Weekend Experiments

Privacy

Effective date: 8 Oct 2026.

Weekend Experiments is the site I run for parents. Kids do the experiments. I don't knowingly collect information from children. If you use a form, you're the adult. If a child sent something anyway, tell me on the contact form and I'll delete it.

What I keep

Mailing list. If you subscribe, I save your email, which form you used, and the time. The first time that address joins, I send a short welcome email, and I email myself the new address and which form it came from. The welcome email includes an unsubscribe link with a random token for that row, not your email. The row stays until you unsubscribe or ask me to delete it.

Questions. The contact form takes your email and your message, and your name if you type one. I save those, which form they came from, and the time. I email myself a copy so I can reply. Your email is the reply-to address on that copy.

Votes. One vote per browser. I set a single cookie, we_vote_token. It is a random id. Your name and email are not in it. Scripts on the page cannot read it. Your browser sends it back to this site, including when you arrive by clicking a link, and does not attach it to background requests from other sites. It lasts 120 days. It is only sent over HTTPS, except on a local development server. I store that id, the option you picked, which week's ballot it was, and the time. Your browser also remembers the week and the option under the local storage key we_vote, so the page can show your pick later. That saved pick stays on your device, in local storage, separate from the cookie.

The vote, unsubscribe (including the confirm link we email after you submit the form), newsletter, and contact endpoints look at your IP address only to slow a burst of clicks, 20 tries in 10 minutes. I keep those hits in memory and do not write the IP to the database.

Unsubscribe also removes that email from an old waitlist, if that table is still in the database. The site does not add anyone to that list.

Analytics

Vercel Analytics runs on every page. It does not set a cookie. Vercel identifies a visit with a hash of the request and drops that hash after a day. A page view can include the page address, the query string (Vercel filters some parameters before storing them), the referrer, a rough location down to a city, and the browser, operating system, and device type. Before that send, the script on this site drops an email parameter if the address has one. Other query strings are left as they are. The welcome email does not put your email in the unsubscribe link. An older link that still has your email in the address only opens the unsubscribe form; it does not remove you by itself. That email is not part of the page view.

I also send four events. None of them include your email, your name, or your message:

  • the experiment page you opened
  • the option you voted for, when that vote is new
  • that the mailing-list form went through, and which form
  • that a question was sent, and which form

Amazon

Some links leave this site for Amazon. Links to a product or a cart include my Amazon Associates tag, so a purchase can be credited to me. I don't send Amazon your email, your message, or your vote. After the click you are on Amazon, and Amazon may set its own cookies. I don't control those.

Who touches it

Neon holds the database: emails, messages, and votes. Resend sends the mail: the welcome note, the copy of your question, and the note to me when someone joins. Vercel hosts the site and runs the analytics. Amazon only enters the picture if you follow a link there.

I don't sell any of this, and I don't share it for ads.

Getting off the list, or deleting something

Unsubscribe at /unsubscribe. That deletes the email from the mailing list. It does not delete a question you already sent.

To ask me to delete an email, a message, or anything else tied to you, use the contact form on the About page. A vote is not tied to a name or an email, so that form cannot point me at your ballot. Clearing this site's data in your browser removes the cookie and the saved pick on your side. The public tally is a count, and it stays.

California, and Do Not Track

This page is the California Online Privacy Protection Act notice (CalOPPA), including how the site treats Do Not Track. The site ignores Do Not Track. I never check for that signal. If your browser sends one, the pages still load, a vote still sets the cookie, and analytics still runs.

If I change what I collect, I'll update this page and the date at the top.

Questions about any of this go through the contact form. I don't put a postal address on the site.