Privacy at the British Resilience Index

The email list

The signup form asks for one thing: an email address. There is one list, and it is used for two things: the monthly reading, which is the new national score, what moved and the sharpest findings from the data, and The Quarterly Record, the print edition, which is sent four times a year. Whichever form you use to join, including the one that unlocks the free Record, you are joining that single list and can expect both. Nothing else is sent to that address and it is used for no other purpose.

The lawful basis is your consent. The list uses double opt in, so the address stays pending and receives nothing until you click a confirmation link, which is also the record of that consent. It is kept until you unsubscribe or ask for it to be deleted, and every email carries a one click unsubscribe link.

What happens when you press subscribe: your address goes to this site and no further, where a small piece of code checks the anti abuse challenge described below and then passes the address to EmailOctopus, the provider that stores the list and sends the email. That code runs on Cloudflare, holds no database and writes nothing down, so the project keeps no copy of your address outside EmailOctopus. It exists so that the key to the mailing list never has to be published in the page, and so that nobody can use this site to send confirmation mail to an address that never asked for it.

Analytics, and why there is no cookie banner

The project counts page views so it knows which analyses are worth writing more of. The tool is PostHog, on its EU cloud, and it is deliberately set up in its least invasive configuration: no cookies, no identifier written to your device, no session recording and no automatic capture of what you click. A handful of deliberate events are recorded, such as a share, a council lookup, a deep dive read (the page open for 30 seconds and scrolled past half way), a click on a data file download, or the steps of a newsletter signup (submitted, accepted or failed, never the address itself) and the place on the site it came from. PostHog honours Do Not Track: if your browser sends it, nothing is recorded there.

A second counter, Pulse, is a small analytics service the author of this site wrote and runs, hosted on Cloudflare at pulse.jimi.land. It works in two parts. A script in the page reports the page you are on together with any query string in its address, the address of the site that linked you here, a screen size bucket and three coarse signals that help tell a browser from an automated script. Pulse keeps the host name of the linking site but not the full link, and keeps only the utm campaign tags from the query string. From the request that carries the report it also keeps your country, and the browser, operating system and device type read from your browser string, which is itself not stored; the device type is set by the screen size bucket. The three signals are kept, along with two more that Pulse reads from the request itself: the browser brand names it announces, without version numbers, and a count of the languages it accepts. Your visit is recorded under a code made fresh each day from your connection and browser details together with a secret that changes daily; it cannot be turned back into either, so the same person is recognised within a day and never across days. Nothing is written to your device.

Separately, the server that delivers each page tells Pulse which page was served, the address of the page that linked to it reduced to its site and path with any query text removed, and whether it was served, blocked or failed, so that automated crawlers, which never run the script, can be counted. For a request that looks like a current browser, that note carries no IP address and no browser string. If a request announces itself as a crawler, carries a crawler signature, or does not send the headers a current browser sends, the IP address and browser string are forwarded, together with the number and name of the network the request came from, so the request can be checked against a list of known crawlers and the operator of an unrecognised one can be identified. Pulse stores neither for a visit it recognises as human; for a crawler it does not recognise it keeps one recent IP address, overwritten on each visit, for a reverse lookup of the operator. Individual visit records are deleted after 90 days and only daily totals remain; that one crawler sample address sits outside the 90 day schedule and is replaced, not accumulated, each time the crawler returns.

If your browser sends Do Not Track or Global Privacy Control, the Pulse script is not loaded at all and the server side note is not sent. Cloudflare hosts both this site and Pulse and, like any host, sees the technical details of every request as part of delivering it; what Cloudflare itself logs is governed by its own notice, and this one cannot speak for it.

Because nothing is stored on or read from your device, the rules that require a cookie banner do not apply. The honest cost of that choice is that visitor counts here are approximate, since the same person visiting twice cannot be recognised.

Cloudflare serves the site and, as any web server must, sees the IP address and browser details of each request in order to return the page. Beyond delivery, your IP address is passed on in two cases: to Pulse when a request looks automated, as described above, and to Cloudflare when you subscribe. The signup form carries one further piece of Cloudflare: Turnstile, a challenge that tells a person from a script. The widget is created as soon as a page carrying a signup form loads, not only when you subscribe, so Cloudflare receives the request for the challenge, and with it your IP address, at that point; when you do subscribe, the challenge result is sent to Cloudflare again to be verified. It replaced the alternative, Google reCAPTCHA, precisely because that would have reported readers who merely scrolled past the form to an advertising company.

Who else can see your data

Four services process data on the project’s behalf: three companies and one service the author runs. There are no others, and none of them is permitted to use your data for their own purposes.

Your rights

Under UK data protection law you can:

• Ask what the project holds about you, and get a copy
• Have it corrected if it is wrong
• Have it erased
• Withdraw consent at any time, which for the newsletter is the unsubscribe link in every email
• Object to or ask for a restriction on how it is used

To exercise any of them, email [email protected]Copyor open in your mail app. Since the only record is usually an email address, the fastest route to erasure is often the unsubscribe link itself.

If you are unhappy with how the project has handled your data, you can complain to the Information Commissioner’s Office, the UK regulator, at ico.org.uk.