Privacy Policy

The principle

We use no third-party trackers and no third-party analytics, and we set no cookie of any kind on a reader's browser. Not one.

We do not sell or share your data, we carry no advertising, and we feed nothing we know about you into any external system. What we never collect cannot leak, and cannot be demanded from us.

What we collect, and why

• Newsletter: your address, your language, and the desks you chose to follow. Subscription is double opt-in — nothing is sent until you click a confirmation link valid for 48 hours, and the confirmation token is stored hashed, never in the clear. Every mail carries an unsubscribe link and an unsubscribe header your mail client understands on its own.
• Citizen reports: your name and the text of your report. Email and phone are optional — leave them out if you would rather follow the case by its reference number alone. We use them to reply to you and to verify the account, and for nothing else.
• Citizen Lens: a photo is uploaded only with your explicit declaration of rights over it, within thirty minutes of the report. It is held in a private path that is never served publicly; if it is rejected it is deleted, and if it is accepted it is published credited to you.

How we measure readership

We want to know that a piece was read, not who read it. The measurement ping carries no cookie, and is cancelled outright if your browser sends the Global Privacy Control signal — as it is for automated visitors and for our own newsroom.

Your IP address and browser string are passed through a hash with a salt that is regenerated every day and exists only in the server's live memory — it is never written to the database. The result lives for minutes, purely to stop one reader being counted twice, and then it is gone.

What reaches the database is aggregate counts only: how many reads this piece had today in this language. The source of a visit is recorded as a category ('search', 'social', 'direct'), never as a URL.

How long we keep it

• A rejected report: ninety days, then deleted automatically.
• A report answered or referred: one year, then deleted automatically.
• A report still open: kept for as long as it is open.
• Aggregate readership counts: two years.
• A newsletter subscription: until you end it.

Who we share it with

Nobody. No analytics provider, no ad network, no email marketing platform: our mail is sent from the project's own server, so your address never passes through a third party.

The one possible exception is a binding legal request from a competent authority — and even then we cannot hand over what we never collected.

On your own device

Your browser stores your dark-mode preference locally; none of it reaches us. The service worker keeps copies of pages and static files so the site works offline — and it never touches API calls. Clearing site data in your browser removes both.

The only cookies we set belong to newsroom accounts at sign-in. None is ever created for a reader.

Your rights, and how to use them

To request a copy of your data, its correction, or its deletion, write through the Voice of the Citizen page describing what you want; you will receive a reference number to follow it. To end a newsletter subscription, the link at the foot of any mail from us is enough.

In full disclosure: the publishing entity's registration details and postal address are not yet published — the ownership, funding and contact pages are still being prepared. Until they are, the Voice of the Citizen page is our only official channel, and it is answered.