Skip to content
The Data Trail

Privacy policy

Updated

This policy covers The Data Trail: the website, its checks and its contact form. It explains what information we handle when you read a page, use a check or write to us, why we handle it, how long we keep it and how to ask us to delete it. If anything here is unclear, ask us and we will explain.

The short version

  • No analytics, no advertising trackers, no reader accounts.
  • Our server and our network provider, Cloudflare, see basic technical details of each visit, which are kept briefly for security.
  • The checks run in your browser and send nothing to us.
  • If you write to us, we keep your name, email address and message so we can answer, and we delete them when you ask.
  • Amazon and our CJ partners may set cookies on their own sites after you click one of their links.
  • We never sell personal information, and we never look people up.

What we do not collect

We do not put analytics scripts, advertising pixels, social media widgets or session recording on our pages. There are no reader accounts, so there are no profiles, passwords or reading histories to store. We do not buy information about our readers, and we do not combine what you send us with data from anywhere else.

The same goes for the subject of the site. We do not keep a database of people, we do not look anyone up, and we do not publish personal records. The example listings in our guides are fictional.

Server and security logs

When your browser asks for a page, the request passes through Cloudflare and then reaches our server. Like almost every web server, ours records basic technical details of each request: the IP address it came from, the user agent (a short line that names your browser and operating system), the address requested, the time and whether the request worked. We use these logs only to keep the site running, find errors and block abuse such as floods of automated requests. They are kept for a short time and then deleted, and we do not use them to piece together what any one reader has read.

Two small security measures use your IP address. The contact form keeps a short count of recent messages from each address so it cannot be flooded; that count lives in memory for a few minutes and is never stored with your message. The sign-in page for our staff dashboard records failed sign-in attempts by IP address to stop password guessing. Readers never need that page.

Cloudflare

Cloudflare delivers our pages and protects the site from attacks. To do that, it processes the same technical details our server sees (IP address, user agent, the page requested), and it may set a strictly necessary security cookie that helps it tell people from automated traffic. Cloudflare acts as our network provider, and its own privacy policy describes how it handles that information. We do not add Cloudflare's web analytics script, or any other tracking tool, to our pages.

The checks

Our checks, such as the password strength meter, the passphrase generator, the exposure quiz and the request letter builder, run entirely in your browser. What you type into them is not sent to us or to anyone else. A password you try in the password strength check never leaves your device.

Some checks remember your progress, for example the boxes you have ticked on the opt-out checklist. They save it in your browser's local storage, on your device only. We cannot see it, and it disappears when you clear this site's data in your browser settings. If you use a private window, nothing is kept after you close it.

The contact form

The contact form asks for your name, your email address and your message. We use them for one purpose: to read your message and answer it. Messages are stored on our server, where only our team can read them. We do not add you to a mailing list, and we do not share or sell what you send.

We keep a message while the conversation is open and for a reasonable time afterward, in case you write back. You can ask us to delete it at any time. Please do not send ID numbers, passwords, card numbers or copies of documents. We never need them.

Where the GDPR applies, we handle server logs under our legitimate interest in keeping the site secure, and contact messages so that we can answer the question you sent us.

Some links on the site are affiliate links. We take part in the Amazon Associates program, and we link to some partner services through CJ (Commission Junction). We do not run tracking scripts from Amazon, CJ or any partner on our pages. Some privacy guides show one partner banner to readers in the United States; its image loads from CJ's servers, which means CJ receives the request (your IP address and browser details) when the banner is shown, as with any image from another site. We do not add tracking pixels to text links.

When you click one of these links, you leave The Data Trail and arrive on the partner's site. There, Amazon, CJ or the partner may set cookies to record that you came from us, so that we can be paid a commission if you buy something or sign up. Those cookies are set by them, on their own sites, under their own privacy policies. We receive reports of clicks and commissions, never your name, your contact details or your account.

Your rights

Wherever you live, you can ask us:

  • what personal information we hold about you (for most readers that is nothing at all, or a message you sent);
  • to correct it;
  • to delete it.

Readers in the European Union and the United Kingdom have these rights under the GDPR and the UK GDPR, along with the right to object to how we use their information and the right to complain to their national data protection authority. California residents have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, to know, correct and delete personal information, and to opt out of its sale or sharing. We do not sell or share personal information as that law defines those words, so there is nothing to opt out of, but the other rights apply in full. Several other states give similar rights, and we honor the same requests from everyone.

To use any of these rights, send a request through the contact form. Say what you want (a copy, a correction or deletion) and give the email address you used if you wrote to us before. We may ask you to confirm the request from that address, so that we never hand one person's message to someone else. Requests are free, and we answer within the time the law sets: one month under the GDPR and 45 days under California's law.

Children

The Data Trail is written for adults. We do not knowingly collect information from children under 13. If a child has written to us, a parent or guardian can ask us to delete the message, and we will.

Security

The site is served only over an encrypted connection. Messages are stored on our server, out of public reach, and our staff dashboard is protected by a password and by limits on failed sign-in attempts. No system is perfectly secure, which is one more reason not to send us ID numbers or passwords.

Changes to this policy

If we change how we handle information, we will update this page and the date at the top.

Contact

Questions about this policy, and every request about your data, go through the contact form on our questions and contact page. We do not publish a postal address, a phone number or an email address.