What public-page analytics record
When analytics are enabled, a public page can send its path, the hostname of an external referring site when available, and a random identifier created in this browser. Valid source, medium and campaign labels from UTM query parameters are also recorded when present. The hosting provider supplies an approximate country and first-level region for the event when available. Full query strings, page fragments, full referring URLs, precise coordinates and city names are not retained. Private admin, member, API, sign-in, sign-up and sign-out routes are excluded.
How the browser identifier is protected
The backend converts the random browser identifier with keyed HMAC-SHA256 before storage. The raw identifier is not retained by the analytics database. IP addresses and user-agent strings are not stored as part of these page-view events. Country and region estimates may be inaccurate, including when a visitor uses a VPN or proxy. Earlier visits without stored location evidence remain unknown.
Why the data is used
Private aggregate reports help evaluate readership, repeat visits, referring sites, campaign labels, approximate country and region, research interest and whether readers return to outcome tracking. Individual reader identities are not shown in these reports, and analytics do not determine publication access or subscription entitlement.
Storage and retention
The browser stores the random identifier and your analytics preference in first-party local storage. A short session marker limits duplicate page views for the same path. The service currently retains server-side page-view records for aggregate measurement; a fixed deletion schedule has not yet been implemented. This notice will be updated when that changes.
Loading your browser preference…
Scope of this control
The control above stops new public-page analytics events from this browser. It does not delete earlier aggregate event records, account records you intentionally create, or operational and security records required to run the service. Clearing browser storage can also clear the saved preference.
Help requests
The Help form collects the support category, reply email, description, submission time and page address supplied with the request. The request is recorded for Buddy, the website assistant, which sorts it for the research lead; if Buddy is unavailable, a PDF copy is emailed to the research lead instead, through the Ledger's own Google Workspace account. Your email address is kept for the reply and is never sent to an AI model; email addresses and phone numbers in your description are removed before Buddy reads it. A request is kept until the research lead has handled it and deleted one month after that. Do not include passwords, authentication codes, payment details or other sensitive information.
Buddy, the website assistant
Messages you send to Buddy are stored with the conversation while you chat. To answer, Buddy sends the message text, with any email address or phone number removed, to an AI model through a provider that keeps no copy and does not train on it. If you are signed in and ask about access, Buddy checks your account's plan and payment status in our billing records. An ordinary conversation is deleted when the chat ends: when you close the chat, or after 30 minutes without a message, whichever comes first.
When Buddy cannot resolve a concern, or passes it to the research lead, it opens a case and gives you a case number. The research lead is emailed a summary with the conversation attached. When you have nothing else to ask, Buddy emails you a copy of the conversation with your case number, and when the research lead closes the case you receive a closing email with a short summary of how it was resolved. These emails go only to the address on the case (your account email if you are signed in, otherwise the email address you give Buddy), are sent through the Ledger's own Google Workspace account, and are copied to the research lead. A case is kept until it is closed and deleted one month after that.
Records kept in Google Drive
The Ledger keeps internal records (website quality-check archives and its agents' incident reports) in its own company Google Drive through Google's official interface, using access limited to files the website itself creates. These records concern the website and its operations; reader payment details and passwords are not included.
The Weekly Ledger newsletter
If you sign up for email updates, your address, the consent wording you agreed to, the page you signed up on and the time are stored in our own database. Nothing is sent until you press the link in the one confirmation email. Newsletter emails, including that confirmation, are sent through Postmark, an email delivery service based in the United States, so your address and each message pass through Postmark's servers there. Postmark keeps the content of sent messages for 45 days (its pricing page, as read on 26 October 2026). Opens and link clicks are not tracked.
Every issue has an unsubscribe link, and a link to manage your preferences, at the bottom. Unsubscribing takes effect at once, needs no sign-in and does not change any account or paid plan. Many email apps also show an unsubscribe button that does the same. If you unsubscribe and later change your mind, sign up again and confirm the new confirmation email; we then lift the unsubscribe with us and at Postmark. If a message to your address bounces permanently or is reported as spam, Postmark tells us and we stop sending to that address for good.
Changes to this notice
This page will be revised when collection, reader controls or retention behavior materially changes. The explanation is intentionally limited to behavior the current implementation can support.