Legal
Privacy
What we collect is a short list, and this page is all of it.
Last updated Sep 13, 2026 · Shiftbase Labs Ltd
Who we are
Yearover is operated by Shiftbase Labs Ltd, a company registered in England and Wales (company number 17027574) at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We are the data controller. Write to hello@yearover.com about anything on this page.
What we collect, and why
| What | Why we have it | How long we keep it |
|---|---|---|
| Your email address | To send the confirmation email, and after you confirm, the digest and launch news. | Until you unsubscribe or ask us to delete it |
| Tickers you follow (optional) | They decide which companies we process first. | Same as your address |
| What you do (optional) | Investor, newsletter writer, student or other, so we know who the product is for. | Same as your address |
| Which form you signed up from | To see which part of the site actually works. | Same as your address |
| A hashed form of your IP address at sign-up and at confirmation | To stop bots and abuse, and to show a sign-up happened if someone says it didn’t. | With your record; short-term rate-limit entries are deleted after 48 hours |
| Aggregate page analytics | Page views, referrer and country, without cookies and without identifying you. | 6 months |
| Which actions you take on the site | Whether a form was sent, a sample or a diff view opened, a link to SEC.gov followed; counted without identifying you. | 12 months |
Everything we store about a reader
- Your email address
To send the confirmation email, and after you confirm, the digest and launch news.
Kept: Until you unsubscribe or ask us to delete it - Tickers you follow (optional)
They decide which companies we process first.
Kept: Same as your address - What you do (optional)
Investor, newsletter writer, student or other, so we know who the product is for.
Kept: Same as your address - Which form you signed up from
To see which part of the site actually works.
Kept: Same as your address - A hashed form of your IP address at sign-up and at confirmation
To stop bots and abuse, and to show a sign-up happened if someone says it didn’t.
Kept: With your record; short-term rate-limit entries are deleted after 48 hours - Aggregate page analytics
Page views, referrer and country, without cookies and without identifying you.
Kept: 6 months - Which actions you take on the site
Whether a form was sent, a sample or a diff view opened, a link to SEC.gov followed; counted without identifying you.
Kept: 12 months
What we do not collect
- No accounts or passwords: there is nothing to log into yet.
- No payment details. No payment is taken on this site.
- No tracking cookies, advertising pixels or cross-site tracking.
- No open or click tracking in our emails.
- We never sell your address or share it with anyone for their own purposes.
Our lawful bases
We send email on your consent: you ask for it on the form and confirm it by clicking the link in the first email, and you can withdraw it from any email. We rely on legitimate interests for keeping the service secure and free of abuse and for analytics that cannot identify you.
Who processes data for us
- Supabase: the database that holds your record (eu-west-1).
- Resend: sends our email (a United States company; our sending region is Asia Pacific, Tokyo).
- Cloudflare: the bot check on our form (Turnstile). The check runs in a Cloudflare frame that may set one short-lived technical cookie of its own for bot detection, which holds no identifier of yours and is not used to track anyone.
- Vercel: runs the website, measures page speed and counts actions on the site (United States); cookieless, no cross-site tracking.
- Umami Cloud: page analytics (United States); cookieless, no cross-site tracking.
Each acts only on our instructions under a written contract. Where data leaves the UK or EEA it does so under the UK International Data Transfer Addendum or the EU standard contractual clauses.
Your rights
You can ask for a copy of what we hold, have it corrected or deleted, take it elsewhere, object to a use, or withdraw your consent. One email to hello@yearover.com is enough and we answer within 30 days. If you are unhappy with how we handled it you can complain to the UK Information Commissioner’s Office, or to your own supervisory authority if you are in the EEA.
Unsubscribing and deletion
Every email carries a one-click unsubscribe. Unsubscribing stops the mail and leaves a record that you unsubscribed, so we do not email you again by accident. Ask us to delete instead and the whole record goes.
Children
Yearover is for adults. It is not directed at anyone under 18 and we do not knowingly collect their data.
Changes to this page
We date every change at the top of this page. If a change matters to you, we say so in an email rather than hoping you notice.