Privacy
This site collects as little as it can. That is not a slogan — the list below is the whole of it, and most of the site collects nothing at all.
Reading cobnuts.net involves no tracking. There is no analytics, no advertising, no third-party scripts beyond a single anti-spam widget on the signup form, and no cookies. Nothing follows you between pages, and nothing is sold or shared with anyone.
The mailing list#
The one place this site takes anything from you is the mailing-list form.
What is stored: your email address, the time you signed up, whether you have confirmed, which page you signed up from, and two random tokens (one for the confirmation link, one for the unsubscribe link). The tokens are stored hashed, so the links in your email cannot be reconstructed from the database.
What is not stored: your name, your IP address, your location, your browser, or anything about what you read on this site. None of it is collected, so none of it can be lost or handed over.
Why: to email you occasionally about Cobnuts. Nothing else. The list is not rented, sold, or shared.
The legal basis is your consent, given by confirming. This is a double opt-in list: signing up sends you an email, and you are not on the list until you click the link in it. If you never click, the pending record expires and is deleted after seven days.
How long: until you unsubscribe. There is an unsubscribe link in every email and it works in one click, with no login and no "are you sure". Unsubscribing deletes the record rather than flagging it — there is no suppression list with your address on it afterwards.
Anti-spam#
The signup form uses Cloudflare Turnstile, which checks that a form submission comes from a person rather than a script. It is a privacy-preserving alternative to reCAPTCHA: it does not use cookies for tracking and does not build an advertising profile. It runs only on pages with a signup form.
To stop one script submitting the form thousands of times, the number of signup attempts from an IP address is counted in a short-lived counter. The counter holds a count against an address for one hour and then expires on its own. It is never written to the database and is not connected to your subscription.
Hosting#
The site runs on Cloudflare Workers, with data in Cloudflare D1 (in the EU) and images in Cloudflare R2. Cloudflare processes requests on our behalf and keeps its own operational logs; see the Cloudflare privacy policy.
Confirmation and welcome emails are sent through Mailgun, using their EU infrastructure. Mailgun therefore handles your address in order to deliver those messages; see the Mailgun privacy policy.
The community forum at forum.cobnuts.net runs separate software (Discourse) on a server in Germany, and it keeps its own account data — a username, an email address, and what you post. If you never make a forum account, none of that exists. Posting on a public forum is public.
Your rights#
If you are in the UK or EU, the GDPR gives you the right to see what is held about you, correct it, take it elsewhere, or have it deleted.
For the mailing list, the fastest route is the unsubscribe link in any email — it deletes your record immediately and needs no request. For anything else, or if you want confirmation in writing, email privacy@cobnuts.net and you will get an answer within 30 days.
Given what is stored, an access request will return your email address, your signup date, and whether you confirmed. There is nothing else to send.
Children#
This site is not directed at children under 13, and the mailing list is not intended for them.
Changes#
If this policy changes in a way that affects what is collected, the change will be noted in the devlog rather than made silently. The date at the top of this page is when it was last revised.