Privacy policy

Last updated 5 November 2026

This site sells The Attention Playbook, a video playbook on growing on X. I'm Rob Hallam, a sole trader in the United Kingdom, and I'm the data controller for the personal data described here. You can reach me at rob@theattentionplaybook.com.

The short version: I collect as little as I can, I don't use advertising cookies, the only analytics tool is PostHog (hosted in the EU) and I never sell your data.

1. When you buy: your email, via Whop

Checkout happens on Whop. Whop is the merchant of record: it takes the payment, collects any sales tax or VAT, and holds your card or payment details. I never see your full payment details.

Whop passes me your email address, your name if you gave one, what you bought, the price paid and your order status. I use these to confirm your order, send you access within ten minutes of buying, handle refunds and answer support emails. The legal basis is performing our contract.

Whop's own handling of your data is covered by Whop's privacy policy.

2. When you visit: analytics with PostHog

I use PostHog, hosted in the EU, to count visits and button clicks, so I can see how many people read the page and how many click through to checkout. It is set up to be as light as it can be: no cookies, session recording off, no automatic click tracking and no profile of you as a person. To count a repeat visit once, PostHog keeps a random ID in your browser's local storage; you can clear it any time by clearing your site data. The script is served from this site, not loaded from a third party. PostHog records page views and these events:

• preorder_click: someone clicked a buy button, with the price and sales count shown at the time, and which button.
• purchase: a sale came through from Whop, with the price paid and which product.
• price_step_change: the price moved up a step, with the old and new price.
• free_video_play: one of the free lessons was played, and whether the viewer was logged in.
• faq_open: which FAQ question was opened.
• refund_request: a refund was requested, before or after delivery, the watched percentage at the time, and the outcome.
• scroll_depth and curriculum_expand: how far down the page people read, and which modules they open.

These events do not contain your name or email. Like any website, PostHog and my hosting provider see your IP address when your browser connects to them; my hosting provider keeps standard server logs for security and to stop abuse, such as rate limiting. The legal basis is my legitimate interest in running and improving the site.

The site sets two small first party cookies (ab_h1 and src) so I can tell which page version and which link brought you here. They identify no one and are not shared.

The course site, course.theattentionplaybook.com, uses PostHog in the EU too, with no cookies, session recording off and nothing you type collected, and the same kind of random ID in local storage. There it counts page views, lesson plays, how far you get through each lesson (25, 50, 75 and 100 percent), downloads, and clicks on links and buttons without their text, and when you're signed in it links them to your course account so I can see how people move through the playbook. If your browser sends Do Not Track or Global Privacy Control, none of it runs.

3. Your course account

The playbook lives on the course site, course.theattentionplaybook.com. To use it you need an account. For your account I keep:

• your email address;
• your progress through each lesson and how long you've watched;
• the questions you ask the AI panel, and its answers;
• the rows you write in the sheet;
• your public X posts, synced into the sheet, but only if you connect your own public X handle. You can disconnect it any time, and nothing more is synced after that.

I use these to run your account, save your progress, answer your questions and apply the refund rule. The legal basis is performing our contract. The course site sets one cookie to keep you signed in. You can delete your account from Settings on the course site, or by asking me at rob@theattentionplaybook.com.

4. Signing in with Google

You can sign in with your email address or with Google. If you choose Google, Google sends me your name, email address and profile picture. I use them only to create your course account and sign you in. I don't read or keep any other Google data.

If your Google email address is the same as an account you already have, signing in with Google opens that same account. Google's own privacy policy covers your Google account.

5. When you watch: playback data

After delivery, the player records how far you get through each lesson: your account, the lesson, the furthest point reached and when. Reading a lesson's transcript, or downloading anything from a lesson (its transcript, its video or a sheet), counts that lesson as watched for the refund rule. I use this to save your progress and to apply the refund rule fairly (under 10% watched within 7 days of delivery), and to settle any dispute about it. The legal basis is performing our contract and my legitimate interest in preventing refund abuse.

Videos are streamed through a video host using signed, expiring links. That host processes technical data such as your IP address to deliver the video.

6. The free lessons

Three lessons are free: the welcome (0.1), how the feed works (1.1) and the Wise Wired story (3.1). The free lessons need a free account, which is just your email address, so I can save your progress. I don't use it for anything else. They play on the course site, through the same video host as the rest of the playbook.

7. Emails

If you buy, I'll send you an order confirmation and your access email within ten minutes of buying, and at most one reminder if you haven't opened it. These are part of the order. I won't add you to a marketing list without asking.

8. Who else handles your data

• Whop, for checkout, payment, tax and buyer accounts.
• My hosting provider, which runs this site.
• PostHog, for the analytics above (EU hosting).
• An email delivery provider, to send the emails above.
• A video hosting provider, to stream the lessons.
• Google, if you sign in with Google.
• An AI provider, to answer the questions you ask the AI panel.
• A provider that reads public X posts, to sync your sheet, only if you connect your X handle.

Some of these are based outside the UK, in which case the transfer is covered by UK adequacy regulations or the standard contractual safeguards those providers offer.

9. How long I keep it

• Order records: for as long as you have access, and then for 6 years, because UK tax rules require it.
• Your course account: until you delete it. Backups keep a deleted account for up to 14 days, until the oldest backup rolls off.
• Playback data: your progress, for as long as you have access. The detailed playback records (where you are in a video, the speed, the time and your IP address) for 90 days, for refund disputes, then deleted. Refund related records are kept with the order record.
• IP addresses on downloads, sign ins, access code attempts and playback links: cleared after 90 days.
• Analytics events: 24 months, then deleted.
• Support emails: 2 years after the conversation ends.

10. Your rights

Under UK GDPR you can ask me for a copy of your data, to correct it, to delete it, to restrict or object to how I use it, and to move it elsewhere. Email rob@theattentionplaybook.com and I'll answer within one month. If you're unhappy with how I handled something, you can complain to the Information Commissioner's Office at ico.org.uk.

11. Changes

If I change this policy in a way that matters, I'll update the date at the top and, if you've bought, tell you by email.