Privacy notice
Last updated: 21 October 2026
This notice explains what happens to your information when you visit joeyxoto.com or sign up for Offscript, my newsletter.
Who I am
This site and Offscript are run by me, Joey Xoto. I decide how your information is used, which makes me the "controller" under UK data protection law. You can reach me at hello@joeyxoto.com.
Offscript
If you sign up, I collect your email address. Kit, the service that sends Offscript, also keeps a record of when you signed up and confirmed, and may record technical details such as your IP address and rough location. Your record is tagged "offscript" so I know which list you joined.
I use your email only to send you Offscript, every other week. I don't sell it or share it for anyone else's marketing.
My lawful basis is your consent. You give it by signing up and then clicking the link in the confirmation email. You can withdraw it at any time using the unsubscribe link in every email, or by emailing me.
Offscript emails may track opens and clicks, so I can see which emails get read and make them better. Open counts are only estimates.
Keeping the signup form safe
To stop spam, the form has a hidden field that bots tend to fill in, and a limit of 5 signups per IP address every 10 minutes. Your IP address is only held briefly in memory for this check. It is never stored.
Cookies and analytics
There are no advertising cookies here, and nothing on this site tracks you across other sites.
The site is hosted by Lovable, which runs basic visitor analytics. It counts page views and records where visits come from, your browser type and language, a rough country based on your time zone, which buttons and links are clicked, and how fast pages load. It sets one cookie, "session-id", which lasts 30 minutes and groups page views into a single visit. I only look at the totals, to improve the site.
You can turn analytics off with the switch at the bottom of this page, or by blocking cookies in your browser. The site works the same either way. If your browser sends a Global Privacy Control signal, analytics are switched off automatically.
A few other things:
- Cloudflare, which protects the site, sets a cookie called "__cf_bm" for up to 30 minutes to filter out bots. The site needs it to run safely.
- Your browser remembers when it last showed you the Offscript invitation, so it doesn't keep asking.
- Fonts load from Google Fonts, so your browser connects to Google, which can see your IP address.
- YouTube (in privacy-enhanced mode) and Spotify players only load when you press play. After that, their own privacy policies apply and they may set cookies.
Who handles your information for me
- Kit (Kit, Inc., USA) stores the Offscript list and sends the emails, acting only on my instructions. Your details are stored in the US. Kit's data processing terms protect UK data with the UK's approved transfer safeguards (the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses). Ask me if you'd like a copy.
- Lovable hosts this site and runs its analytics. Your email passes through Lovable on its way to Kit. I don't keep a separate copy on this site.
- Cloudflare protects and delivers the site.
How long I keep it
- While you're subscribed, I keep your email so I can send you Offscript.
- If you unsubscribe, I delete your details from Kit within 30 days.
- If you sign up but never confirm, I delete your email within 30 days.
- You can ask me to delete your details at any time.
Your rights
Under UK data protection law, you can ask for a copy of your information, ask me to correct or delete it, ask me to limit how I use it, object to how I use it, and ask for it in a format you can take elsewhere. Email hello@joeyxoto.com and I'll reply within one month.
Complaints
Please tell me first at hello@joeyxoto.com, so I can put it right. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes
If anything here changes, I'll update this page and the date at the top.