Privacy Policy

Bread & Law LLC (“Bread & Law,” “we,” “us”) operates two websites — www.breadandlaw.com, the practice’s site, and tools.breadandlaw.com, where its tools live — and a tracking service at t.breadandlaw.com. The tools, together called Tools for Communicators, are The Loop, Cited, the Cannabis Consumer Poll, and Is It News?. This policy says what each of them collects, what is kept and for how long, and who else handles it. Together they are the “Services.”

1. Who we are

For information about your use of the Services, Bread & Law LLC is the data controller. Contact: andrew[at]breadandlaw.com, or Bread & Law LLC, c/o Registered Agents Inc., 90 State Street, Suite 700, Office 40, Albany, NY 12207.

One exception — The Loop’s tracking and the Wire. When a practitioner uses The Loop to track their own outreach, or to share outcomes on the Wire, the information is processed on their behalf and under their instructions. For that data the practitioner is the controller and Bread & Law is their processor/service provider. The practitioner is responsible for having a lawful basis to send tracked email and to process information about its recipients (Section 6 and the Terms of Service).

2. What we collect

2.1 Visits to either website

Our host, Vercel, keeps standard request logs (IP address, time, browser type) for security and diagnostics. The practice’s site, the tools index, the two tool pages hosted there, and Cited use Vercel Web Analytics, which counts page views in aggregate and sets no cookies. The Loop demo pages carry no analytics script of their own. We do not use advertising cookies or cross-site trackers.

Both websites serve their own font files; no font is requested from a third party.

2.2 The Loop demo (tools.breadandlaw.com/theloop)

The demo runs in your browser on fictional data that ships with the page. It does not ask for, send, or store anything about you.

2.3 Cited (tools.breadandlaw.com/cited)

When you run an assessment, Cited stores:

• the outlet and the URL you submitted;
• signals about that outlet’s site — robots rules, response headers, sitemap and similar public technical evidence, and the results of test requests Cited makes to the site;
• probe records — when Cited asks an AI platform to fetch a page, it routes the request through a one-time redirect on our host and records the first request that arrives: the time, the user agent, and the egress IP address of the platform’s crawler. These are addresses of third-party automated systems, kept as evidence that the fetch happened. They are not the addresses of Cited’s users.

This is information about publishers and web infrastructure, not about you.

Your IP address. To cap how many assessments one source can run, Cited computes a salted one-way hash (HMAC-SHA256) of your IP address the moment a request arrives and stores only the hash. The raw address is never written to disk or database. The hash cannot be turned back into an address, is used only to count requests, and is deleted within 24 hours.

To perform an assessment, Cited sends the URL being assessed — not information about you — to an AI platform’s fetch interface (currently Anthropic’s). Your browser may keep a note of an assessment in progress in its own local storage so the page can resume it; that stays in your browser.

2.4 The Loop — a desktop application, and its tracking service

On the practitioner’s computer. Media contacts, their email addresses, outreach, notes, responses, and clips are stored locally in The Loop. Bread & Law does not receive or store them.

The tracking pixel. A practitioner may place a one-pixel image, served from t.breadandlaw.com, in an email they send. When something loads that image — a person’s mail client, or an automated scanner — the service logs: the tracking identifier the practitioner generated, the time, the IP address that made the request, and its user-agent string. It grades each load as likely human or likely automated. This information is about the recipients of the practitioner’s email, and an IP address can be personal data under laws such as the EU/UK GDPR. The pixel does not read the email or any reply.

What the application sends to the service. So that grading works, The Loop reports the time each tracked message was sent, and the network addresses the practitioner’s own computer connects from (so the practitioner’s own opens are not counted). Both are stored against the installation’s credential.

Locations. To show roughly where a tracked email was opened, The Loop looks up each opener’s IP address in a location database kept on the practitioner’s own computer (DB-IP, used under CC BY 4.0). The address is not sent to any location service. The result is an approximate city and region, never a precise location. The database itself is downloaded from db-ip.com only when the practitioner asks for an update.

Automated review. Once a week the service scans open logs for patterns that look like undetected scanners and stores a summary of what it finds, which can include sample addresses.

2.5 The Wire

A practitioner may turn on the Wire to share a read-only view of their outreach outcomes with people they choose. While it is on:

• The Loop publishes a projection of those outcomes to Bread & Law’s store at t.breadandlaw.com: which journalists and outlets read, replied, or published, and when. It contains no email addresses, no tracking identifiers, no notes, no network addresses, and no locations.
• Anyone who has the link and the code the practitioner gave them can read it. Bread & Law does not decide who that is.
• The store keeps only a hash of the code. A reader’s session is a random token, stored hashed, that expires after 15 minutes without use.
• To limit guessing, the store counts attempts against a truncated hash of the reader’s IP address. That counter expires with its window (a minute, or an hour) and is cleared daily. Nothing else about readers is recorded — no raw address, no user agent.

