What we collect, and what we don't.

The short version

This site sets no cookies and runs no advertising code in your browser. We measure how essays are read, in aggregate, without knowing who you are. If you subscribe to the newsletter, we get your email address (because that is what a newsletter is) and nothing else you didn't type in. If you got here by clicking one of our ads, we tell the ad platform its ad worked — and that sentence deserves the detail below rather than your trust.

That's the whole thing. The rest of this page is the detail, because a page that says "we respect your privacy" and stops there isn't telling you anything.

When you read an essay

We use Umami, a cookieless analytics tool, to see which essays get read. It records the page visited, the referring site, your browser, operating system, device type, and country. It does not set cookies, does not store personally identifying information, and cannot follow you to other websites. This is why you are not being asked to click a cookie banner.

We also measure how essays are read, because the writing gets better when we can see where it loses people. As you scroll, the site records which section you're in and how long you stay there, and reports these events:

• section-read: a section heading, and how many milliseconds you spent in it. If you scroll back and read a section again, both visits are added together and reported once, flagged as revisited.
• read-25, read-50, read-75, read-100: how far down the essay you got, in quarters.
• read-end: the furthest section you reached before leaving, how many sections you read, and whether you finished.

When you land on the home page

The home page's job is to hand you an essay, and most people who arrive never open one. We record enough to tell the difference between someone who tapped a link by accident and someone who looked at the page and decided against it, because those are different problems and only one of them is ours to fix.

• home-scrolled, home-card, home-list, home-signup: whether you scrolled at all, and which parts of the page came into view.
• home-click: which link you took first — the featured essay, one of the others, or something in the header or footer.
• home-end: how long you stayed, how far you got, and which of those things you did before leaving.

We do not record where your pointer went, we do not replay your session, and we do not record anything you type.

All of these events travel through Umami and carry no identifier. Not a name, not an email, not a cookie, not an account. They cannot be tied back to you, and they cannot be joined to a newsletter subscription. They tell us that a section lost readers; they never tell us that you stopped reading.

Umami is operated by Umami Software, Inc. in the United States, which means this aggregate data is processed there.

When you subscribe

When you submit the subscribe form, your address goes to this site's own server and straight on to beehiiv, which runs the newsletter. We keep no copy: there is no database here, no file, and nothing in the logs. If beehiiv returns an error we record what went wrong, with the address stripped out first.

Along with your address, we pass which page you subscribed from, so we know which essay persuaded you. That's all the context there is.

beehiiv (beehiiv, Inc., United States) stores your email address and the usual newsletter engagement data: whether an email was delivered, opened, and which links were clicked. They process this on our behalf; their handling is covered by the beehiiv privacy policy.

We use your address to send you the newsletter. We do not sell it, rent it, or hand it to anyone else. Every email carries an unsubscribe link, and unsubscribing is immediate and permanent unless you come back on purpose.

When you arrive from an ad

We sometimes run ads on Instagram and Facebook. If you clicked one and then subscribed, we tell Meta that the ad worked, because otherwise we are buying ads blind. Everyone else does this with a tracking pixel: a script that runs in your browser, leaves an identifier on your device, and keeps recognising you afterwards. That script is the reason most sites have to interrupt you with a cookie banner. We don't have one, and this is why.

Instead the message goes from our server, once you've subscribed, and it contains four things: a one-way scrambled (SHA-256) version of your email address, your IP address, your browser's user-agent string, and the click identifier that Meta themselves attached to the link you followed. Nothing is stored on your device. Nothing runs in your browser. Meta already had the first three the moment you clicked, and the fourth was theirs to begin with.

This only happens if you actually arrived on one of our ads. Subscribe after a search, a link from a friend, or the RSS feed, and Meta is told nothing whatsoever: your address goes to beehiiv and nowhere else.

What Meta does with it is match the scrambled address against their own records to work out which ad you saw, and count it; their handling is covered by the Meta privacy policy. We can't un-tell them afterwards. So if you'd rather stay out of it entirely, subscribe from the site rather than from an ad, and you are.

Hosting

The site is hosted by Vercel Inc. (United States). Like every web server, theirs keeps short-lived technical logs of requests, including IP addresses, for delivery and security. We don't read them for analytics and we don't build anything on top of them.

What we don't do

• No cookies. Not for analytics, not for anything.
• No retargeting pixels, no social-media trackers, no advertising code running in your browser at all. The one thing an ad platform is ever told is the paragraph above, it happens on our server after you've subscribed, and only if you came from an ad.
• No third-party fonts or scripts beyond the Umami tag. The typefaces are served from this domain, so no font provider learns you were here.
• No selling, renting, or sharing of your email address.
• No accounts, no profiles, no attempt to work out who you are.

Where we are

Turns Out is operated from Serbia, outside the European Economic Area, and our service providers are in the United States. So if you're reading from the EU or UK, your data is handled outside it. We've said above exactly what that data is: an email address if you subscribed, and non-identifying reading measurements if you didn't.

Your rights

We're not established in the EU, but the GDPR still reaches sites that offer services to people there, so we apply it, and you can hold us to it. You have the right to ask what we hold about you, correct it, delete it, take it elsewhere, or object to it being processed. In practice, the only thing we hold that is about you is a newsletter subscription, so in almost every case the answer is the unsubscribe link. But write to us and we'll do it properly.

The legal basis for the newsletter is your consent, which you give by subscribing and withdraw by unsubscribing. The same consent covers telling Meta that their ad worked, which is described on the form itself and in full above, and which happens only if you arrived on an ad. The legal basis for the cookieless, non-identifying measurement above is our legitimate interest in knowing whether the writing works. You also have the right to complain to your national data-protection authority.

How long we keep things

Your email address stays until you unsubscribe or ask us to delete it. Analytics data is aggregate and non-identifying, and is kept for as long as it's useful for editing.

Changes

If this policy changes, the date at the top changes with it. If a change actually matters (new processor, new category of data), subscribers get told in an email rather than by a silent edit.

Contact

Miodrag Lazić, hello@readturnsout.com. Full details on the imprint.