My Approach to Privacy
EconGoat is where I teach economics and economic development with a dose of life. You should be able to learn here without being tracked, profiled, or marketed to. Every lesson, quiz, and blog post is free to read, with no account and no sign-up.
This policy explains what the site collects, what it deliberately does not collect, why, how long I keep it, and what you can do about it. It applies to this website and to the emails it sends.
Who is responsible for your information
EconGoat is run by one person, its author, who is the "I" in this policy. I decide how the information described here is used, which makes me its controller under data protection laws such as the European Union's General Data Protection Regulation (GDPR). You can reach me about anything in this policy at privacy@goatecon.com. A site this small does not need a data protection officer, so your questions come straight to me.
Information You Choose to Give Me
You can read everything on this website without giving me any personal information, and you never have to give any. I only receive personal information when you choose to send it, apart from the security records the server keeps by itself for a short time: the server logs, the counts that stop the newsletter forms from being misused, and the records of attempts to sign in to the admin pages.
Newsletter sign-up
If you sign up for the newsletter, I store your first name, your last name if you give one (it is optional), and your email address, along with when you signed up, when the confirmation email was last sent, and when you confirmed. The newsletter cannot be sent without a first name and an email address, so those two are required. The sign-up form is for readers 16 and over.
Signing up takes two steps. The site emails you a link to confirm your address (signing up again more than an hour later sends it again). Until you confirm, you are not on the list and get no newsletter. If the confirmation email cannot be sent yet, your sign-up waits until it can. A sign-up that is never confirmed is deleted 30 days after the last confirmation email, or after 90 days if none could be sent (see How Long I Keep Information).
Once you confirm, the site sends one email to say you are subscribed. That email, and every newsletter after it, has an Unsubscribe link, and the Unsubscribe button that many mail apps show works too, with one click. The page you see after confirming has an Unsubscribe link as well. You can also use the form on this page, or email me. Unsubscribing deletes your name and email address from the list at once.
The site's emails contain no tracking pixels and no pictures loaded from other websites, and their links go straight to the page they point to, with no click tracking, so I cannot tell whether you opened an email or which links you followed. The one exception is the links to confirm your address and to unsubscribe. Each is unique to you, because following one is how the site confirms or unsubscribes you, and the server logs record them like any page, for 7 days.
Messages you send me
If you email me at privacy@goatecon.com with a question, a correction, feedback, or anything else, I keep your message and your email address so I can reply and follow up. Mail to that address is forwarded to my mailbox by Namecheap, the company its domain name is registered with, so your message passes through Namecheap's email forwarding and my email provider on its way to me.
Quizzes
When you check your answers to a lesson quiz, they are sent to the site in the page address so it can mark them and show your score. They are not saved or linked to you, and the server logs leave them out, except in the rare record of an error (see Server Logs). Your own browser's history keeps the address, as it does for every page you open.
Your lesson progress is kept only if you ask for it, and only in your own browser. The Lessons page, each topic and lesson page, and a marked quiz offer "Remember my progress on this device", which keeps your quiz scores and the parts of each lesson you have read, so the pages can show how far you have got. "Forget my progress and stop remembering", on the Lessons page, erases it. See Cookies and Browser Storage.
How I Use Your Information
I use the information you give me only for the purpose you gave it to me for:
- Sending the newsletter you subscribed to, the email that asks you to confirm it, the email that says you are subscribed, and, when you ask for one, a link to unsubscribe.
- Checking your quiz answers and showing your score.
- Replying to your questions, feedback, and accessibility requests.
- Keeping the site working and secure, and meeting any legal obligations.
I never use it for advertising, and I never give it to anyone to market to you. I do not make automated decisions about you or build a profile of you.
Why I Am Allowed to Use It
Data protection laws such as the GDPR ask me to say why I am allowed to use each kind of information (its "legal basis"):
- Newsletter: your consent, which you give when you confirm your address. You can withdraw it at any time by unsubscribing. Withdrawing it does not affect what I did before. Before you confirm, keeping your sign-up and sending the confirmation email rest on your request and on my legitimate interest in making sure that only the owner of an address can add it to the list.
- Messages you send me: my legitimate interest in answering you, or taking the steps you ask me to take.
- Quiz answers: checking them is the service you ask for. They travel in the page address, are not saved or linked to you, and are left out of the server logs, except in the rare record of an error.
