult readers. We do not knowingly collect data from anyone under 16.
Changes to this policy
If we materially change how we handle subscriber data, we will note the change here and, where appropriate, in the newsletter itself. Routine updates (vendor changes, wording fixes) will be reflected in the "Last updated" date above.
Contact
Privacy questions: contact us.