Triple Point Strategy LLC ("TPS," "we," "us," or "our") designed this policy around the Website's current data flows. It should be read together with our Terms of Use.
01 Scope
This Privacy Policy applies when you visit or interact with the TPS website at triplepointstrategy.com, including its Research, Fund, Solutions, Team, Contact, and legal pages (the "Website").
This policy is limited to Website activity. It does not govern personal information handled through a Fund subscription package, investor onboarding or administration, a separately executed agreement, employment activity, or another offline relationship. Those activities may be governed by separate agreements, notices, and legal obligations.
02 Privacy snapshot
- After the page hydrates, Contact, investment inquiry, and newsletter forms send only to same-origin TPS server routes.
- Before hydration and when JavaScript is disabled, the forms use a non-network dialog method and do not transmit entries.
- TPS server routes validate inputs, enforce origin and anti-abuse controls, and fail closed when required configuration is unavailable.
- Inquiry and subscriber notifications use a signed server-to-server Google Apps Script relay; endpoints, signing material, provider keys, and other runtime secrets are not sent to browser code.
- Google Analytics measures visits only after you allow optional analytics. Advertising features are disabled.
- Research continuity uses browser session storage, not a TPS visitor profile.
- The Website displays server-sourced market data and does not send subscriber information to the market-data provider.
03 Information the Website handles
| Category | Examples | Current handling |
|---|---|---|
| Newsletter information | Email address, source page, form timing, and an invisible anti-spam field | Sent to a same-origin TPS server route. When configured, email, source page, and campaign labels go to Beehiiv; after acceptance, email, source, submission time, and a pseudonymous visitor key go through the signed relay for a subscriber email notification. |
| Request and device information | IP address, requested URL, time, browser or device details, and security events | Processed by hosting and security infrastructure; form routes derive a salted visitor key for rate limiting and relay anti-abuse controls |
| Optional website analytics | Published page address and title, referring website, pseudonymous cookie identifiers, visit timing, and browser or device information | Sent to Google Analytics only after consent. TPS excludes URL queries, fragments, form entries, and search terms from its analytics events. |
| Research continuity data | Search or filter URL, scroll position, focus target, and return state | Kept in the browser session or page URL |
| Contact and investment inquiry entries | Contact: first and last name, email, reason, subject, message, and privacy acknowledgement. Investor: first and last name, email, optional phone, investor type, self-reported status, potential investment range, and privacy acknowledgement. Both include source and submission time. | Sent to a same-origin TPS server route, strictly validated, and—only when configured—delivered in a signed server-to-server request to Google Apps Script, which emails restricted TPS recipients |
If you contact TPS directly by email or through another channel, we receive whatever information you choose to include in that communication. Direct email is a separate communication channel from the Website forms.
04 Sources of information
Website information may come from:
- you, when you subscribe, submit a Contact or investment inquiry, or communicate with TPS directly;
- your browser or device, as part of ordinary web requests and browser-session functionality;
- hosting, security, email-relay, and newsletter service providers acting for TPS; and
- public or third-party services used to supply Website content, such as market data.
05 How information is used
TPS and providers supporting the Website may use information to:
- create, confirm, reactivate, administer, and deliver a newsletter subscription;
- honor unsubscribe, suppression, and privacy requests;
- operate, secure, diagnose, and maintain the Website and its forms;
- understand aggregate readership and traffic sources when you allow optional analytics;
- detect spam, fraud, automated abuse, security incidents, or unlawful activity;
- preserve Research navigation state during a browser session;
- route, deliver, and respond to Contact and investment inquiries or direct communications;
- protect the rights, property, and safety of TPS, Website users, and others; and
- comply with applicable law, regulation, legal process, and recordkeeping duties.
07 Contact and investment inquiry forms
Before hydration and with JavaScript disabled, each form keeps a static non-networkmethod="dialog" fallback. After hydration, submission goes only to a same-origin TPS server route. The route enforces the allowed origin, required privacy acknowledgement, exact field names and values, bounded input sizes, anti-spam timing, and rate limits.
