Privacy
What this site knows about you.
Almost nothing, and only what you hand over deliberately. This page says exactly what is collected, why, and how to make it stop.
The short version
If you just read this site, no account is created, no cookies are set, and nothing about you is stored. The only personal data collected is an email address, and only if you type one in yourself — either to subscribe to the weekly report, or to create a members account.
Who is responsible
Margin & Co. is an independent research project run by one person in the United Kingdom. For data protection purposes Margin & Co. is the data controller, and can be reached at hello@marginco.co.uk. If you need the controller's registered legal identity — for example to bring a formal complaint — email that address and it will be provided to you in writing.
What is collected
If you only read the site
Nothing that identifies you. Reading the site requires no account. There is no advertising, there are no tracking pixels, and there are no analytics scripts — the site ships no JavaScript at all, which you can verify for yourself in your browser's developer tools.
The site is served through Cloudflare, which processes technical request data (IP address, browser type, page requested) to deliver pages and block attacks. This is standard infrastructure logging, it is not linked to any identity, and I do not receive a copy of it. Cloudflare's own privacy policy covers that processing.
If you subscribe
Your email address, the date you subscribed, and a record that you gave consent. That is the entire record. No name, no location, no inferred interests.
If you create a members account
Your email address, the date the account was created, and your membership tier. Sign-in is passwordless by default: you enter your email, a single-use link is sent to it, and following that link signs you in.
You may optionally set a password, and nothing happens until you choose to. If you do, what is stored is never the password itself. It is combined with a secret key held outside the account store, then put through 25,000 rounds of PBKDF2 with a random salt unique to you, and only that result is kept. The password cannot be read back out of it, by anyone, including me. Removing the password from your security settings deletes it.
If you switch on two-factor authentication, a secret used to verify your authenticator app's six-digit codes is stored alongside the account. It is used for nothing else, and turning 2FA off deletes it.
While you are signed in, a session record is held in Cloudflare storage and matched to a cookie in your browser. Signing out deletes both.
Why, and on what legal basis
A subscriber email address is used for one purpose: sending you the weekly research report. The lawful basis under UK GDPR is consent, which you give by ticking the box on the subscribe form. Consent can be withdrawn at any time, and withdrawing it is as easy as giving it.
An account email address is used to send your sign-in links and anything that is strictly part of running the account. The lawful basis is performance of a contract — you cannot be given access to a members area without a way to sign you in. Creating an account does not subscribe you to the weekly report, and does not opt you into marketing; those are separate choices you make yourself.
Neither address is used for anything else, and neither is used for advertising.
Cookies
If you are not signed in, this site sets no cookies at all.
Signing in sets one cookie, which holds a session identifier and nothing else. It is strictly necessary to keep you signed in — without it the site could not tell one request from the next — so under the UK's cookie rules it does not require consent, which is why there is no cookie banner. It is not used for tracking, analytics, or advertising. Signing out clears it, and so does deleting cookies for this site in your browser.
Who your data is shared with
Nobody. The subscriber list is not sold, rented, shared, or used for advertising. It sits in Cloudflare storage attached to this site.
If a mailing provider is used in future to actually send the emails, this page will be updated to name it before any data is transferred, not after.
How long it is kept
A subscriber record is kept until you unsubscribe, at which point it is deleted rather than flagged as inactive. If the project stops publishing, the list is deleted.
An account record is kept until you ask for the account to be deleted. A sign-in link expires 15 minutes after it is issued and is deleted the moment it is used, whichever comes first. A session expires after 30 days, or immediately when you sign out.
Your rights
Under UK GDPR you have the right to access a copy of your data, correct it, have it deleted, restrict or object to its use, and take it elsewhere. Exercising any of these costs nothing.
Email hello@marginco.co.uk and I will action it within 30 days, usually the same week. For a deletion request you do not need to give a reason.
If you think I have handled your data badly, you can complain to the Information Commissioner's Office. I would rather you told me first so I can fix it.
Security
The site is served over HTTPS only, with HSTS, a strict Content Security Policy that forbids JavaScript entirely, and clickjacking protections. Sign-in links and session identifiers are stored hashed, so the stored copy cannot be used to sign in as you. There is no payment processing on this site.
Accounts are passwordless unless you choose otherwise, so for most accounts there is no password to steal. Where one has been set, it is salted, stretched and combined with a key kept outside the account store, so a copy of that store would not be enough to work out anyone's password. Password sign-in attempts are rate limited, which is what stops a stolen address being guessed against at speed. In the interest of being straight about it: the number of hashing rounds is lower than the current OWASP recommendation, because this site runs on a hosting plan that caps how long a single request may compute for. The separate secret key is what carries that weight instead.
No system is perfectly secure. If you find a vulnerability, please email hello@marginco.co.uk — you will get a fast reply and public credit if you want it.
Changes
If this policy changes materially, the date at the top changes and subscribers are told by email before the change takes effect wherever that is practical.