Privacy

Last reviewed: 14 September 2026

This page explains what happens to your information when you use this website. We have tried to keep it short and specific rather than comprehensive and vague.

Who we are

TERF Times is an independent online publication. We decide what reader information is collected through this site and why, which makes us the data controller for it under UK data protection law.

You can contact us about anything on this page at terftimescontact@gmail.com.

Reading the site

You do not need an account to read TERF Times, and we do not ask you to create one.

Server logs. Our host, Netlify, keeps ordinary technical records of requests to the site, as any web host does. These include the IP address the request came from, the page requested, the time, and details your browser sends about itself. They exist so the site can be served, kept available and protected from abuse. We do not use them to identify individual readers.

Aggregate analytics. We use Cloudflare Web Analytics to see how many times our pages are read and which pages those are. Each page view sends your IP address, the page address, the page you came from and your browser’s description of itself to Cloudflare, a United States company. That is what any request to a website sends, and it is how the country, browser and device totals are worked out. Cloudflare states that it “does not use any client-side state, such as cookies or localStorage, to collect usage metrics”, and that it does not fingerprint individuals by IP address or user agent for the purpose of displaying analytics. What we see is a count, grouped by page, referring site, country, device type, browser and operating system, alongside how quickly pages loaded. We cannot see who you are, and the script carries nothing that would let it recognise you when you come back.

The analytics script does not run on the editorial admin area, and it does not run on preview builds of the site.

The add-to-calendar links on event pages go to Google, Microsoft or Yahoo only if you choose to follow them.

Sending us a message, a tip, a correction or an event

The contact, tips, corrections and event submission forms are handled by Formspark, which stores submissions for us. When you send one, Formspark receives what you typed, along with your IP address, an approximate location worked out from it, the browser your request came from, and the page you submitted from. It uses those to filter spam and to keep the service working. On the contact, tips and corrections forms, what you typed includes the email address you give us; the event submission form does not ask for one.

The event submission form is different from the others: everything entered on it is intended for publication, and we ask for no private details. Formspark stores each submission and also adds it as a row to a spreadsheet in our own Google account, which we use to check and approve listings. We keep those rows as a record of what was listed.

Each form is protected by Cloudflare Turnstile, a check that tells us whether a submission is likely to be automated. Cloudflare collects a small set of technical signals to run it: the IP address, a TLS fingerprint, the browser user agent, and the site key and the address of the page it appears on. Cloudflare states that it cannot directly identify individuals from those signals, and that Turnstile “does not access, store, or transmit user communications, form entries, or other page inputs”. Cloudflare’s Turnstile Privacy Addendum sets out the signals it collects, and its Turnstile documentation is where the second statement comes from.

For messages, tips and corrections, we use what you send to answer you and to do our reporting, and for nothing else. We use event submissions to decide whether to list the event and to write the listing, which is public. These forms are ordinary web forms rather than a confidential channel, which is why the tips page says so above its fields.

Joining the mailing list

If you sign up, we collect the email address you give us. It is stored by Formspark alongside our other form submissions.

We will only use it to send you updates about the publication. We do not sell it, trade it, or pass it to anyone for marketing. No newsletter has been sent yet, and we have not chosen a mailing tool. If you want your address removed, email us and we will remove it.

Supporting us

Donations go through Buy Me a Coffee, which is a separate service with its own privacy policy and its own relationship with you. We do not see your payment details. We see whatever information that platform chooses to show an account holder about the people who support them, such as a name or handle, an amount, and any message left with the donation.

Why we are allowed to do this

UK data protection law requires a legal basis for each thing we do with your information. Ours are these.

Server logs and form protection. Our legitimate interests in serving the site, keeping it available, and protecting it and our forms from abuse.

Aggregate analytics. Our legitimate interests in knowing what is read here so we can decide what to publish. The counts are not attached to you and cannot be traced back to you, which is what makes that a fair basis to rely on.