When all required server settings are present, the TPS route packages the inquiry with its type, source, exact ISO submission time, and a pseudonymous visitor key. It signs that payload with HMAC-SHA256 and sends it server to server to Google Apps Script. The script verifies the signature, request age, exact field contract, duplicate request identifier, and relay rate limits before Google Workspace Mail sends an email to configured TPS-domain recipients. No relay URL, signing key, Beehiiv credential, market-data credential, or rate-limit salt is included in browser code.
Required configuration that is absent, invalid input or origin, rate limiting, or a downstream delivery failure causes the route to fail closed with a limited error. The interface reports success only after the relay reports actual delivery (or a previously delivered duplicate). The Apps Script implementation does not write submissions to a spreadsheet or application database. A delivered notification is an email and may remain in TPS's Google Workspace mailbox under TPS's operational, legal, and retention practices.
You may instead use the email link displayed on the Contact page. Selecting a mailto:link opens your chosen email application; your email provider and its transmission services apply their own privacy practices.
08 Technical and security data
To protect all three forms from abuse, the Website server reads the requesting IP address, combines it with a server-only secret salt, and creates a SHA-256 hash. A shortened 32-character hexadecimal visitor key is retained in short-lived process memory for a ten-minute application rate-limit window and included in the signed Apps Script payload. Stale process entries are removed as later requests are processed, and the in-memory map is capped. The application does not add the raw IP address to the Beehiiv request or Apps Script payload.
Apps Script uses short-lived cache records to detect duplicate request identifiers and enforce visitor and email anti-abuse limits. Visitor and keyed email-digest counters can remain for up to one hour; request delivery markers can remain for up to six hours. Application logging is limited to request identifier, form type, outcome, and duration rather than submitted fields. These controls are operational safeguards, not a spreadsheet or application database of submissions.
Website hosting and security providers necessarily process web requests and may maintain infrastructure logs containing an IP address, request time, requested URL, browser or device information, response status, and security signals under their service arrangements. TPS does not use those records in the source-controlled application to build advertising profiles.
09 Cookies, browser storage, analytics, and tracking
Google Analytics loads only after you choose Allow analytics. Before that choice, and when you decline, the Website sends no analytics events or consent pings to Google. You can change your choice through Privacy choices in the footer. Declining after a prior acceptance stops further measurement and clears this Website's Analytics cookies.
Analytics uses pseudonymous cookies to measure page visits, sessions, and traffic sources. Google also processes ordinary connection and device information, including the IP address needed to receive a request. TPS sends published page addresses and titles, and only the origin of an external referring website. It excludes URL queries, fragments, search terms, and form entries. Automatic form, search, click, video, and download tracking is disabled, as are Google signals and advertising personalization in the Website tag.
The Website uses sessionStorage to remember Research navigation state, scroll position, and return context during the browser session. Research search and filter values can also appear in the page URL, which means they may be included in ordinary hosting logs or shared if you copy the URL.
The Website serves its typefaces from the same TPS origin. The source-controlled application does not load third-party font files.
Your analytics choice is stored locally for up to 180 days. Analytics cookies are configured for a maximum of 180 days without extending their expiry on each visit. If browser storage is unavailable, your choice applies only in the current tab. The Privacy choices control remains available so you can withdraw consent.
The source-controlled Website has no feature designed to let third parties collect personally identifiable information about a visitor's online activities over time and across unaffiliated websites for TPS advertising purposes. Infrastructure providers may receive ordinary request information when their resources are requested; their own policies govern processing outside TPS's application.
When your browser sends a Global Privacy Control or Do Not Track signal, optional analytics remains off. The Website does not implement sale, targeted-advertising, or cross-context behavioral-advertising features.
10 Service providers and other disclosures
Information may be processed or disclosed in these limited circumstances:
- Newsletter delivery: Beehiiv receives newsletter subscription information when the integration is configured.