- Server logs, rate limits, sign-in attempt records, the admin history, and backups: my legitimate interest in keeping the site secure and working.
- Records the law requires me to keep: my legal obligations.
Where I rely on my legitimate interests, you have the right to object; see Your Choices and Rights.
Cookies and Browser Storage
The ordinary pages of this site set no cookies at all. Reading the lessons and the blog, checking your quiz answers, signing up for the newsletter, confirming it, and unsubscribing all work without one. Cookies are used only on the admin pages, where the site's editors work on it. None of them track you, here or on other websites, and none are used for advertising or analytics. There are no cookies from other websites.
The pages for readers store a few things in your browser's own storage, but only when you ask them to. The tables below list every cookie and browser storage entry the site uses. Cookies are sent to the server with each page you open. Browser storage stays on your device and is read only by the page itself, so I never see it.
Only for people who edit the site
The admin pages, where the site's editors (for now, only me) work on it, use the cookies and browser storage below. No page for readers links to them. Anyone who opens the admin's sign-in page gets two of them: the csrftoken cookie, and the admin's appearance setting (theme), which the admin writes as soon as the page opens. The rest are only for editors who sign in.
Why there is no cookie banner
Everything in these tables is either strictly necessary for something you asked for, such as signing in, or stored only when you ask for it, by clicking the light and dark switch, a code language, or "Remember my progress on this device". The one exception is the admin pages' own display settings: their appearance (theme), which Django's admin writes whenever one of its pages opens, and the state of its side menu and filters.
Those settings are only on the editors' pages, hold nothing about you, and never leave your browser. None of it tracks you, so there is no consent banner.
Your browser also remembers, for up to a year, that this site must always be opened over a secure connection. That note holds no information about you.
Clearing or blocking them
You can clear or block all of these in your browser settings. Everything stays readable if you do, and signing up for the newsletter, confirming it, and unsubscribing work without cookies, but the site will forget your choices. Only signing in to the admin pages needs cookies.
Server Logs
Like almost every website, the server that runs EconGoat keeps standard logs of the requests it receives. The access log records your IP address, the date and time, the page you asked for, the page that linked you here if your browser says, and the name and version of your browser. It leaves out anything after a "?" in the address of either page, so it never records your quiz answers. The error log records problems the server runs into, and a record of an error can include a page's full address. I use the logs only to keep the site running and secure, for example to find errors and block attacks, never to profile visitors. They are deleted after 7 days.
The site's own log records warnings and errors: a server error notes the page that was asked for, and each failed attempt to sign in to the admin pages notes only the browser's name and the page. This log hides the IP address and the username tried; the sign-in records described below keep those, for 30 days. The database's log rarely holds anything about visitors, but a request that fails there can leave what it carried in it, such as the name and email address given in a newsletter sign-up. Both are deleted after 7 days too. The program that runs the site's code keeps no log of the pages people open.
The newsletter forms and the admin's sign-in page also use IP addresses, to stop misuse. The newsletter sign-up counts requests from each visitor, so the form cannot be used to flood someone's inbox, and the unsubscribe form on this page does the same. These counts are stored under a scrambled form of the IP address (a keyed hash), never the address itself. They expire within a day of the last request (an hour for the unsubscribe form) and are deleted the following night. When the unsubscribe form emails a link, the site notes it for an hour by subscriber number only, so it sends at most one an hour to each address. The sign-in page for editing the site records each attempt to sign in (the IP address, the browser's name, the username tried, and the time) so it can stop password guessing. Those records are deleted after 30 days.
Who I Share Information With
I do not share your personal information with anyone except the services I need to run the site and to receive your email:
- Microsoft Azure runs the site on one server in the United States (its West US 2 region): the website, its database (including the newsletter list), its logs, and its backups. Microsoft is bound by its data processing agreement, the Microsoft Products and Services Data Protection Addendum.
- The email delivery service that sends the site's emails receives your name, your email address, and the email itself. I have not chosen it yet, and I will name it here before the site sends any email.
- Namecheap and my email provider carry the email you send me, as described under "Messages you send me" above, under their own terms.
Research roundup posts are drafted with the help of an AI service, from the public abstracts of the papers they cover. No information about readers is sent to it.
There are no advertising networks, analytics services, or tracking scripts on this site, and every font, script, style, and picture comes from the site's own server, so visiting EconGoat sends your IP address to nobody else. I may also disclose information where the law requires it.
