Privacy notice — ARBITORIA

What does not happen

No tracking cookies. There is exactly one cookie, and it appears only once you sign in. It does nothing but keep you signed in. If you only read, no cookie is set at all.
No JavaScript runs. Article pages carry one script tag, but it holds structured data (JSON-LD) for search engines — data, not code the browser executes.
No analytics. Neither Google Analytics nor any alternative.
No external resources are loaded. Web fonts are used, but served from this domain. No request goes to Google Fonts or any CDN. Your browser does not contact another company’s server while reading a page here.
No comments. There are accounts — you need one to write a story. Reading needs no account.
One form: search. The front pages and the search page carry a search box. It is a plain GET form, so it needs neither cookies nor JavaScript. But what you type goes into the address — read it together with “What is processed anyway” below.

That is why there is no cookie consent banner. It has not been omitted. That single cookie is strictly necessary for a service you asked for yourself — signing in — and such cookies do not require consent. No consent-requiring cookie is set here.

You can verify this. Open your browser’s developer tools, look at the network tab, and reload this page: every request goes to this domain.

What is processed anyway

Fetching a page over the internet leaves a technical trace. This site is delivered through Cloudflare, which processes the following in order to serve and protect it:

IP address
Time of the request and the address requested — a search puts what you typed into the address, so search terms are part of this record
Browser and device type (User-Agent)

This exists to make the site work and to stop attacks. Arbitoria does not use these records for marketing or profiling. Cloudflare acts as a processor for this.

What an account leaves behind

If you only read, none of this applies.

Stored

Email address — used to send you a sign-in link
The name you go by — shown on your pieces. It need not be your real name
Language — which desk you write in
Your pieces and their versions — editing keeps the earlier version. That is what makes silent edits impossible

Not stored

A password. None is ever created, so none can leak
Real name, date of birth, phone number, postal address
Payment details

Sign-in links and sessions are not kept in the clear. Only hashes are stored — someone reading the database cannot use them to enter your account.

	How long
Sign-in link	15 minutes. It works once
Signed-in state (session)	30 days
Unpublished draft	7 days

Where it lives — Cloudflare D1, Western Europe. Member data and member writing do not leave the EU.

Who sends the link — sign-in links are sent through Mailjet, founded in France and now part of the Sinch group. In this processing it acts as a processor.

What Mailjet receives is your address and that link — nothing else. Not your writing, not the name you go by, not what you have read.

Mailjet states in its own documentation that “Your data is stored and processed in the EU”, spread across two regions and six data centres in Europe (Mailjet infrastructure page). That is as far as we verified; that page does not name particular cities or countries.

Source links in articles

Articles carry a lot of source links, because the editorial principles require every claim to be backed by a verifiable link.

Following one of those links takes you to that site, and that site’s own policy applies from then on. Arbitoria has no control over what is collected there. While you stay on this page, however, no request is sent to those sites. A link only acts when it is clicked.

RSS

If you subscribe to a feed such as /en/rss.xml, your reader will poll this site periodically. Those requests are logged in the same way as above. Nothing identifies an individual subscriber.

Your rights

Under the General Data Protection Regulation you may request:

Access to personal data being processed
Rectification and erasure
Restriction of and objection to processing
To lodge a complaint with a supervisory authority (in Belgium: the Data Protection Authority / Autorité de protection des données)

Requests can be sent to:

contact@arbitoria.com

Without an account, this site keeps no identifying information of its own, so there is nothing to erase.

With an account, what is listed above is held, and you can ask to see, correct or erase it.

Status of this document

This has not yet been reviewed by a lawyer.

It is a factual description of what the site does, not a document prepared by counsel. The facts above can be verified as described; whether the legal form is sufficient is a separate question. When a review has been done, this notice will be removed and the change recorded below.

Saying so seemed better than presenting it as finished.

Change log

2026-09-12 — Email delivery is connected. The “not connected yet” line is gone: signing up now really does send a sign-in link. What Mailjet receives is unchanged — your address and that link, nothing else.
2026-08-26 — The email provider was chosen — Mailjet — and named here, in the place where yesterday’s note promised “its name will be written here”. What it receives (your address and the link, nothing else) and where it keeps things are written alongside. On location we carried over only the sentence Mailjet’s own documentation states — search summaries named cities, but the primary page does not, so those are not written here.
2026-08-25 — Rewritten as the member desk arrives. “No cookies are set” and “No accounts, logins” no longer hold: signing in sets one cookie, and an account keeps an email address and a chosen name. A new section, “What an account leaves behind”, says what is kept and for how long. The reason there is no banner also changed — it used to be there is nothing to consent to, and is now no consent-requiring cookie is set. The three sentences about JavaScript, analytics and external resources remain true.
2026-08-25 — “There is no form to fill in” became false. Opening the search page put a search box on the front pages and on the search page itself, and this sentence was not read alongside that change. It now says there is one form, and states that what you type travels in the address and lands in the record above. The three sentences about cookies, JavaScript and external resources remain true — search is a GET form and needs none of them.
2026-08-17 — Two statements corrected. First, this said the site “contains zero script tags”; article pages in fact carry one, holding structured data (JSON-LD). The original sentence was written after checking only an index page. It now reads “no JavaScript runs”. Second, web fonts were introduced, so “no web fonts” became “served from this domain”. That no request leaves for a third party remains true.
2026-08-16 — First version. Written when the blog moved to arbitoria.com and was separated from the previous notice.