Privacy policy

Gekko & Fox is a report you read. Every issue is open without an account. The site sets no cookie until you sign in or choose a theme. Its analytics store nothing on your device. The personal data handled is: what a web server sees for a moment to send a page, an anonymous count of visits, your email address if you sign in, and what you send if you write to us. This page states what that data is, how long it is kept, and your rights.

1. Who is responsible

The publisher of Gekko & Fox is the controller of any personal data described here. Its name, address and email are in the last section of this page. This policy follows the EU General Data Protection Regulation (GDPR) and Swedish law.

2. Reading the site

When your browser asks for a page it sends what every browser sends: your IP address, the address of the page, the time, the page you came from if any, and a description of your browser. Cloudflare, which serves the site from its network, uses this to deliver the page, keep the site reachable and block abuse. We can see the same data in Cloudflare's request logs for the short time Cloudflare keeps them, and we look at it only to find faults and attacks. We copy none of it, build no profiles and store IP addresses nowhere else.

The issue you read is fetched from our own server by the code that renders the page, not by your browser. That request carries nothing about you. Our server holds the issues and never sees a reader.

Analytics. We count how the site is used with PostHog (EU region): which pages are read, for how long, from which country and on what kind of device, how the page performs, where readers click and scroll, and a handful of actions such as sharing an issue or saving a calendar entry. The analytics are cookieless: nothing is stored on your device, no cookie, no local storage. To count visitors, PostHog computes an anonymous identifier on its servers from your IP address and browser together with a salt that changes every day, so it can link your page views within one day and never across days. Your IP address is not kept. Text on the page, what you type and the contents of any form are never recorded. If you sign in, usage is linked to your account's random identifier, never to your email address. We honor your browser's Do Not Track setting: with it on, nothing is recorded.

Legal basis: our legitimate interest in running a site that works, is not abused, and improves from how it is read (GDPR article 6(1)(f)).

3. What stays in your browser

Until you sign in or choose a theme, we set no cookies. When you sign in, your browser receives a session cookie that keeps you signed in on this site. It holds a signed token, not your address in clear text; it is sent only to this site; and it goes when you sign out, or expires on its own when you have not been back for a long time. It is strictly necessary for the service you asked for by signing in, so no consent is required under the Swedish Electronic Communications Act. Cloudflare may set one security cookie when it has to tell a person's browser from an automated attack; it holds no personal information and we do not read it.

If you set light or dark with the theme switch, that one word is stored in a cookie named gf-theme for a year, so the page opens the same way next time. It is sent only to this site and holds nothing but the word. If you are signed in, the same word is saved with your account, so your other devices open the same way once you sign in there. Your browser's "clear site data" removes the cookie; signing out leaves it. Because it stores only a setting you asked for, no consent is required for it either.

The other buttons work the same way. "Download PDF" is your browser's own print function. "Share" copies the page's address to your clipboard. "Add to calendar" builds the calendar file in your browser and your browser saves it. None of these contacts us, beyond the anonymous count in section 2 that one of them was used.

4. Signing in

You can sign in with your email address, or with a Google or Apple account where that button is offered. With email, we send a six-digit code to the address you give; it works once and expires within an hour, and we keep only a scrambled form of it, for at most a day. With Google or Apple, the provider confirms your email address to us, and your name if you choose to share it; we receive nothing else, and we neither read nor post anything on your behalf there. What Google or Apple record about that sign-in is governed by their own policies.

Signing in creates an account. It holds your email address, when you signed in, and, with Google or Apple, the provider's stable identifier for you, so that the account stays yours if that email address changes. If you set a theme while signed in, the account keeps that one word too (section 3). We use the account to know you are you when you come back, and for nothing else today: no newsletter, no profile, no marketing. If we add something that uses it, such as a subscription, this page will say so before it starts.

One address is one account. The same address signs in to this site and to the publisher's other sites; each site records only that you use it, and signing out of one does not sign you out of the others.

Legal basis: performance of the service you asked for by signing in (GDPR article 6(1)(b)). You can delete your account at any time by writing to us; we delete it within a month, or at once if you ask for that.

5. Writing to us

If you email us, we keep your message and our reply for as long as the matter is open and for up to 24 months after, unless a law requires us to keep it longer. Our email is hosted by Google (Google Workspace), which processes it on our behalf under its data processing terms. We use your address only to answer you.

Legal basis: our legitimate interest in answering the people who write to us (GDPR article 6(1)(f)), and your consent where you ask us to contact you.

There is no newsletter today. If we add one, this page will say what it collects before you can sign up.

6. Links to other sites

An issue links to its sources, to the sites of the companies it names, and to the providers of its data. Those sites are not ours; what they collect is governed by their own policies. A link is a link: following one tells us nothing.

7. Who processes data for us, and where

• Cloudflare (Cloudflare, Inc. and its EU affiliate) serves the site, protects it and keeps the request logs in section 2. Pages are served from the Cloudflare location nearest you; which one is Cloudflare's routing, not a setting of ours.
• Supabase (Supabase, Inc.) runs the account database in section 4, in Frankfurt, Germany. It holds your email address, the sign-in details described there and, if you set one while signed in, your theme, and nothing else about you.
• Mailjet (Mailjet SAS, Paris, a Sinch company) sends the sign-in code email, from servers in the EU. It sees your address and the code; the email carries no tracking.
• PostHog (PostHog, Inc.) runs the cookieless analytics in section 2, in its EU region.
• Google (Google LLC and Google Ireland Limited) hosts our email.

All five are bound by data processing agreements. Where one processes personal data outside the EEA, the transfer rests on the EU–US Data Privacy Framework, to which Cloudflare, Supabase, PostHog and Google are certified, and on the EU Standard Contractual Clauses. Our own servers are in the EU. Google and Apple, when you sign in with them, act on their own account, not for us.

8. How long we keep things

• Request logs: for the short time Cloudflare keeps them; we copy none of them.
• Analytics: anonymous, with no identifier that outlives the day it was made; kept in aggregate.
• Your account: until you delete it, or ask us to.
• Sign-in codes: in scrambled form, for at most a day.
• Email correspondence: until the matter is closed and up to 24 months after.
• Your theme setting: in your browser, until you clear it; on your account, until you delete the account.

Nothing else is kept.

9. Your rights

You have the right to ask what personal data we hold about you and to receive a copy, to have it corrected or erased, to restrict or object to how we process it, to receive it in a portable form, and to withdraw any consent you have given. To exercise a right, write to us; we answer within a month. We make no automated decisions about you and do no profiling.

If you believe we handle your data wrongly, you may complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), imy.se, or to the data protection authority where you live.

10. Children

The site is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has written to us or opened an account, tell us and we will delete it.

11. Security

The site is served over HTTPS only. The account database holds your email address, the sign-in details in section 4 and, if you set one while signed in, your theme, and nothing else about you; it is reachable only by our own server, never by the page in your browser. Sign-in codes are stored scrambled and die within the hour. The request logs and the analytics are visible to the people who run the site and to no one else.

12. Changes to this policy

The date at the top of this page is the date of the version you are reading. If we change what we collect, the change is described here before it takes effect.

13. Publisher and controller

Gekko & Fox is published by, and the controller of personal data under this policy is:

A company established in the EU; no representative under GDPR article 27 is required.