- Inquiry and subscriber email relay: Google Apps Script receives a signed payload and Google Workspace Mail delivers an email to configured TPS-domain recipients. The relay does not write submissions to a spreadsheet or application database.
- Optional analytics: Google Analytics processes consented visit data to report readership and traffic sources. See Google's Privacy Policy.
- Hosting and security: ChatGPT Sites and infrastructure providers process requests needed to host, deliver, and protect the Website.
- Market data: TPS's server requests public market information from CoinMarketCap. Application code does not send subscriber or inquiry information with that request.
- Professional and legal support: advisers, auditors, insurers, or authorities may receive information when reasonably necessary and permitted by law.
- Business transaction: information may be evaluated or transferred in connection with a merger, financing, reorganization, sale, or similar transaction, subject to appropriate protections.
The Website also links to social networks, research sources, and other third-party sites. Following a link sends a request to that third party, which applies its own terms and privacy practices.
11 Advertising, sale, and profiling
The Website's source-controlled application contains no advertising network, targeted advertising, cross-context behavioral advertising, data-broker integration, or feature that sells personal information. The Website application does not use form information to make or facilitate a decision producing a legal or similarly significant effect about a visitor. If Website practices change, TPS will update this policy and provide any notice, consent, or opt-out mechanism required by law.
12 Retention and security
| Record | Retention approach |
|---|---|
| Form rate-limit visitor key | Ten-minute application window in process memory; stale entries are purged on later requests |
| Relay anti-abuse cache | Visitor and keyed email-digest counters for up to one hour; request duplicate/delivery markers for up to six hours |
| Inquiry notification email | Delivered to configured TPS Google Workspace recipients and retained according to TPS operational, legal, and retention practices |
| Research continuity state | Browser session storage, controlled by your browser and normally cleared when the session ends |
| Newsletter subscription | While active and then as reasonably necessary to honor opt-outs, resolve issues, and meet legal obligations |
| Hosting and security logs | According to operational, security, contractual, and legal requirements applicable to TPS and its providers |
TPS seeks to use reasonable administrative, technical, and organizational safeguards appropriate to the Website information it controls. No internet transmission, service provider, or storage system can be guaranteed completely secure. Please do not send sensitive personal information, private keys, wallet seed phrases, passwords, or subscription funds through the Website forms or email.
13 Your rights and choices
Depending on your residence and applicable law, you may have rights to request access to, correction of, deletion of, or a portable copy of personal information TPS controls; to withdraw consent; to restrict or object to certain processing; or to appeal a decision on a privacy request. You may also use an authorized agent where applicable.
Submit a request to contact@triplepointstrategy.com. Describe the request and the TPS interaction involved. TPS may take reasonable steps to verify your identity and authority, may request additional information, and may retain information when required or permitted by law. If a request is denied, you may reply to the decision and ask that it be treated as an appeal. TPS will not discriminate against you for exercising an applicable privacy right.
California and Texas residents may have specific rights under their respective privacy laws when those laws apply. This policy does not claim that every state statute applies to TPS in every circumstance; TPS will honor rights required by applicable law and may voluntarily fulfill other reasonable requests.
14 Children and international processing
The Website is intended for a general adult audience and is not directed to children under 13. TPS does not knowingly collect personal information through the Website from children under 13. If you believe a child has provided information, contact TPS so the matter can be reviewed.
TPS operates in the United States. Website providers may process information in the United States or other locations where they operate. Those locations may have privacy laws that differ from the laws where you live. Where required by applicable law, TPS seeks to use appropriate safeguards for a restricted transfer.
15 Policy changes and contact
TPS may revise this policy when Website features, providers, or legal requirements change. The updated version will be posted here with a revised "Last updated" date. If a change materially affects how information already collected is used, TPS will provide additional notice when required.
Triple Point Strategy LLCPrivacy inquiries: contact@triplepointstrategy.com
Website: triplepointstrategy.com