Privacy

Why there is no cookie banner

The rule that produces cookie banners is about storing or reading information on your device. This site's audience measurement does neither. There is no analytics cookie, no local storage, and no fingerprinting script. Everything described below is derived on the server from the request your browser already had to send in order to fetch the page, and most of it is discarded immediately.

That is also why there is nothing to consent to, and nothing to opt out of beyond the Do Not Track and Global Privacy Control signals, which this site honours (see below).

What is recorded

For each page view:

• the time it happened,
• the path requested — /publications.php, say. Never the query string,
• the hostname of the site you followed a link from, if any — www.google.com, not the full address, so a search term or a session token in a referring URL is never stored,
• a two-letter country code, derived from your IP address,
• the browser family and operating-system family, taken from the User-Agent header — Firefox, Linux — and never the header itself,
• whether the request looked like a crawler rather than a person,
• the HTTP status the page answered with.

What is not recorded

• No IP address of any kind, not even a shortened one. Your address is used once, in memory, to look up a country, and is then discarded. It is never written to disk and never appears in the database.
• No raw User-Agent string. The full header is distinctive enough to recognise a person by; only the two families above are kept.
• No query strings, no form contents, no account of any kind.
• No analytics cookie, no local storage, no fingerprinting.
• No third-party analytics service. No advertising. No profiling, no automated decision-making, and no cross-site or cross-app tracking.
• Nothing is sold, shared, or sent anywhere.

Counting visitors without recognising them

To tell one visit from two, each page view is tagged with a one-way SHA-256 hash of four things: your network's address prefix (your IP with its final part removed), your User-Agent string, a secret known only to this server, and today's date.

Two consequences follow, both of them deliberate:

• The tag cannot be reversed. Neither your address nor your browser string can be recovered from it.
• The tag changes at midnight UTC and cannot be matched across two days. There is no way — for me or for anyone with a copy of the database — to tell that a visitor on Tuesday is the same visitor as on Wednesday.

So this site can say how many distinct visitors read it on a given day, and nothing longer than that. That is the whole extent of what it can know, and the design is what makes it so rather than a policy that could quietly change.

How long it is kept

Individual page-view records are kept for a limited period — currently 90 days — after which they are folded into per-day totals (how many visits that day, from which countries, to which pages) and the individual records are deleted.

The fold is irreversible. The per-day totals contain no visitor tag at all, so once a day has been folded, nothing in the database can distinguish one visitor from another on that day.

Two honest qualifications. The period is a setting rather than a law of the site, so it can be changed; if it is, this page is changed with it. And the deletion is not automatic — it runs when the site is maintained, so records can outlive the stated period by however long that lapses. Nothing about them changes in the meantime, and the fold, when it comes, is still irreversible.

Do Not Track and Global Privacy Control

If your browser sends DNT: 1 or Sec-GPC: 1, the visit is not recorded at all. This is not legally required of a site measuring its own audience this way; it is honoured because it is easy and because being asked not to count someone is a good enough reason not to.

Two other things you should know

These are true of the site and would be true without any of the above, so it would be misleading to leave them out.

• A session cookie (PHPSESSID) is set on every page. It is strictly necessary — it carries the anti-forgery token and, for me, the administrative login — and it holds no analytics data. But it means this site does not set "no cookies", and saying otherwise would be false.
• The publication pages load MathJax from a third-party CDN (cdn.jsdelivr.net), so that they can typeset formulae. When you open /publications.php or /publi_bib.php, your browser makes a request to that service, which sees your IP address. That is outside this site's control and is not part of the measurement described above.

Legal basis, and your rights

The legal basis is legitimate interest (GDPR Art. 6(1)(f)): understanding which pages of an academic site are read, in order to keep writing the useful ones. The interest is modest, and so is the intrusion — the data holds no identifier that outlives a day, no address, and nothing that could be combined with any other dataset to single anyone out. It is on that balance that consent is not sought.

You have the right to access, erasure and objection. In practice, an honest answer is more useful than a formal one: the data holds no identifier I can link to you. If you write to me, I have no way to find your rows, because there is nothing in them that connects to you — which is the point of the design, and which the GDPR anticipates (Art. 11: a controller is not obliged to acquire additional information purely in order to identify someone). If you would rather not be counted at all, sending DNT: 1 is the effective remedy, and it works immediately.

Controller

Guilhem Lavaux, Institut d'Astrophysique de Paris, 98 bis boulevard Arago, 75014 Paris, France — guilhem.lavaux@iap.fr