Messages, tips and corrections. Our legitimate interests in reading and answering what you send us and in doing our reporting, which is what you sent it to us for.

Event submissions. Our legitimate interests in running a listing of public events, which is what you sent the details for. The form asks for nothing private, and it says on the page that everything entered may be published.

Mailing-list addresses. Your consent, given when you sign up. You can withdraw it at any time by asking us to remove your address, and nothing else changes for you if you do.

Where we rely on our legitimate interests, you can object. The “Your rights” section below says how.

Who processes information for us

• Netlify hosts the site and keeps server logs of requests to it.
• Cloudflare Web Analytics counts page views without cookies or other information stored on your device.
• Cloudflare Turnstile checks form submissions for automation.
• Formspark receives and stores what you send through our forms, including mailing-list signups.
• Google Sheets holds the spreadsheet of event submissions, in the publication’s own Google account.

Each of these acts on our instructions for the parts described above. Buy Me a Coffee is not in this list because it is not acting on our instructions; it makes its own decisions about supporter information.

Where information is stored

Formspark stores our form submissions in Ireland and Germany, both inside the European Economic Area.

Netlify and Cloudflare are United States companies operating global networks, so information they handle for us may be processed outside the United Kingdom. Netlify states that it relies on the UK Extension to the EU-U.S. Data Privacy Framework and on the standard contractual clauses published by the European Commission for such transfers. Cloudflare’s analytics data is aggregated and its Turnstile signals are limited to the technical values listed above. Google may process the event submissions spreadsheet outside the United Kingdom under Google’s privacy policy.

How long we keep it

Formspark keeps a submission until it is deleted, and a deleted submission stays recoverable for 30 days after that. Formspark keeps the IP address and approximate location attached to a submission for 12 months.

Netlify does not publish a retention period for the server logs it keeps for the sites it hosts, and we have not been given one.

For our own handling, we keep messages, tips and corrections only as long as we need them to deal with what they are about, and mailing-list addresses until you ask us to remove yours. Event submissions are kept as a record of listings. We have not yet fixed formal retention periods. We are setting them, and we will publish them here when we have.

Cloudflare states that it retains unsampled analytics data for the past seven days and then aggregates it, and that the dashboard shows the previous six months.

Your rights

Under UK data protection law you have the right to:

• ask what personal information we hold about you and get a copy of it
• have inaccurate information corrected
• ask us to delete information
• ask us to restrict what we do with it
• object to us using it, including for our analytics
• receive information you gave us in a portable form, or ask us to send it to someone else

To use any of these, email terftimescontact@gmail.com and say what you want. We do not charge for this, and we will reply within one month. We may need to ask you something to be confident we are talking to the right person.

Because our analytics does not identify anyone, we usually cannot connect a page view to you, so a request about analytics data is one we may not be able to act on beyond stopping further collection.

Complaints

If you are unhappy with how we have handled your information, tell us at terftimescontact@gmail.com and we will look into it and reply.

You can also complain to the Information Commissioner’s Office, the UK regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to come to us first.

Changes to this page

We will update this page when what we do changes, and we will change the review date at the top when we do. Our use of cookies and similar technologies is covered separately on our cookie page.

Turning analytics off

If your browser can save the setting, use the switch just below this section; if it cannot, the switch says why. It applies to this browser only and takes effect from the next page you open; the page you are on may already have been counted.

When you turn analytics off, the site stores one setting in your browser, named tt-analytics, that says “off”. It holds nothing else, is never sent anywhere, and stays until you turn analytics back on or clear this site’s data. Some browsers, notably Safari, clear stored settings after about a week without visiting a site, so you may need to set it again.

If your browser sends the Global Privacy Control signal, analytics is off here automatically. Blocking the address static.cloudflareinsights.com, or using a content blocker, also works and needs no setting. Nothing on the site depends on the analytics script, so blocking it will not break anything you came here to read.