Spoiler alert, we collect almost none

Somewhere in a Californian datacenter, not ours, we’re in Switzerland, an advertising algorithm is bored stiff. No tracking cookie to crunch, no spy pixel to monetize, no behavioral profile to resell. MacSouverain has no interest in knowing who you are. What follows is the honest list of the bare technical minimum, and nothing more.

In practice

Cookies: no tracking, advertising or analytics cookies. See the Cookie policy for the details, spoiler, it’s short.

Server logs: the server records requests for 7 days, to spot a bug or an attack. Even with Cloudflare out front, some automated traffic (scanners, bots) still reaches the server, hence these logs. One big difference from the rest of the web, your IP address is truncated the moment it’s written, we cut off the end, the part that could lead back to you. So we never keep your IP in the clear. That’s the bare technical minimum a server needs to stay standing, nothing more. A little honesty in passing, when a page travels through our delivery intermediary (Cloudflare), it does see your IP for the length of the trip, like any router between your browser and the server. The part we control, we’ve cut down to the minimum.

Audience measurement: we use Plausible, self-hosted, without cookies and without storing your IP address. It produces nothing but aggregate counters, how many times an article was read, from which country, through which source. We can see that an article was read 300 times. We have no idea by whom.

Advertising, affiliate links: none. No ads, no affiliate links, no commission. MacSouverain sells nothing and earns nothing on anything whatsoever.

Scripts: everything is served from macsouverain.com. Zero third-party tracking scripts. What you type into the search box stays between your browser and the server.

Who is responsible for your data

The processing described here is carried out by the site’s publisher (see Legal notice), established in Andorra. For any question or to exercise your rights, write to [email protected].

What we process, and why

• Web server logs. Data: truncated IP address (never in the clear), requests. Legal basis: legitimate interest (security, diagnostics). Retention: 7 days.
• Audience measurement (Plausible, self-hosted). Data: aggregate counters, no IP, no cookie. Legal basis: legitimate interest. Retention: aggregated, non-identifying.
• Delivery via the CDN (Cloudflare). Data: IP address (in transit). Legal basis: legitimate interest (availability, anti-abuse). Retention: per Cloudflare.

Why truncate rather than keep

A full IP address is a piece of data that can point to you. A truncated IP is a number too imprecise to trace back to a person, but precise enough to see that a burst of requests comes from the same network, and to tell an attack apart from an ordinary visitor. So we keep the minimum that serves a purpose, for 7 days, and not one identifying byte more. The less we store, the less there is to leak. It’s the whole logic of the site, applied to ourselves.

Transfers outside the European Economic Area

The site is hosted in Switzerland (Infomaniak), a country recognized as offering an adequate level of protection. Delivery goes through Cloudflare (United States), and this transfer is covered by appropriate safeguards (standard contractual clauses, Data Privacy Framework as the case may be).

Your rights

You have the rights of access, rectification, erasure, objection, restriction and, where applicable, portability, as well as the right to set directives on what happens to your data after your death. To exercise them, write to [email protected]. In practice, MacSouverain holds no account, no subscriber, no name-based database, so most of these rights simply have no object here. But you have the right to know, so it’s said.

Complaint

You can lodge a complaint with the Andorran data protection authority, the APDA (Agència Andorrana de Protecció de Dades). If you reside in the European Union, you can also turn to your own country’s authority (in France, the CNIL).

Applicable law

The processing is governed by Andorran law 29/2021 of 28 October 2021 on the protection of personal data, and, for visitors from the European Union, by the General Data Protection Regulation (GDPR, EU 2016/679).

Why it’s this short

Because the privacy industry invented the 12,000-word privacy policy that nobody reads and that ultimately authorizes the opposite of what it claims to govern. Here, we keep it short because we do little. That’s the whole point.

A question?

Write to me, I answer: [email protected].