What I keep, and why.

The newsletter

Four things, and nothing you didn't hand me.

Subscribing is double opt-in: I only add you after you click the link in the confirmation email, so no one lands on the list without asking. When you subscribe, I store what the form and your browser send — this, and no more:

Your email address

So I can send you essays. That's the entire reason it exists. Legal basis: your consent, given when you confirm.

Where you subscribed

A short label for the page or form you signed up from — "home", "climate-forward", "writing/<essay>", and so on. It tells me which writing brings people in. It's my own count, not sold or traded.

Your IP address

Captured once, at the moment you submit the form — not on every email, not as you read. I keep it to catch abuse: bot signups, spam floods, someone subscribing an address that isn't theirs. Legal basis: legitimate interest in keeping the list clean.

Your browser's user-agent

The identifying string your browser sends, stored at the same moment and for the same reason. I don't use it — or your IP — to profile you or follow you around the web.

I keep your record while you're subscribed. Unsubscribe and I stop that instant, and I clear the IP address and browser details — I only kept those while you were on the list. What's left is minimal: your address and the fact that you unsubscribed. Ask me to erase that too and I will.

Who touches it

Three services keep it running. All in the EU.

Resend delivers the email on my behalf, so it handles your address and the essay itself. It runs in the EU region.

The site and the subscriber database live on a Hetzner server in the EU. Nothing about you leaves the EU.

PostHog measures how the site is used — pageviews, clicks, how far you scroll, and session replays with every form field masked, so I never see what you type. It helps me find where the writing lands and where the site confuses people. It sets one identifier so a returning browser isn't counted twice, and it's EU-hosted. Legal basis: legitimate interest. Block it with any tracker blocker and the site works exactly the same.

What I don't do

The absences are the point.

I don't sell your data. I don't share it for advertising. There is no third-party ad tracker, no Facebook pixel, no Google Analytics, no enrichment service quietly filling in who you are. The list is small on purpose, and it stays that way.

Your rights

It's your data. Take it back whenever.

Under the GDPR you can ask me for a copy of what I hold, correct it, delete it, or object to any of the above. Two ways to do it:

The unsubscribe link is in the footer of every email — one click, instant, no questions. For anything the link doesn't cover, including full erasure, email me. I answer these myself, and promptly.

If you think I've mishandled your data and I haven't put it right, you can complain to your data protection authority. In Finland that's the Office of the Data Protection Ombudsman.

Who's responsible

One person, reachable.

Karolina Sarna, trading as Rebel Strategy Lab, in Helsinki, Finland, is the data controller. The fastest way to reach me about any of this is karolina@rebelstrategylab.com.