Spoiler alert, we collect almost none

Somewhere in a Californian datacenter, not ours, we’re in Switzerland, an advertising algorithm is bored stiff. No tracking cookie to crunch, no spy pixel to monetize, no behavioral profile to resell. MacSouverain has no interest in knowing who you are. What follows is the honest list of the bare technical minimum, and nothing more.

In practice

Cookies: no tracking, advertising or analytics cookies. See the Cookie policy for the details, spoiler, it’s short.

Server logs: the server records requests for 7 days at most, to spot a bug or an attack. Even with Cloudflare out front, some automated traffic (scanners, bots) still reaches the server, hence these logs.

One big difference from the rest of the web, your IP address is truncated the moment it’s written, we cut off the end, the part that could lead back to you. In the visit log, we never keep your IP in the clear.

The one exception is the server’s log of serious errors, which the software can’t truncate. It only fills up when a request genuinely crashes, it stays almost empty, and it too is gone after 7 days. When a request looks like an attack, our monitoring tool keeps an alert, for longer, to track attacks over time.

That’s the bare technical minimum a server needs to stay standing, nothing more. A little honesty in passing, when a page travels through our delivery intermediary (Cloudflare), it does see your IP for the length of the trip, like any router between your browser and the server. The part we control, we’ve cut down to the minimum.

Audience measurement: we use GoatCounter, self-hosted on the site’s own server, in Switzerland. No cookies, and its counting script is served from macsouverain.com, like everything else. If your browser sends a Do Not Track signal, it counts nothing at all.

It keeps the country and the language, never the region or the city. Your IP address is only used to work out the country, and it is not stored. To avoid counting the same visit twice, it relies on a cookieless session counter.

What’s left is nothing but aggregate, non-identifying counters, how many times an article was read, from which country, in which language, through which source. The dashboard is private, nothing is public. We can see that an article was read 300 times. We have no idea by whom. The little ?ref=mastodon or ?ref=bluesky you see on the links I share is there for that alone, knowing where the visit came from. It says nothing about you.

Advertising, affiliate links: none. No ads, no affiliate links, no commission. MacSouverain sells nothing and earns nothing on anything whatsoever.

Scripts: everything is served from macsouverain.com. Zero third-party tracking scripts. What you type into the search box stays between your browser and the server.

Who is responsible for your data

The processing described here is carried out by the site’s publisher (see Legal notice), established in Andorra. For any question or to exercise your rights, write to [email protected].

What we process, and why

• Web server logs. Data: truncated IP address for requests, full in the serious-error log (rare), requests. Legal basis: legitimate interest (security, diagnostics). Retention: 7 days at most.
• Security alerts. Data: suspicious requests and their IP (truncated, except for serious errors). Legal basis: legitimate interest (security). Retention: as long as needed to track attacks.
• Audience measurement (GoatCounter, self-hosted in Switzerland). Data: aggregate counters (country, language, page, source of the visit), IP not stored, no cookie, disabled if your browser sends Do Not Track. Legal basis: legitimate interest. Retention: aggregated, non-identifying.
• Delivery via the CDN (Cloudflare). Data: IP address (in transit). Legal basis: legitimate interest (availability, anti-abuse). Retention: per Cloudflare.

Why truncate rather than keep

A full IP address is a piece of data that can point to you. A truncated IP is a number too imprecise to trace back to a person, but precise enough to see that a burst of requests comes from the same network, and to tell an attack apart from an ordinary visitor. So we keep the minimum that serves a purpose, for 7 days at most, and not one identifying byte more. The less we store, the less there is to leak. It’s the whole logic of the site, applied to ourselves.

Transfers outside the European Economic Area

The site is hosted in Switzerland (Infomaniak), a country recognized as offering an adequate level of protection. Delivery goes through Cloudflare (United States), and this transfer is covered by appropriate safeguards (standard contractual clauses, Data Privacy Framework as the case may be).

Your rights

You have the rights of access, rectification, erasure, objection, restriction and, where applicable, portability, as well as the right to set directives on what happens to your data after your death. To exercise them, write to [email protected]. In practice, MacSouverain holds no account, no subscriber, no name-based database, so most of these rights simply have no object here. But you have the right to know, so it’s said.

Complaint

You can lodge a complaint with the Andorran data protection authority, the APDA (Agència Andorrana de Protecció de Dades). If you reside in the European Union, you can also turn to your own country’s authority (in France, the CNIL).

Applicable law

The processing is governed by Andorran law 29/2021 of 28 October 2021 on the protection of personal data, and, for visitors from the European Union, by the General Data Protection Regulation (GDPR, EU 2016/679).

Why it’s this short

Because the privacy industry invented the 12,000-word privacy policy that nobody reads and that ultimately authorizes the opposite of what it claims to govern. Here, we keep it short because we do little. That’s the whole point.

A question?

Write to me, I answer: [email protected].