Loading stories…
We believe in digital transparency. This policy explains exactly what we collect, where it is stored, how long we keep it, and the rights you can exercise over it.
We do not knowingly collect data from children under 13, and we do not create accounts for casual readers.
The data we gather is used to deliver, maintain and improve xSypher. We rely on your consent for optional categories, on the performance of a contract for newsletter delivery, and on our legitimate interest in keeping the platform secure and understood.
To send the newsletters you asked for, publish and moderate comments, and answer messages sent to the desk.
To detect malicious activity, mitigate denial-of-service traffic, prevent comment spam and enforce our Terms of Use.
To see which topics readers actually read, so we know what to cover in more depth and what to stop commissioning.
To fund the publication. Ad serving is consent-gated and handled by Google; we do not build reader profiles of our own.
We do not sell, rent or trade your personal information. We share data with processors only where they perform a service for us under a data-processing agreement — our database and edge-compute provider, our email provider, our advertising partner and our error-monitoring provider. We may also disclose information where legally compelled to do so, and we will tell readers when we are permitted to.
xSypher is served through Cloudflare's edge network. Cloudflare terminates TLS, caches static assets, applies web-application-firewall rules and absorbs volumetric attacks before traffic reaches our application. In doing so it processes IP addresses, user agents, TLS fingerprints and request URLs on our behalf as a data processor, and it is bound by its own data-processing terms.
Article bodies and editor documents are stored in Cloudflare R2 object storage, while structured metadata — titles, bylines, taxonomy, comments, subscribers — lives in our PostgreSQL database. Both are encrypted in transit; R2 objects are served over HTTPS only and are not publicly listable.
Because Cloudflare operates a global anycast network, a request from your device may be served by an edge location in your own region rather than by an origin server elsewhere. That is a latency and resilience benefit, and it also means fewer copies of your request travel across the internet than they would with a single-region host.
xSypher is supported by display advertising served through Google AdSense, and may work with additional third-party advertising partners. Advertising is what allows the reporting, reviews and benchmarks on this site to remain free to read, and it is kept clearly separate from editorial judgement.
Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website and other websites. Google's use of advertising cookies — including the DoubleClick/DART cookie — enables it and its partners to serve personalised advertisements based on your visits to xsypher.com and other sites on the internet.
You can control this: visit Google Ad Settings to opt out of personalised advertising, or aboutads.info to opt out with participating vendors. Our Cookie Policy lists every advertising cookie and its opt-out in full.
What we never do: sell your email address, share newsletter lists with advertisers, expose commenter identities to partners, or embed advertising pixels that load before you have made a consent choice.
We keep personal information only for as long as it serves the purpose it was collected for, unless a longer period is required by law:
| Data | Retention |
|---|---|
| Newsletter email address | Until you unsubscribe, then removed from active lists and suppressed for 24 months to honour the opt-out |
| Comment content & display name | For as long as the article and comment remain published |
| Comment email/IP hashes | Retained for moderation and abuse prevention while the comment exists; deleted with it |
| Edge security logs | Short-lived (typically days), then rotated |
| Consent records | Until you clear them, plus 12 months for audit |
| Aggregate view statistics | Indefinite — these contain no personal data |
Where a deletion request is made, data that is no longer needed is irreversibly deleted or anonymised, and any backup copy is left to expire on its normal rotation cycle.
Depending on where you live, you hold specific legal rights over your data. We honour these for every reader, not only where a statute compels it:
To exercise any of these rights, email our Data Protection contact at [email protected]. We respond within 30 days, and usually sooner. You may also lodge a complaint with your local supervisory authority.
All traffic between your browser and our servers is encrypted with TLS, enforced with HSTS, and protected by a strict Content Security Policy with per-request nonces. Staff authentication uses signed, HTTP-only session cookies, and passwords are hashed with a modern password-hashing algorithm — never stored in plain text or reversible form.
Submitted comment content and article HTML are sanitised before storage so that a submission cannot inject scripts into a page another reader loads. Email addresses used in comments are hashed at the point of submission, so a database disclosure would not hand over reader addresses.
No system is perfectly secure, and we will not pretend otherwise. If we ever suffer a breach affecting your personal data, we will notify affected readers and the relevant authority without undue delay. Suspected vulnerabilities in our own platform can be reported through the process set out in our responsible disclosure policy.
If you have any questions, concerns or requests regarding this Privacy Policy, our practices, or your dealings with the xSypher platform, please contact us.