Privacy

Who operates the site

Living Outlook publishes this site. We have not published a separate registered company name or postal address here. For privacy requests use the contact form.

Information we collect

• Reader accounts: name and email, used only for passwordless sign-in.
• Comments: the name and email you type, the comment text, an optional account link, and a hashed network address used to slow spam. Emails are not shown on the page.
• Contact form: name, topic and message. The form does not collect an email address.
• Reactions: the reaction you choose, stored against an anonymous first-party cookie fingerprint.
• Outbound reference clicks: destination URL, label, optional article, and an aggregate click count when you follow an external link through /out/… or share through /s/…. This is a first-party operational record, not Google Analytics.
• Sessions and security: a session identifier, CSRF token, and — when sessions are stored in the database — IP address and user agent. Application logs may also record request paths and errors. Rate limiting uses the request IP.
• Google Analytics telemetry: we send page-use measurement to Google Analytics 4 so we can see how the public pages are read. This is required. See below.

Why we process it

• To run accounts, comments, reactions and the contact form.
• To moderate abuse and keep the service available.
• To keep a first-party record of which editorial references readers follow.
• To collect telemetry through Google Analytics for analytic purposes: which pages are read, how readers move through the site, and what devices and browsers they use.
• To respond to corrections and privacy requests.

Lawful basis

Where UK GDPR applies we rely on:

• Contract — sending a sign-in link and keeping the account you asked for.
• Legitimate interests — security logs, spam control, outbound-click records, ordinary site operations, and Google Analytics telemetry used to understand public-page use.
• Consent — comments, reactions and contact messages you choose to submit.
• Legal obligation — if we must retain or disclose information to meet a lawful request.

Google Analytics

We use Google Analytics 4, operated by Google Ireland Limited (and Google LLC in the United States), as required telemetry for analytic purposes. The Measurement ID is stored in the server environment. When a valid ID is configured, the analytics tag loads for public pages. This publication does not offer a setting to turn Analytics off.

Google may collect:

• the page URL, title and referring page;
• approximate location derived from IP (Google Analytics 4 does not give us a precise address);
• device, browser and screen information;
• page-view and engagement events generated by the GA4 tag;
• first-party analytics cookies described in the Cookie Policy.

We configure the tag without advertising signals, Google Signals or ad personalisation. We do not send names, email addresses, account IDs or comment text to Google Analytics. First-party outbound short-link counts stay on our servers and are separate from Analytics.

Google acts as a processor for this measurement. Information may be processed in the United States or other countries where Google operates. Google’s retention for a GA4 property is the period configured on that property; we have not enabled a longer retention than Google’s standard property controls. Typical analytics cookies last up to about two years for _ga, with a shorter per-property identifier.

The site does not provide an in-product control to refuse or customise Analytics. Browser settings or Google’s browser opt-out add-on can still block third-party measurement in that browser. Those tools are outside this publication.

Cookies

The application sets first-party cookies and Google Analytics cookies. Analytics cookies are required for this site’s measurement. We do not set advertising cookies. Necessary cookies include the session cookie and XSRF-TOKEN. vl_commenter can remember a guest name if you ask; vl_reactor stops reaction-count inflation. The Cookie Policy lists each cookie’s purpose and duration.

Authentication and session data

Sign-in is passwordless. We email a time-limited magic link. Session data is stored by the configured session driver (file or database). Database sessions include IP address and user agent until the session expires.

Comments and contact forms

Comments are published after basic spam checks. Messages with several links may be held for review. The contact form stores name, topic and message only, so we cannot email a reply unless you include a contact method in the message itself or write to the address above.

Security and network logs

Hosting and application logs may include IP address, user agent, timestamps and the path requested. Rate limiting uses the request IP in the application cache. These records are operational, not Google Analytics.

Outbound click and reference logs

Editorial citations and share buttons may pass through this site’s short-link service. We store the destination, a label, an optional article id and an aggregate click count. We do not store a per-click identity, IP or user agent on that record.

Service providers

Hosting, email delivery and infrastructure providers process data on our behalf to keep the site online and to send sign-in links. Google processes Analytics telemetry for the measurement described above. We do not sell personal data.

International transfers

If a hosting, email or analytics provider stores data outside the UK, we rely on the transfer safeguards that provider offers. Google Analytics can involve a transfer to the United States.

Retention

• Accounts remain until you ask us to delete them.
• Comments remain while the article is public, unless you ask us to remove yours or we remove them for abuse.
• Contact messages are kept only as long as needed to handle the request.
• Outbound-click aggregates stay while the short link is in use.
• Sessions expire after inactivity. Security logs are kept only as long as needed to investigate incidents.
• The cookie-notice acknowledgement is stored for about 365 days.
• Google Analytics retention follows the GA4 property settings described above.

Your rights

Depending on where you live, you may request access, correction, deletion, restriction, objection, portability of data you provided, and withdrawal of consent where processing is based on consent. Use the contact form. Analytics telemetry is required for this publication and is not withdrawn through a site cookie setting.

Complaints

UK readers can complain to the Information Commissioner’s Office (ICO) if they believe their data protection rights have not been respected.

Automated decisions

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

Contact for privacy requests

Use the newsroom contact form. Include a way to reach you if you want a reply.