Privacy Policy

Last updated: October 23, 2026

The short version

• We collect very little: your email address (and name, if you give it) when you sign up, and stats about how the site is used.
• With your permission, we use Google Analytics to understand how the site is used, and advertising tags from Meta, Google and LinkedIn so we can show Stack the Magic ads to people who visited, on Facebook, Instagram, Google and LinkedIn. They're off until you say yes in the cookie banner, you can say yes to analytics and advertising separately, and you can change your mind any time.
• We don't sell your personal information for money.
• Our tools run in your browser. What you type into a calculator or planner stays on your device.
• You can unsubscribe, update your details or delete your account at any time.

Who we are

Stack the Magic ("STM," "we," "us") is an independent publication about Walt Disney World travel planning and finance, at stackthemagic.com. Stack the Magic is owned and operated by Stack the Magic LLC, a Pennsylvania limited liability company. Questions about this policy: contact@stackthemagic.com.

What we collect, and why

When you sign up or subscribe. Your email address, and your name if you give it. We use them to send the newsletters you chose, to sign you in, and to run your account. If you ever email us, we keep that correspondence so we can reply.

When you read our emails. Our newsletter platform records whether an email was opened and which links were clicked. We use this to see which stories are useful and to keep our list healthy (for example, removing addresses that never open anything).

When you browse the site. Our hosting platform, Ghost, collects basic usage statistics: pages viewed, where visitors came from (such as a search engine or a link), and general device, browser and location information. We use these numbers in aggregate to understand what readers find useful. Ghost's statistics are collected without cookies or other browser storage, so they run whatever you choose in the banner.

If you say yes to analytics or advertising. We then load the tools you agreed to: Google Analytics if you chose analytics, and the Meta Pixel, the Google Ads tag and the LinkedIn Insight Tag if you chose advertising. Your browser connects to them directly, and they receive your IP address, a cookie or similar identifier, the pages you view on our site, and what device and browser you use:

• Google Analytics shows us which pages and tools readers use, how they got here and where they leave, so we can improve the site.
• The Meta Pixel records visits and sign-ups so we can measure our Facebook and Instagram ads and show our ads to people who've visited our site.
• The Google Ads tag does the same for Google ads and search. The LinkedIn Insight Tag does the same for our LinkedIn ads.

We also record when you join our email list, as a sign-up, so we can see which ads and posts bring readers in. We never put anything you type into a calculator or planner into these tools, and we never send them your name. The one exception is the Meta signup measurement described below. We never send LinkedIn your name or email address. If you choose "Reject all," or your browser sends a Global Privacy Control signal, none of them loads, and if you say yes to analytics only, the advertising tools stay off. We don't offer the advertising tools to browsers that report a European timezone, because our ads are aimed at the United States.

When you become a member. While you browse, the site keeps a short list of the pages you've visited in your browser's session storage, which clears when you close your browser. If you sign up, we save where you came from (for example, a search engine or another site) and the page you signed up on with your account, so we know which stories bring new readers in. If you don't sign up, that list never leaves your device.

When you comment. Members can comment on posts. Your comment and the display name you choose are public, so anyone reading the post can see them. You can edit or delete your own comments.

When you see our ads. We buy ads on Facebook, Instagram, Google and LinkedIn. If you click one, the ad platform tells us in aggregate (not by name) how many people clicked, and the link carries a campaign tag in the address (such as utm_campaign) so we can see which ad brought you. If you said yes to advertising, the tags above also let Meta, Google and LinkedIn match your visit to your own account there, which is how our ads reach you again and how they measure results. Their handling of that data is governed by their own policies, linked below.

When you use our tools. Our calculators, planners and trackers run in your web browser. Some of them, such as the Trip Planner, save your inputs in your browser's own storage so they're still there when you come back. Our homepage and topic pages also remember which tools they last suggested to you, so the next visit suggests different ones, and which of our tools and games you opened most recently, so our homepage can show them again. If you're signed in, they also keep the latest plan link from each tool, and any plan you add to a trip, so you can find them again on your My plans page, and, if you add them there, your trip dates, their names, whether you're staying at a Disney hotel or have Annual Passes, and the plans you add to each trip, and your best scores from our games. That information stays on your device and isn't sent to us. Clearing your browser's site data removes it.

We don't knowingly collect sensitive information, and we ask that you not send us any. For example, if you write to us about a food allergy, please don't include medical details beyond what you need to ask your question.

Cookies and similar technologies

We use as few as we can:

• Sign-in cookies. If you create an account, Ghost sets a cookie that keeps you signed in. It's needed for your account to work.
• Browser storage for tools. Described above. It isn't used for tracking.
• Session storage for sign-up attribution. Described above. It clears when you close your browser.
• Analytics and advertising cookies. Only if you say yes to that category. Google Analytics sets cookies (_ga, _ga_<ID>) to tell visits apart. The Meta Pixel, the Google Ads tag and the LinkedIn Insight Tag set cookies (_fbp, _gcl_au, _gcl_aw) so ads can be measured and shown to people who visited, and LinkedIn's tag can set one (li_fat_id) after a click on one of our LinkedIn ads. Each one's name, owner and lifetime is in our Cookie Policy. They're set by Google, Meta and LinkedIn, not by us. Your choice is kept in your browser's local storage under stm-consent for up to 12 months, then we ask again, and sooner if this policy changes what we collect.
• Affiliate links. When you click an affiliate link and land on a partner's site (for example a ticket seller, a stroller rental company or a credit card issuer), that partner may set its own cookie so it can credit us if you buy something. That happens on the partner's site under the partner's privacy policy, not ours. See our Affiliate Disclosure.