Where Your Information Is Stored
Browser storage stays on your device. The site itself, meaning its database, its logs, and its backups, is on Microsoft's servers in the United States, and email you send me passes through the email forwarding of Namecheap, a United States company, on its way to my email provider. If you are in the European Union, the European Economic Area, the United Kingdom, or Switzerland, this means your information is transferred to the United States. Microsoft takes part in the EU-US Data Privacy Framework and its UK and Swiss extensions, and its data processing agreement also includes the European Commission's Standard Contractual Clauses. You can email me at privacy@goatecon.com for more information about these safeguards.
Links to Other Websites
Lessons, blog posts, and research roundups link to other websites, such as the sources I cite and the papers I summarize, and the footer may link to EconGoat on social media. Nothing from those websites is loaded on EconGoat's pages, so they learn about your visit only if you follow a link. They have their own privacy practices, which I do not control. It is worth reading their policies before you give them any personal information.
Children and Privacy
EconGoat is written for curious people from about 16 years old to adults. Anyone can read it without giving me any information, but the newsletter is only for people 16 and over, and it is not directed to children under 16.
If you are under 16, please do not sign up. If you believe a child under 16 has given me personal information, contact me and I will delete it.
How Long I Keep Information
I keep each kind of information only as long as I need it:
- Newsletter subscriptions: until you unsubscribe. Your name and email address are then deleted from the list at once.
- Sign-ups that are never confirmed: deleted 30 days after the last confirmation email was sent, or 90 days after signing up if none was sent.
- Server logs (IP address, time, the page asked for and the page that linked to it without anything after a "?", and browser name; an error record can include a full page address), the site's own log, and the database's log: deleted after 7 days.
- Sign-in attempt records for the admin pages, which only the site's editors use (IP address, browser name, username tried, and time): deleted after 30 days.
- Rate-limit counts for the newsletter forms, stored under a scrambled form of the IP address: they expire within a day of the last request (an hour for the unsubscribe form) and are deleted the following night. The note that an unsubscribe link was sent, which holds only a subscriber number, expires after an hour and is deleted the same way.
- The admin history, the record of the editors' changes: it names a subscriber only by number, such as "Subscriber #12", never by email address. Older entries that still held an address are rewritten every night. It is kept as long as the site runs.
- Editors' accounts (username, email address, and password in scrambled form): until the editor no longer needs one.
- Editors' sign-in sessions: deleted the night after they expire.
- Backups: kept private and deleted after 30 days, except the most recent one, which is kept until a newer one replaces it. Someone who has unsubscribed can stay in a backup until that backup is deleted. A copy I download to my own computer is deleted on the same schedule.
- Copies of the newsletter list exported from the admin (made, for example, to answer your request for a copy of your information): deleted once used.
- Messages you send me: as long as I need them to deal with your message, then deleted.
Your Choices and Rights
You are in control of the information you have given me. At any time you may:
- Unsubscribe from the newsletter, with the link in any newsletter email or the form below.
- Ask me what information I hold about you, and for a copy of it.
- Ask me to correct information that is wrong or out of date.
- Ask me to delete your information.
- Ask for a copy of the information you gave me, in a common format you can take elsewhere.
- Object to my using your information, including where I rely on my legitimate interests.
- Ask me to limit how I use your information, for example while a question about it is settled.
- Withdraw your consent where I rely on it. This does not affect what I did before you withdrew it.
To use any of these, email me at privacy@goatecon.com. It is free, and I answer within one month. Depending on where you live, you may have additional rights under local data protection law. I honor these requests wherever you live.
You also have the right to complain to a data protection authority, such as the one where you live, in the European Union or the European Economic Area, the United Kingdom, Switzerland, or anywhere else that has one. I would be grateful if you contacted me first, so I can try to put things right.
Unsubscribe
To stop getting the newsletter, enter your email address. If that address is subscribed, the site emails it a link that unsubscribes it. It sends a link rather than unsubscribing you straight away, so nobody can unsubscribe someone else. The form works without cookies, and the page shows the same message whatever you type.
Changes to This Policy
I may update this policy as the site changes. When I do, I will change the date at the top of this page, and I will announce significant changes on the site.
Contact Me
If you have questions about this policy, or would like to use any of the choices and rights described above, please email me. I run EconGoat on my own, and I am responsible for the information described here.
Email: privacy@goatecon.com
I answer privacy requests within one month.