Draft · pending legal review
Privacy policy
Five Sigma collects as little as possible. This page lists everything the site actually collects, why, where it goes and how long we keep it.
DRAFT — this policy describes exactly how the site works as of 12 October 2026 and is still under legal review. Items in [brackets] will be completed before it is final.
Who is responsible
[Controller: name / legal entity, address, and contact email for privacy requests.]
Until a contact address is published here, you can make any privacy request (to see, correct or delete the data we hold about you, including your email address) through the report form: choose “Site-wide” and describe your request.
The short version
- We do not set any cookies, and we use no advertising or cross-site tracking.
- Reading the site requires no account and no personal information.
- We only store personal data you choose to give us: your email address if you subscribe or ask for a reply to an error report.
What we collect, and why
1. Visit statistics (Vercel Web Analytics and Speed Insights)
To understand which pages are read and whether the site is fast, we use Vercel Web Analytics and Vercel Speed Insights. They use no cookies. Vercel says Web Analytics identifies a visit using a hash created from the incoming request, which is discarded after 24 hours. It records the page address, referrer, approximate location (country, region, city), browser, operating system and device type. Speed Insights records performance measurements (such as loading times) with the page, browser, device, country and network speed, and Vercel says this is not tied to any individual visitor or IP address. [Legal basis: legitimate interest in running and improving the site.]
2. Server logs
Our hosting provider, Vercel, processes technical request data (including IP addresses) to deliver pages and protect the service, and keeps short-lived logs. We don’t use these logs to identify visitors.
3. Newsletter
If you subscribe, we store your email address, the date and time you gave consent, the version of the consent text you agreed to, the page you subscribed from, your status (pending, confirmed or unsubscribed), and one-time tokens (stored only in scrambled, hashed form) used for the confirmation and unsubscribe links. We use double opt-in: nothing is sent beyond one confirmation email until you click its link. [Legal basis: consent, which you can withdraw at any time by unsubscribing.]
Emails are sent through an email delivery provider [to be confirmed — e.g. Resend], which processes your address only to deliver our emails.
4. Error reports
If you report an error, we store the article, the passage, your explanation, any source link you give, and — only if you choose to provide it — your email address so we can reply.
5. “Was this clear?” feedback
We store the article, your answer and any comment you type. It is anonymous; please don’t include personal information in comments.
6. Abuse prevention
To stop automated spam, our forms count submissions per connection. We store a salted, one-way hash of your IP address (not the address itself) together with a counter, and delete these records after two days.
7. Settings stored in your browser
If you switch to light mode or turn off animations, your choice is saved in your browser’s local storage (keys fs-theme and fs-motion). It never leaves your device. You can clear it in your browser settings at any time.
8. Embedded videos
Videos are hosted by TikTok. Nothing is loaded from TikTok until you press “Play video”. When you do, TikTok’s player loads, and TikTok may set cookies and collect data under its own privacy policy.
Where your data is stored
Form submissions are stored in a database run by Supabase, hosted on Amazon Web Services in the United States (region us-east-1). The site is hosted by Vercel. [Add the international-transfer basis appropriate for EU/UK visitors, e.g. Standard Contractual Clauses / the EU–US Data Privacy Framework, after review.]
How long we keep it
- Unconfirmed newsletter sign-ups: deleted after 30 days.
- Unsubscribed addresses: deleted 30 days after you unsubscribe.
- Confirmed subscribers: until you unsubscribe.
- Error reports and feedback: deleted after 2 years.
- Rate-limit records (hashed): deleted after 2 days.
Deletion runs automatically every day.
Your rights
You can ask to access, correct or delete your data, or object to how we use it. You can unsubscribe from the newsletter at any time using the link in every email. [Contact for requests; right to complain to a supervisory authority, e.g. the Israeli Privacy Protection Authority or an EU data protection authority.]
Children
The site is suitable for curious readers of all ages, but the newsletter is not intended for children under [13/16 — confirm].
Changes
We will update this page if the site starts collecting anything new, and change the date below. Questions? See our About page for contact details.
Last updated 12 October 2026 (draft)