Privacy, plainly

The Concept Library has no accounts, no sign-up, no comments and no newsletter, so it never asks for your name or email address. What it does see is how the site is used: which pages are visited, roughly where a visit comes from (country and city, worked out from your IP address), the type of device and browser, and the page that sent you here.

Three things collect this. Google Analytics 4 records the pages you view, how long you stay, how you arrived (a search engine or a link, for example), approximate location, device, browser, screen size and language, and a random ID kept in a cookie. In the EU, the EEA, the UK and Switzerland it only runs after you say yes. Vercel Analytics and Vercel Speed Insights, from the company that hosts the site, count visits, pages viewed, the referring site, approximate country, device and browser type, and page speed. They set no cookies. And Vercel, as the host, keeps ordinary server logs of each request, including your IP address, for a period set by Vercel’s plan.

When you first arrive, the site checks which country your connection comes from, only to decide whether to ask before Google Analytics loads. The site does not save the result of that check. Google Analytics and Vercel Analytics separately record an approximate country in their visit counts.

You never have to give us data to read the site. Nothing here is aimed at children, and nothing decides anything about you automatically.

Google Analytics sets two cookies: _ga, which tells one browser from another, and _ga_ followed by the site’s ID, which keeps track of a visit. Each holds a random number, not your name, and lasts up to two years. They are used for one thing: counting visits and seeing which concepts get read, so we know which concepts to add and improve.

The site also keeps one small note in your browser’s local storage, called cl-analytics-consent, that remembers whether you said yes or no. It isn’t a cookie, it is never sent to us, and it exists only to remember your choice, so it is kept whichever you choose.

If you are in the EU, the EEA, the UK or Switzerland, Google Analytics doesn’t load and sets no cookies until you choose “Yes, count me in” on the banner or turn it on below. If we can’t tell where you are, we ask. Everywhere else, including India, it loads straight away, and you can turn it off at any time below or under Cookie choices at the bottom of any page.

Turning Google Analytics off stops it counting you from that moment and deletes its cookies from this browser. It does not delete visits Google has already received; write to us for that. If you clear your browser’s site data, your choice is cleared too, and outside the regions above Google Analytics will count you again until you turn it off.

• Google receives your visit data through Google Analytics, when it is running for you.
• Vercel hosts the site and runs Vercel Analytics, Speed Insights and the server logs.
• YouTube sees your IP address when the thumbnails of videos on a concept page load. The video player itself (from youtube-nocookie.com) only loads when you press play, and once it loads YouTube may store information on your device and its privacy policy applies.
• The Metropolitan Museum of Art, the Smithsonian, Wikimedia Commons and Pexels see your IP address when an image from them loads on a concept page.

Google and Vercel are based in the United States and process data there and elsewhere. For data from the UK, the EU and Switzerland they rely on legal safeguards such as standard contractual clauses or the EU-US Data Privacy Framework, which each describes in its own privacy policy. You can ask us for details. YouTube, The Metropolitan Museum of Art, the Smithsonian, Wikimedia Commons and Pexels receive your IP address directly from your browser when their content loads, under their own privacy policies.

For Google Analytics where we ask first, the reason is your consent, which you can withdraw whenever you like. Withdrawing doesn’t undo counting that happened before. For Vercel Analytics, Speed Insights and server logs in the EU, the EEA, the UK and Switzerland, the reason is our legitimate interest in keeping the site working, secure and useful to readers. Elsewhere, Google Analytics counts visits without asking first, and you can switch it off at any time. The site is run from India, so India’s Digital Personal Data Protection Act, 2023 may also apply.

Google deletes visit-level data linked to the cookie ID after no more than 14 months (our setting). Totals in Google Analytics’ standard reports carry no cookie ID and are kept for as long as the property exists. The cookies expire after two years at most, or at once if you turn Google Analytics off. Vercel keeps its visit counts and server logs for a period set by Vercel’s plan. Your yes-or-no note stays in your browser until you clear its data or change your choice; if your browser blocks storage, a choice lasts only for the page you are on.

Under the GDPR and the UK GDPR you can ask to see the data held about you, have it corrected or deleted, limit or object to its use, ask for a copy you can take elsewhere, and withdraw consent at any time. Withdrawing is as easy as giving: switch analytics off above. If you are in India, you can ask us to tell you about, correct or erase your personal data, and raise a grievance at the address below.

Your right to object: where we rely on legitimate interest you can object at any time. For Google Analytics, turning it off under Cookie choices does this immediately; for anything else, write to us.

To make a request, email the address below. We will reply within one month. To find or delete your Google Analytics data, copy the value of your _ga cookie before you turn analytics off, because turning it off deletes that cookie. We can’t look you up by name or email address, and Vercel’s counts and server logs hold nothing we can link to you, so we may be unable to single out your visits there; we will tell you if so. If you are unhappy with the answer, you can also complain to your data protection authority; in the UK that is the Information Commissioner’s Office (ico.org.uk).

The Concept Library is run by Ravi Surana, who is responsible for this data. Questions, requests and complaints go to iamravisurana@gmail.com. If this policy changes, we update the date at the top.