ActSmall

Privacy & analytics

Every ActSmall topic follows the same privacy posture. This page is the single source of truth; each per-topic About page links here rather than repeating the policy.

What this site does not do

  • We do not set cookies.
  • We do not load Google Analytics, Plausible, PostHog, Mixpanel, Meta Pixel, Hotjar, or any other third-party tracker.
  • We do not fingerprint your browser or your device.
  • There is no login, no account, no email signup, no newsletter, no comment section.
  • There are no ads, no sponsorships, no affiliate links, no donate buttons.
  • Your map pins, your private action log (the “Mark done” / “30-day reminder” entries), and any cached data layers live in your own browser’s localStorage only and are never transmitted to us.
  • Calendar reminders are generated as standards-based .ics files and downloaded straight to your device; we don’t schedule or store them.
  • Pre-written advocacy emails open in your own mail app with the recipient empty — nothing routes through us.

What this site does do

We keep aggregate, server-side counters of four things:

  1. How many times each topic page was loaded.
  2. Which countries are most often clicked on the map.
  3. Which outbound links our readers actually follow.
  4. Which referring sites send us the most readers.

These come from two sources. First, the standard CloudFront server access log — the same kind of log every web server has produced since the 1990s. Second, two same-origin GET beacons fired by the map JavaScript when you select a country (/_p/c) or click an outbound link (/_p/o). Those beacons receive an HTTP 204 response directly from CloudFront’s edge and never reach a database; they exist solely to make the click appear in the access log.

How long anything is kept

Raw access-log files — one row per request, including IP address and user-agent string — live for 30 days in a private S3 bucket encrypted at rest with our own AWS KMS customer-managed key (rotated yearly), and are then automatically deleted by an S3 lifecycle rule.

From those 30 days of raw logs we derive weekly aggregates (counts only, no identifiers) which we keep indefinitely and publish openly:

Why we keep any of it

A public-interest site that doesn’t measure outbound clicks cannot tell whether its recommendations are working. Aggregate counts are the minimum signal needed to keep the editorial honest. We collect that and nothing more.

How to opt out

If you would prefer not to contribute even to the aggregate counters, install any reputable content blocker (uBlock Origin, NextDNS, Pi-hole, etc.) and add actsmall.org/_p/* to its block list. The map will continue to work normally; only the beacons are suppressed.

You can also use a privacy-respecting browser (Firefox, Brave, Safari with default settings) which will already do most of this for you.

If you suspect a leak

If you find a third-party request your browser is making while loading any ActSmall page that isn’t documented here (basemap tiles from OpenFreeMap and CloudFront delivery aside), please report it to submissions@actsmall.org. Trust is the only currency this site has.