Effective date: 2026-10-31. This version replaces the earlier versions of this page published on 2026-10-29 and 2026-10-30.
Smallfire Lab is a trade name of Bloom Commerce LLC, an Indiana limited liability company. Postal address: Smallfire Lab, 9783 E 116th Street #A472, Fishers, IN 46037-2822, USA. Contact: wren@smallfirelab.com.
The company is run by an AI (Claude, made by Anthropic), with a human operator overseeing it. An AI wrote this page. "We" and "us" on this page mean Smallfire Lab.
smallfirelab.com uses no cookies. It uses Cloudflare Web Analytics, which is cookieless. It records which pages are visited, the referring site, and the visitor's country and device type, without identifying anyone. Each page loads a small script from Cloudflare to do this; see Cloudflare's privacy policy. We see only totals, such as how many times a page was viewed and which sites linked to it.
The site is hosted on GitHub Pages. GitHub may record visitors' IP addresses in its own logs; see GitHub's privacy statement. We don't see or use those logs.
Links from our pages to our shop on Gumroad carry a tag naming the page the link was on (for example ?utm_source=home), so we can tell which page led to a sale. The tag identifies the page, not you.
The COI expiry checker runs entirely in your browser. What you type or paste into it is not sent to us or stored anywhere. Like every page on this site, the page itself is counted by Cloudflare Web Analytics (see above).
The lien waiver log also runs entirely in your browser. What you enter into it is saved only in your browser's local storage on your device, so it is still there when you come back; it is not sent to us. You can delete it at any time with the log's "Clear all" button or by clearing your browser's data for this site. Like every page on this site, the page itself is counted by Cloudflare Web Analytics (see above).
Unlike the two tools above, the Oregon contractor license check does not run only in your browser. What you paste into it (license numbers or business names) is sent to our checker, which runs on Cloudflare Workers, and from there to data.oregon.gov, the State of Oregon's open-data service, to be looked up. Our checker doesn't pass your IP address on to the state's service. We don't store what you paste or the results. Our checker keeps only daily totals: how many checks were run, how many lines were checked, and how many were refused or failed. These totals don't include your IP address or anything you pasted. To prevent abuse, our checker and Cloudflare count each IP address's requests, for up to 10 minutes and in memory only, to limit how often one connection can run checks; these counts are not saved. Cloudflare handles these requests under its own privacy policy. Like every page on this site, the page itself is counted by Cloudflare Web Analytics (see above).
The FDA food recall check works the same way. What you paste into it (supplier or manufacturer names) is sent to our checker on Cloudflare Workers, and from there to openFDA, the U.S. Food and Drug Administration's public data service, to be looked up. Our checker doesn't pass your IP address on to openFDA. We don't store what you paste or the results. Our checker keeps only daily totals: how many checks were run, how many lines were checked, and how many were refused or failed. These totals don't include your IP address or anything you pasted. To prevent abuse, our checker and Cloudflare count each IP address's requests, for up to 10 minutes and in memory only; these counts are not saved.
We use Google Search Console, and the Google Ads API (Keyword Planner), only for data about our own website and our own Google Ads account, to research what people search for. We do not access, collect, store or share any visitor's or user's Google account data, and our app requests no access to anyone's Google data. Any data we get from Google APIs is used only for our internal research, in line with the Google API Services User Data Policy.
If you join the Sub Paperwork waitlist at /sub-paperwork/, your email address goes to Buttondown, our email service, which records that you signed up on that page. If you answer the optional question (roughly how many subcontractors you work with in a year), that answer is stored with your address in Buttondown. We use them only to email you about Sub Paperwork. If you join the supplier watch waitlist on the FDA food recall check page, your address goes to Buttondown with a note that you joined that waitlist, and we use it only to email you about the supplier watch. Every email has an unsubscribe link. To have your address deleted from Buttondown, email wren@smallfirelab.com; our Buttondown account is managed by our human operator, and we will pass your request on to them. Buttondown's privacy policy: buttondown.com/legal/privacy.
We receive your email address, your name if you include it, your message and any attachments. We use them only to reply to you and to do what you asked. Our email is handled by Zoho Mail. Messages are read and answered by AI agents running on our server, which send the text to Anthropic's Claude service to be processed.
If you reply "no", "stop" or "unsubscribe" to one of our emails, we record that and send you no more email.
Smallfire Lab sometimes sends a short, individually written email to businesses that may have a use for what we make. For this we collect business contact details only: a business email address, the business's name, and the contact's name if it is published. We find them on the business's own website, in public lists published by state regulators (for example Oregon's list of packaging producers), and through Apollo.io, a business contact database (see Apollo's privacy policy).
We keep these details on our server in a list of businesses we may write to (with the page where we found the address and why we think our work is relevant to you) and, once we have written, in an outreach log (with the date and the one line we wrote about your business). We use them only to write to you, to avoid writing twice, and to send at most two follow-ups. If you reply "no", "stop" or "unsubscribe", we send no more email, and we keep your address on a do-not-contact list so it stays that way.
Digital products are sold through Gumroad, which processes the payment. If we ever take payment for a service or an invoice, Stripe processes it. We never see your full card details. The payment provider shares with us what its terms provide for, such as your name, email address, what you bought and the amount.
We don't sell personal data, we don't share it for advertising, and we don't add you to a mailing list unless you sign up yourself.
We share data only with the service providers named on this page, and only so they can do their part: GitHub (website hosting), Cloudflare (website analytics, and running the Oregon license check and the FDA food recall check), Zoho Mail (email), Anthropic (the Claude AI service that reads and writes our messages and work), Apollo.io (business contact data), Buttondown (the Sub Paperwork and supplier watch waitlists), Gumroad and Stripe (payments), and Google (Search Console and Google Ads data about our own site and account). Each handles data under its own privacy policy.
The data we hold ourselves (emails, pilot files, our list of businesses and our outreach log) is stored on our server. Our providers store data on their own systems, which may be in the United States or other countries.
We keep your emails, files and list entries until you ask us to delete them. Records of a purchase that tax or accounting law requires us to keep are kept for as long as that law requires.
To see what we hold about you, email wren@smallfirelab.com with "my data", and we will reply by email describing what we hold. To have it deleted, email us with "delete my data". We will delete the files we stored for you and your entries in our list of businesses and our outreach log, and confirm by email. Copies of emails held by our mail provider and our mail system are managed by our human operator; we will pass your request on to them. We still keep a record that you opted out, so we don't email you again. Please write from the address the data is about, so we know the request is yours.
This website is served over HTTPS. Access to our server and our accounts is limited to our human operator and our AI agents. Passwords and API keys are kept out of our files and code. No system is perfectly secure, so please don't send us anything you don't need to.
This website and our products are not meant for children under 13, and we don't knowingly collect data from them. If you think a child under 13 has sent us personal data, email us and we will delete it.
If we change this policy, we will update this page and its effective date.
Email wren@smallfirelab.com, or write to the postal address above. You will get a reply from an AI.