Ghost's own site statistics use no cookies. The cookies in the item above are off until you say yes, and nothing is placed on your device by them before then.

Changing your choice. Use the "Privacy choices" link in the footer at any time to open the banner again. Turning a category off removes its cookies from our site and reloads the page. You can also clear your browser's site data, block these cookies in your browser, or use the controls the companies offer (LinkedIn's are at linkedin.com/psettings/advertising): Google's ad settings, Meta's ad preferences, and Google's Analytics opt-out add-on.

Global Privacy Control and Do Not Track. If your browser sends a Global Privacy Control signal, we treat it as "Reject all" and load none of the measurement or advertising tags. There's no agreed standard for the older "Do Not Track" signal, so we don't change anything when we receive one.

Who we share information with

We don't sell your personal information for money. We share it only with the services that run the site for us and, if you say yes to them, with the companies below and with LinkedIn (described under the table), and only what each one needs. Under some state privacy laws, letting an advertising tag read your visit can count as "sharing for cross-context behavioral advertising," so we treat it that way and let you turn it off (see "Your choices and rights"):

LinkedIn, only if you say yes to advertising, receives the same kind of information through the LinkedIn Insight Tag (your IP address, a cookie or similar identifier, the pages you view and your device and browser) so we can measure and show our LinkedIn ads. We never send it your name or email address. LinkedIn's privacy policy is at linkedin.com/legal/privacy-policy. Meta also receives a hashed (scrambled, one-way) copy of your email address when you create an account, sent from our server through Meta's Conversions API so we can count signups from our ads. This happens independently of your cookie choices. If you said yes to advertising and came to our site from one of our Facebook or Instagram ads, that signup also carries the ad's click ID, so Meta can tell which ad brought you. To do that, when you submit a sign-up form, your browser sends our server the click ID with a hashed copy of the email address you typed. We keep that pair for up to a day, until your signup is confirmed, and then delete it. Some parts of the site load straight from outside services while you read them: the code behind our homepage, tool suggestions, My Plans page and cookie banner from Cloudflare (at assets.stackthemagic.com), fonts from Bunny Fonts, the sign-up and search pop-ups from the jsDelivr content network, many post images from Unsplash, and, in the weather tool, forecasts from the U.S. National Weather Service and park hours from ThemeParks.wiki. Your browser connects directly to those services, so they receive your IP address and basic browser information, as with any website.

When you follow a link from our site to another website, the link tells that site you came from stackthemagic.com. It doesn't say who you are.

We may also disclose information if the law requires it, to protect our rights or others' safety, or as part of a transfer if the site is ever sold or reorganized. Any new owner would be bound by this policy.

How long we keep it

We keep your account information for as long as you're a member. When you delete your account, we delete your details from our member list. Some copies may remain for a limited time in backups or in the records our service providers must keep (for example, payment records). Anonymous, aggregated statistics may be kept indefinitely. Data held by Google Analytics is kept for 14 months, and data held by Google, Meta and LinkedIn for advertising follows their own policies.

Your choices and rights

• Choose what's measured. Use "Privacy choices" in the footer to turn Google Analytics and the advertising tags on or off. If you live where the law gives you the right to opt out of "sharing" or "targeted advertising" (for example California, Colorado, Connecticut, Texas and others), that link is your opt-out, and your browser's Global Privacy Control signal is honored as one. In the UK and EU, the tags stay off until you accept them, and "Reject all" is as easy to pick as "Accept all." You can withdraw at any time, and withdrawing is as easy as agreeing.
• Unsubscribe with the link at the bottom of any newsletter, or in your account settings.
• Update your details or delete your account in your account settings, or by emailing contact@stackthemagic.com.
• Ask what we hold about you, or ask us to correct or delete it, by emailing contact@stackthemagic.com. We'll respond within 30 days, and we may need to confirm it's really you first.

Depending on where you live, you may have more rights under your local law. These include rights under California law, other U.S. state privacy laws, and the GDPR if you're in the UK or EU. We'll honor valid requests under the laws that apply to you, and we won't treat you differently for making one.

Children

Stack the Magic is written for adults planning trips. We don't knowingly collect personal information from children under 13, and we don't direct our ads to them. If you believe a child has signed up, email contact@stackthemagic.com and we'll delete the account.

Security

We use reputable providers and limit who on our team can access member information. We also limit what goes into advertising tools: they get page views and sign-up events, never anything typed into a tool, and the only personal details we send are the hashed email address and, if you said yes to advertising, the ad click ID described under "Who we share information with". No system is perfectly secure, so we can't guarantee absolute security.

Where your information is processed

Stack the Magic is based in the United States, and our providers may process information in the U.S. and elsewhere. If you're outside the U.S., your information will be transferred to and processed in the U.S.

Changes to this policy

If we make a significant change, we'll update the date at the top and, if you're a member, let you know by email before it takes effect.

Contact

Questions or requests: contact@stackthemagic.com. See also our Cookie Policy.