2.6 Cannabis Consumer Poll (tools.breadandlaw.com/cannabis-consumer-poll)

The page displays a published poll record. Your browser loads that record directly from GitHub, which receives the request as it would for any file it hosts. We collect nothing from you on this page beyond what Section 2.1 describes.

2.7 Is It News? (tools.breadandlaw.com/is-it-news)

Is It News? is open-source code, published on GitHub. The page describes it. It does not collect, use, or store IP addresses or other personal data.

2.8 If you write to us

We keep the email you send and what we need to answer it.

3. How we use information

• To provide, operate, and maintain the Services;
• To prevent abuse and enforce rate limits (Cited, the Wire);
• For The Loop, to report to the practitioner whether and when tracked email was opened, and to filter out automated loads;
• To answer inquiries and support requests;
• To secure the Services and comply with legal obligations.

4. Legal bases (EEA/UK users)

Where the GDPR applies, we rely on: legitimate interests (to secure the Services and prevent abuse — including Cited’s salted-hash rate limiting — and, on a practitioner’s instructions, to provide open tracking and the Wire to them); performance of a contract (to provide a service under an agreement with us); consent where required; and legal obligations. For The Loop’s tracking of a practitioner’s recipients, and for what a practitioner shares on the Wire, the lawful basis is the practitioner’s responsibility as controller.

5. Who else handles it (sub-processors)

We do not sell personal information. We share it only with providers who help run the Services:

We may disclose information if required by law, to protect our rights or safety, or in connection with a business transfer.

6. A practitioner’s responsibilities when using The Loop

You are responsible for using The Loop’s tracking and the Wire lawfully, including compliance with email, privacy, and electronic-communications laws in your and your recipients’ jurisdictions (for example, CAN-SPAM, GDPR, and ePrivacy rules). You represent that you have any rights, notices, or consents necessary to send tracked email, to have its opens logged and processed, and to share outcomes with the people you give your Wire code to. If a recipient exercises privacy rights over data collected through your tracking, we may direct that request to you as the controller.

7. How long we keep it

Cited

• IP rate-limit hashes: deleted within 24 hours.
• Assessment runs and signals: deleted after 90 days, except that the most recent run and the most recent signals for each outlet are kept, so a shared result link keeps resolving.
• Raw test-request logs: 30 days.
• Probe records (including crawler egress addresses) and the list of outlets assessed: kept; no automatic deletion.

The Loop’s tracking service

• Open logs — tracking identifier, time, IP address, user agent, grade: kept; there is no automatic deletion schedule. Requests to delete them are handled under Section 8.
• Rows from the public tracker demo: deleted after 7 days.
• Send times, the practitioner’s own network addresses, and audit summaries: kept; no automatic deletion.

The Wire

• When the practitioner turns it off: the projection, the code hash, and every reader session are deleted at once.
• If The Loop stops publishing for 7 days: the same deletion happens automatically.
• Reader sessions: 15 minutes without use. Attempt counters: cleared daily.
• A record that the installation has a Wire address (no outcomes in it) is kept so an old link resolves to “nothing shared.”

Websites. Host logs and analytics: kept for a limited period, in aggregate.

Correspondence and engagement records. Kept while active and as required for legal, tax, and accounting purposes.

8. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing. California residents have rights under the CCPA/CPRA, including the right to know and to delete, and the right not to be discriminated against for exercising them; we do not sell or “share” personal information as those terms are defined under California law.

To exercise any right, email andrew[at]breadandlaw.com. We will verify your request as required by law. Cited’s IP hashes are non-reversible and short-lived, so we generally cannot link them to an individual. For data collected through a practitioner’s use of The Loop or the Wire, we may need to route your request to that practitioner (the controller).

9. International transfers

We are based in the United States, and information we process is handled in the U.S. If you access the Services from outside the U.S., you understand your information may be transferred to and processed in the U.S. Where required, we use appropriate safeguards for such transfers.

10. Children

The Services are intended for business use by adults and are not directed to individuals under 18. We do not knowingly collect personal information from children.

11. Security

We use reasonable technical and organizational measures to protect information. By design, The Loop keeps contact data on the practitioner’s own device; Cited never stores a user’s raw IP address; and the Wire’s store holds only hashes of codes and session tokens. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the effective date. Material changes will be communicated as required by law.

13. Contact

Bread & Law LLC
Email: andrew[at]breadandlaw.com
Mailing address: c/o Registered Agents Inc., 90 State Street, Suite 700, Office 40, Albany, NY 12207