Privacy
The plain version.
Last updated: 16 September 2026 (Plan it: asks are now kept, redacted and unlinked to you, for 12 months, to decide which guides to write; Voyage AI added as an embedding provider; guides written from retrieved passages).
howtogetaito.com is published by Adapt Progress Evolve Limited, registered in England and Wales, company no. 10047328, registered office 5 Brayford Square, London E1 0SG, VAT GB362654684. Questions about this notice, or want to exercise any of the rights below? Email hello@howtogetaito.com.
Email signup
Signup uses your email address and nothing else. We use Resend to send the confirmation message and to hold the list. When you sign up you get an email asking you to confirm; until you confirm on the linked page, you are not subscribed. Confirmation links expire after 24 hours and the temporary signup record is scheduled for deletion at the same time. Confirmed contacts stay in Resend until they unsubscribe or the list is no longer needed. Every email includes an unsubscribe link. Resend’s own privacy policy is at resend.com/legal/privacy-policy.
Shared and emailed plans
Pressing Share on a plan card stores the card exactly as shown — the workflow, assistant, tools, cost, difficulty and privacy notes, all drawn from our catalogue — under a random 12-character id at /plan/<id>. What you typed to get the plan is not part of it and was never stored. Anyone with the link can see the card; the page is not indexed by search engines. Email me this plan sends that same card once to the address you give, through Resend; we do not keep the address unless you also tick the box to join the guides list, which then goes through the normal confirmation email above. Our analytics record that a plan was shared, emailed or saved, and whether it was a composed plan or a guide — not the plan, not the address.
Accounts
An account exists only to keep the plans you save. It is your email address, the date you joined and last signed in, a sign-in session, and your saved plans. There is no password: we email you a link that signs you in, which works once and expires after 30 minutes. The session is a cookie named htg_session (HttpOnly, Secure, same-site) that lasts 90 days or until you sign out; it is the only cookie this site sets, and it is set only when you sign in. Delete your account from the account page at any time: it removes the account, sessions and every saved plan immediately, and any share links to them stop working.
Videos
Some guides have a “Watch it done” recording. The page shows our own poster image and a play button; nothing is loaded from YouTube until you press play. When you do, the video comes from YouTube’s privacy-enhanced domain (youtube-nocookie.com), and from that moment Google’s privacy policy applies to what YouTube sees: policies.google.com/privacy. The transcript is on the page in full, so you can read instead of watch. Our analytics record that a video was played or a transcript opened, on which guide — nothing about you.
Hosting
Cloudflare hosts and serves this site and rate-limits the signup endpoint to stop abuse, which means your IP address is seen in the process. The signup service uses it only to limit repeated requests; it is not stored with your contact. Cloudflare’s privacy policy: cloudflare.com/privacypolicy.
Analytics (first-party, anonymous, optional)
We measure how the site is used so we can tell which guides help and which need work. It is our own code, on our own domain, and it is built not to identify you: no cookies, no IP address stored, no user agent stored, no third-party tools, nothing you type. What it records: the pages viewed, how far down a page you scrolled (25/50/75/100%), how long a page was visible, which outbound links were clicked (the site and path, not you), whether a search in the prompt box matched a topic (never the words), and the outcome of an email signup (never the address). Each visit gets a random id kept in your browser’s session storage so that one visit’s events can be counted together; it is not sent anywhere else and is deleted when you close the tab. Cloudflare tells us the country a request came from and we keep that (for example “GB”), nothing finer.
If your browser sends the Global Privacy Control signal or Do Not Track, nothing is recorded. You can also switch it off here, for this browser:
“Plan it” on the homepage
When you press Plan it, the words you typed are sent to our own server, turned into a numerical embedding by Cloudflare Workers AI running on that server (and, since 16 September 2026, also by Voyage AI’s embedding API, whose privacy policy applies to that one request), and compared against the library. If a guide matches closely, that is the whole journey apart from the record described below.
If nothing matches closely, your words — and, if you add one, the sentence describing your situation — are sent once to Anthropic’s Claude API, together with the passages of our published guides, tool cards and glossary that fit best, so it can write a short guide from them. That is a business API request under Anthropic’s commercial terms, which say inputs sent that way are not used to train their models; Anthropic’s privacy policy is at anthropic.com/legal/privacy. The card tells you when a guide was written this way. To avoid repeat requests, a finished guide is kept for 30 days against a salted, one-way hash of the ask. There is a daily spending cap on this path; when it is reached, Plan it falls back to the library match only.
What we keep, and why
Since 16 September 2026 we keep what you typed into Plan it — the ask, the situation sentence if you added one, and the outcome (which guide matched, or that one was written) — because the asks nobody has written a guide for yet are the best signal of which guides to write next. Before that date we did not keep them.
What is not kept with it: your IP address, browser, cookies, session, account or email address. There is nothing in the record that links an ask to a person, and we do not try to. Before the record is written, anything that looks like an email address, a phone number, a card-like run of digits or a UK postcode is replaced with a placeholder. Please still leave names and contact details out of what you type. Records are deleted after 12 months.
How they are used: read by us, in aggregate, to see which asks repeat and which guides to write; the same guide-writing process then applies (drafted, fact-checked, published under the author’s name). We do not publish what you typed, do not sell or share it, and do not use it to train any model. The Share, Email and Save actions on a card still store only the card, never the ask.
Our analytics record only which guide was matched or suggested (or that nothing matched). The “show without our products” switch is remembered in your browser only.
What we don’t do
No advertising tools, no third-party analytics, and no cookies unless you sign in (then one session cookie, described under Accounts). Search on this site runs entirely in your browser and never sends your query anywhere.
AI crawlers
When a request comes from a known AI system or search crawler (identified by its user-agent string), we log the page it fetched, that user-agent string, the country and the time, so we can see which AI systems actually read this library. That log holds no IP addresses and nothing about people using a normal browser.
Your rights
Want to access, correct or delete your data, or withdraw consent? Email hello@howtogetaito.com. We keep data only as long as it is needed to run the subscription, handle opt-outs or abuse, and meet any legal obligations that apply.