Privacy policy
What we collect, why, and how to get rid of it.
Who we are
The Research Brief is published by The Research Brief, London. For any question about your data, write to hello@theresearchbrief.co.uk and we will answer.
What we collect
| Data | Why | Kept |
|---|---|---|
| Your email address | To send you the issue you asked for, one welcome email when you join, and — after a free month — one email when it ends | Until you unsubscribe, then a suppression record (below) |
| Whether you confirmed it, and when | So we never email an address that did not ask | As above |
| Which page you signed up from | To know which parts of the site bring readers in | As above |
| How you found us, if your browser told us when you arrived: the link you followed (for example, the one on our Instagram profile), the website you came from, and the first page you landed on | To know which of our channels bring readers in | As above |
| Your answer to “where did you hear about us?”, if you choose to give one | The same | As above |
| That you unsubscribed, and by which route | To keep you off the list, and to tell a one-click opt-out from a link in an issue | Kept — it is what stops you being re-added |
| Subscription status and renewal date | To know whether you can read members’ sections | While you are a member, then as required for accounting |
| Your Stripe customer and subscription reference | To link your membership to the payment record, and to cancel it | As above |
| If you comment on one of our Instagram posts to ask for a free month: your Instagram account ID and username, the comment, when you made it, and the one-time link we sent you (stored only as a hash) | To send you the link, and to offer one free month per Instagram account | Kept, so the same account is not offered again; ask us to erase it |
| If you take a free month: when it starts and ends, and whether you were already on our list | To give you the full Brief for the month, to allow one free month per email address, and to know whether to take you off the list when it ends | Kept, so the address is not given a second free month; ask us to erase it |
| A one-time sign-in link (stored only as a hash) | To let you sign in without a password | Expires in 20 minutes; the record is deleted within the hour |
| A sign-in session cookie | To keep you signed in | 30 days, or until you sign out |
That is the complete list of what we hold about you. We do not use tracking pixels, we do not log which issues or sections you read, we do not build a profile of you, and we have never sold or shared a reader’s address with anyone.
Website statistics
We use Cloudflare Web Analytics to count how many people visit and which pages they land on. It is deliberately the least invasive option we could find: it sets no cookie and stores nothing on your device. It does not follow you between sites, and it cannot tell us that a particular person read a particular page.
What it records is aggregate and anonymous: page views, the page that referred you, rough country, and browser type. Nothing in it is linked to your email address or your subscription, and none of it is used for advertising.
When you follow one of our own short links — such as theresearchbrief.co.uk/ig — we count the click: which link, and when. Nothing about you is recorded with it. If you then sign up, the link you came through is noted on your subscription, as listed above. We remember it only while the page is open, never by storing anything on your device.
This is also why this site has no cookie banner. Banners exist because most analytics store something on your device and need your consent to do it. Ours does not, so there is nothing to ask you about.
We do not track whether you open an issue and we do not track which links you click. Those things are possible — most newsletters do them using an invisible image — and we have chosen not to. It follows that we cannot tell you what our open rate is, because we genuinely do not know.
What happens when you unsubscribe
You come off the sending list immediately. We keep your address on a suppression record rather than erasing the row outright, because that record is the thing that prevents you being added back by a later import or a mistyped signup. It is used for nothing else: no email is sent to it, and it is never shared.
If you would rather be erased completely, say so and we will do it — see Your rights below. The one consequence worth knowing is that we then have no way to recognise the address, so nothing stops it being re-subscribed in future.
Card details
We never see them. Payments are handled entirely by Stripe on their own pages; your card number does not pass through our servers and is not stored by us at any point. We receive only your email address, whether the payment succeeded, and when the subscription renews.
Cookies
One cookie, rb_session, set only after you sign in. It holds your email address and an expiry, signed so it cannot be tampered with, and is marked HttpOnly so no script can read it. There are no advertising or analytics cookies, which is why this site has no cookie banner — there is nothing to consent to.
Who else processes your data
- Supabase — the database holding your address and subscription status.
- Stripe — payments and billing. Their privacy policy governs the card data they hold.
- Resend — sends the issue, the confirmation email, and sign-in links.
- Meta (Instagram) — if you comment to ask for a free month, we read that comment and send the link as a private message through Instagram. Meta’s own privacy policy governs what Instagram holds.
- TikTok — we prepare posts for our own TikTok account and place them in that account’s drafts, where we publish them ourselves. To do that we hold access credentials for our own account only. We receive and keep no information about you if you view, like or comment on our posts there. TikTok’s own privacy policy governs what TikTok holds.
- Google (YouTube) — we upload our own videos to our own YouTube channel. See YouTube below.
- Cloudflare — the anonymous, cookieless visitor statistics described above. It receives no email address and no subscription information.
Each is a processor acting on our instructions. None of them is permitted to use your address for their own purposes.
YouTube
We use YouTube API Services to upload our own videos to our own YouTube channel. By watching or interacting with our videos on YouTube you are subject to the YouTube Terms of Service, and Google’s handling of your data is governed by the Google Privacy Policy.
The only data we hold from YouTube is the access credential for our own channel, stored in our database so that the upload can run, and the identifier and link of each video we upload. We do not access, collect, store or share any information about people who view, like, comment on or subscribe to our videos. No reader signs in to this website with a Google account.
The channel owner can withdraw our access at any time from Google’s security settings at security.google.com/settings/security/permissions. Once access is withdrawn, the stored credential stops working. To ask us to delete anything we hold, write to hello@theresearchbrief.co.uk.
Your rights
Under UK GDPR you can ask for a copy of everything we hold about you, ask us to correct it, or ask us to delete it. Write to hello@theresearchbrief.co.uk. We will respond within one month. Deletion on request means the row is removed, not flagged — including the suppression record described above, if that is what you want.
One limit we cannot get around: where you have paid us, UK tax law requires the transaction record to be kept for six years. That is held by Stripe as well as by us, and it is the only category we cannot erase on request.
You can remove yourself at any time without asking us: every issue carries a one-click unsubscribe link, and it works without signing in.
Complaints
If you think we have handled your data badly, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.