Privacy policy

In short: This site sets no cookies and runs no ads, third-party trackers or third-party scripts. If you subscribe to the newsletter, we store your email address, the language edition, the form you used, your IP address, your browser’s user-agent string and the date and time of sign-up. Our visitor analytics count visits in aggregate and never store your IP address.

This text is a working version prepared by the editorial team and has not yet been reviewed by a lawyer.

Who is responsible

The publisher of this site is responsible for the personal data described here. The contact page is the channel for all privacy questions and requests.

The newsletter is optional. The sign-up form asks for your email address. Two hidden fields record the language of the page and which form you used, such as the footer or the newsletter page.

Each subscriber record contains only the data listed below. It does not include your name or location. We do not currently track email opens.

Data	Why	Legal basis (GDPR / UK GDPR)	How long
Email address	To send you the newsletter	Consent, Art. 6(1)(a)	Until you unsubscribe or ask us to delete it
Language edition	To send it in your language	Consent, Art. 6(1)(a)	Until you unsubscribe or ask us to delete it
Source (which form)	To record which sign-up form was used	Consent, Art. 6(1)(a)	Until you unsubscribe or ask us to delete it
IP address	To prevent abuse and spam, and document your sign-up	Legitimate interest in preventing abuse and documenting consent, Art. 6(1)(f)	Until you unsubscribe or ask us to delete it
Browser user-agent string (truncated to 200 characters)	To prevent abuse and spam, and document your sign-up	Legitimate interest in preventing abuse and documenting consent, Art. 6(1)(f)	Until you unsubscribe or ask us to delete it
Date and time of sign-up (UTC)	To record when you subscribed	Consent, Art. 6(1)(a)	Until you unsubscribe or ask us to delete it

You can withdraw your consent at any time.

The form also contains a hidden anti-spam field that people never fill in. If it is filled in, nothing is stored.

We limit sign-ups to 10 attempts per IP address per 10 minutes. This count is kept in memory only, not stored. If you sign up twice with the same address, nothing new is stored. The service does not reveal whether an address is already subscribed.

What we collect when you read the site

We count visits with GoatCounter, an open-source analytics tool that we run on our own server. It is not a third-party service.

GoatCounter records:

The page path you visited
The referrer (the page you came from)
The browser family and operating-system family
Screen size
Country, derived from your IP address at the moment of the visit

These data are stored as aggregate counts. GoatCounter uses no cookies, no local storage, no fingerprinting profile and no cross-site tracking.

To distinguish a repeat view from a new visit using a random ID, GoatCounter uses your IP address and user-agent only in memory for up to 8 hours. They are never written to the analytics database or to disk. This is separate from the IP address and user-agent stored when you subscribe.

Our web server is not configured to keep access logs.

Our legal basis for analytics is legitimate interest in knowing which pages are read. No personal data is stored by the analytics.

What we do not do

We do not sell or share personal information.
We do not show ads or use targeted or cross-context behavioral advertising.
We do not profile readers or subscribers.
We do not load third-party scripts, trackers, social widgets or embedded videos.

Fonts are hosted on our server. Pages make no requests to other domains. There are no cookies anywhere on the site.

Where the data is stored

We use our own rented server (a VPS) at a hosting provider in Germany, in the European Union. Newsletter data and analytics stay on that server. Downloads such as PDF and ZIP files are served from the same server.

If you read from outside the EU, including the US, the UK, Australia or India, this means your data is processed in Germany. For readers in Brazil, storing data in Germany is an international transfer under the LGPD.

Email sending

Newsletter sending has not started yet, and we do not use an external email provider. When sending starts, we will email you from our own sender address. If we ever use an email delivery service, we will name it on this page before your address is passed to it. We never sell or share your address.

Automated unsubscribe links are not in place yet. To unsubscribe, ask us at any time through the contact page and we remove your record by hand.

How long we keep it

Subscriber data is kept until you unsubscribe or ask us to delete it. There is no automatic expiry yet. When you unsubscribe or ask for deletion, we delete your whole record: email address, language edition, source, IP address, user-agent, and sign-up date and time.

Analytics store only aggregate counts. The analytics use of your IP address and user-agent is limited to memory for up to 8 hours; neither is stored in the analytics database or on disk.

Your rights

We honor requests to know, delete and correct personal information from everyone, wherever they live.

US state privacy laws, including California’s CCPA/CPRA and similar state laws, provide the context for these rights. We do not sell or share personal information, use targeted or cross-context behavioral advertising, or profile you. We do not discriminate against anyone for exercising privacy rights.

UK GDPR and EU GDPR: rights include access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaints to a supervisory authority.

Other jurisdiction-specific frameworks include:

Brazil, LGPD (Law 13.709/2018), Article 18: confirmation of processing, access, correction, anonymization, blocking or deletion, portability, information about sharing, and revocation of consent.
Mexico, LFPDPPP, published in the Official Journal of the Federation on March 20, 2025: ARCO rights (access, rectification, cancellation and opposition), plus revocation of consent.
Colombia: Law 1581 of 2012, the habeas data framework.
Argentina: Law 25.326.

How to use your rights

Send your request through the contact page. We reply within one month. For requests under the LGPD, we reply within the legal deadline.

We may ask you to confirm that you own the subscribed address by writing from that address. Use the same contact page for requests under any of the frameworks listed above.

Complaints to an authority

You can complain to a data protection authority:

EU: a supervisory authority in your country of residence, including the CNIL in France or the AEPD in Spain
UK: the ICO
Brazil: the ANPD
Mexico: the Secretariat of Anti-Corruption and Good Governance, which took over the INAI’s data protection role
Colombia: the Superintendency of Industry and Commerce (SIC)
Argentina: the AAIP

Children

This site is not directed at children. We do not knowingly collect data from anyone under 16.

Changes to this policy

Material changes are dated at the top of this page through the “Last updated” date. Once newsletter sending starts, we will also announce material changes to subscribers.