Privacy. What we keep, and why.

What we collect when you sign up or write in, who handles it, how long we keep it, and how to get it deleted.

Last updated: 5 November 2026

The short version

  • We collect as little as we can: your email if you sign up or write in, and the words you send us.
  • We never sell your details, and we don't show you adverts.
  • No tracking cookies and no advertising trackers. Our visitor counts can't follow you from one day to the next.
  • Your email is never shown on the site.
  • You can ask us what we hold about you, or ask us to delete it, at any time: info@thegist.media.

Who we are

The Gist is independent UK media, run by Huw Allen. This site is thegist.media. For this site, Huw is the data controller: the person responsible for your data under UK data protection law (UK GDPR and the Data Protection Act 2018).

Questions or requests about your data: info@thegist.media.

What we collect, and why

The Friday newsletter

If you sign up, we take your email address and pass it to beehiiv, who send the newsletter for us. The newsletter itself, and your subscription, live on beehiiv. Like most newsletter services, beehiiv records whether an email was opened and which links were clicked, so we can see what readers like. Every email has an unsubscribe link, and one click takes you off the list.

Why we can: you asked us to (consent). You can withdraw it at any time by unsubscribing.

Comments on the site

Under each Gist you can leave a comment. Huw reads each one and chooses which to publish. You give us:

  • Your first name and your comment. If Huw publishes your comment, these appear under the Gist, with the date and any reply from Huw. Nothing goes up until Huw has read it. See the house rules.
  • Your email address. This is never shown. We use it to send you a link to check it's you, a receipt with a link to take your comment down, and, if you tick the box, an email when Huw replies.

If you tick "Send me the Friday newsletter too", we add you to the newsletter only after you've clicked the link in your email.

To stop spam, the form uses Cloudflare Turnstile, a check that you're a person. Cloudflare sees your IP address and some details about your browser to do this. Your browser opens a connection to Cloudflare as the form comes into view, and the check itself loads when you tap into the form or press Report. We also keep a short scrambled code made from your IP address with each comment for 30 days, so we can deal with abuse. It can't be turned back into your IP address.

You can take your comment down at any time with the link in your receipt email. That also removes Huw's reply.

Why we can: you've asked us to consider your comment for publication (consent). You can withdraw it by taking the comment down. Spam checks and abuse records are in our legitimate interest in keeping the comments safe.

Suggest a Gist

You can suggest a topic, and add your name and email if you'd like us to know who asked. Only the topic and its votes appear on the board. Your name and email are kept with your suggestion and sent to Huw's inbox, and are never shown. If you tick the newsletter box, we add you to the newsletter straight away.

Why we can: our legitimate interest in hearing ideas from readers, and your consent for the newsletter.

Get in touch and work enquiries

If you send us a message, we keep your name, email and message so we can reply, and Huw gets a copy by email.

Why we can: our legitimate interest in answering you, or taking steps towards working together if that's what you asked about.

Podcast alert

If you ask to hear when the podcast launches, we pass your email to beehiiv with a note that you want the podcast alert. If beehiiv can't be reached at that moment, we hold your email until it can, then pass it on.

Why we can: you asked us to (consent).

Comments on our Instagram

If you comment on one of our Instagram videos, Huw can read and answer it from the site's dashboard. We keep a copy of your Instagram username and comment for that. Instagram's own privacy rules also apply to anything you post there.

Why we can: our legitimate interest in reading and replying to comments on our own posts.

Counting visits

We count how many people visit and which pages they read, so we know what's working. We do it without cookies. Each visit is turned into a scrambled code made from your IP address, your browser type and a random value that changes every day. At midnight the codes and the random value are thrown away, so we can't recognise you the next day, and we never store your IP address. We also note which website sent you here (just its name, like google.com). What we keep after that is daily totals only.

Why we can: our legitimate interest in knowing how the site is used, done in a way that doesn't identify you.

Keeping the site safe

To stop forms being flooded, the server holds your IP address in its memory for up to 10 minutes, and never writes it down. To count each vote, reaction or quiz answer only once, we keep a scrambled code made from your IP address for up to 90 days. Our server keeps no visitor logs.

