Privacy Policy

Effective 10 August 2026 · Unrushed Studio

Accounts launched on 10 August 2026, and this policy grew to cover them — dated here, as the previous version promised, rather than edited quietly. The site now collects a little instead of almost nothing, and this page says exactly what “a little” means.

What this site is

Unrushed Ledger is a company-intelligence site published by Unrushed Studio, a Mistral Spark project. It keeps a curated, sourced record of companies, investors, funding rounds and news, compiled by scheduled research routines that read public sources: company newsrooms, regulators, the press, and nothing else.

What we collect

Your account. An email address, a password, and the timestamps of the account's creation and sign-ins. The password is stored only as a hash by Supabase, our authentication provider; we never see it and cannot read it. We use the email to authenticate you and to send the messages an account requires (confirmation, password reset), and for nothing else. No newsletter arrives because you signed up.
Your watchlist. The entities you save, with the time you saved them. This is what the account is for. It is visible to you alone.
One essential cookie. Signing in sets a session cookie so the site can remember who you are between pages. It is strictly necessary for accounts to work and is not used to track you across other sites. Signed-out reading sets no cookie at all.
Two values in local storage. Your theme choice (ul-theme) and your analytics decision (ul-consent). Both stay in your browser. No server ever sees them.
Analytics, only if you allow it. If you choose “Allow analytics” on the banner, Vercel Web Analytics records page views in aggregate. It is cookieless, does not follow you across sites, and does not build a profile of you. If you choose “Essential only”, the analytics script is never even loaded.
A bot check at sign-up. Creating an account may include a Cloudflare Turnstile challenge, which processes technical signals from your browser (including your IP address) to tell people from scripts. That processing happens so that accounts cannot be created in bulk by machines; Cloudflare acts as a processor for it.
Hosting request logs. The infrastructure serving this site processes ordinary request logs (address, requested path, timestamp, user agent) as a normal part of serving pages. We don't add anything to that, and we don't query it for anything beyond keeping the site running.

What we don't do

No ads, and no ad-tech or third-party tracking of any kind.
No sale of data. Not your email, not your watchlist, not anything.
No profiling. Your watchlist is a feature you use, not a signal we mine. We don't build a picture of who is reading, only of what is happening at the companies in the ledger.
No analytics without consent, and none that could identify you even with it.

Where it lives

Three providers process data on our behalf, each for one job: Supabase holds accounts and watchlists (authentication and database); Vercel serves the site and, with your consent, its aggregate analytics; Cloudflare runs the sign-up bot check. None of them is permitted to use your data for their own purposes.

Your data, your call

Your account page shows what the account holds. To delete the account — email, watchlist, everything — or to ask for a copy of it, email alper@mistralspark.com from the account's address and it will be done. Deletion is deletion: the rows are removed, not flagged.

About the companies in the ledger

The entities, rounds and news items in the ledger are compiled from public sources: company newsrooms, regulatory filings, and press coverage. Nothing comes from private or confidential information. Every figure on this site carries the source it came from; where something is undisclosed, the ledger says so rather than guessing.

If you believe an entry about you or your company is wrong, outdated, or shouldn't be here, contact alper@mistralspark.com and we'll investigate, then correct or remove it.

Contact

Questions, corrections, or requests about this policy or anything in the ledger: alper@mistralspark.com.

Changes to this policy

We'll update the effective date at the top of this page whenever this policy changes, and describe what changed in plain language rather than silently editing the past. So far: 8 August 2026, first version, before accounts; 10 August 2026, accounts, the consent banner, optional analytics and the sign-up bot check added.