Why we can: our legitimate interest in keeping the site working and fair.

Cookies and storage on your device

We only use storage the site needs to work, so there's no cookie banner.

  • One cookie, for comment writers only. After you click the check link in your email, a cookie called gist_lw remembers your comments on this device for up to a year, so you don't have to check your email every time. It holds a code, not your email address, and it's only sent with comment requests.
  • Your answers on this device. Your browser remembers your quiz and poll answers, your votes and your reactions, so the page shows them when you come back. These stay on your device and are never sent to us. Clearing your browser's site data removes them.
  • Page animations. For the length of your visit, your browser notes whether you've seen the opening animation, so it doesn't play every time.

Who else handles your data

We use a few companies to run the site. They only use your data to do that work for us, under contracts that require them to keep it safe.

  • beehiiv sends the newsletter and holds the subscriber list.
  • Resend sends the emails from the site, such as comment links and replies.
  • Cloudflare runs the Turnstile spam check, and stores and plays our videos. When you press play, your browser fetches the video from Cloudflare.
  • Railway hosts the site and the data on this page.
  • Meta (Instagram). The home page shows our latest Instagram posts. Your browser loads those pictures straight from Instagram's servers, which see your IP address, as any website you visit would.
  • Anthropic (Claude). Huw may use the AI assistant Claude to help him read comments, on the site and on Instagram, and draft replies. Claude can see comments, Gist suggestions and messages, including names. It sees an email address only if Huw asks for one to reply to a message. It never sees the addresses of comment writers or subscribers. Anthropic handles this under its own privacy terms.
  • GitHub stores the code and articles that make up the site. It holds none of your details.

If the law requires it, for example a court order or a formal complaint about a comment, we may share what we hold with the people entitled to it.

Links to Instagram, TikTok, YouTube, Threads, LinkedIn and Facebook take you to those companies' own sites, which have their own privacy rules. We don't embed their players or trackers on our pages.

Data that leaves the UK

Several of these companies are based in the United States, so your data may be handled there. When it is, it's protected by the UK's approved safeguards: the UK-US data bridge where the company is certified, or otherwise the transfer terms approved by the Information Commissioner.

How long we keep it

  • Newsletter and podcast alert: until you unsubscribe.
  • Published comments: for as long as they're on the site, until you or Huw take them down.
  • Comments you didn't confirm: deleted after 48 hours.
  • Comments waiting for Huw: kept until he decides.
  • Comments Huw doesn't publish: the text is deleted after 30 days, the rest after 90 days.
  • Comments you take down: the text goes straight away, and the record within 30 days.
  • Your email, as a comment writer: while any of your comments is on the site, and for 2 years after your last comment.
  • Abuse codes on comments: 30 days. Reports of a comment: 90 days.
  • Gist suggestions: your name and email are deleted after a year. The topic may stay on the board.
  • Messages and work enquiries: a year, or 6 months once dealt with. Copies in Huw's inbox are kept for as long as he needs them for the conversation.
  • Instagram comments: the text is deleted after 6 months, unless Huw is still replying. Your username and the date stay for up to 13 months after the video was posted.
  • Visit codes: deleted every midnight. Daily totals are kept for about 13 months.
  • Vote and answer codes: 90 days.

Your rights

Under UK data protection law you can ask us to:

  • tell you what we hold about you and give you a copy;
  • correct anything that's wrong;
  • delete your data;
  • stop or limit how we use it, or object to a use based on our legitimate interests;
  • give you your data in a form you can take elsewhere.

Where we rely on your consent, you can withdraw it at any time. That doesn't affect anything we did before.

Email info@thegist.media from the address you used with us. We'll reply within a month, and it's free.

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk (opens in a new tab) or on 0303 123 1113.

Children

The Gist is written for adults. If you're under 13, please don't send us comments or sign up. If you think a child has given us their details, tell us and we'll delete them.

No automated decisions

We don't make decisions about you by computer alone, and we don't build profiles of readers.

Changes to this page

If we change how we use your data, we'll update this page and the date at the top. If the change is a big one, we'll tell newsletter subscribers too.