Privacy policy

1. Who is responsible

The Long Save is operated jointly by Ottilie Vance and Rafe Adeyemi as an unincorporated two-person publication. We are the data controllers for anything described here. Our postal address is Lighthouse, 28 Kensington Street, Brighton BN1 4AJ, United Kingdom, and we can be reached at [email protected].

We are not a company, have no employees, and do not have a statutory obligation to appoint a data protection officer. Both of us take responsibility for this policy and either of us can answer a question about it.

2. What we actually collect

There are exactly two circumstances in which we hold anything about you: you send us a message, or your browser stores two values that never leave your device. That is the complete list.

Data held by The Long Save

What	Where it comes from	Why we have it	How long
Name or chosen alias	The write-in form or an email you send	To address a reply to the right person	Until the exchange ends, then up to 12 months
Email address	The write-in form or an email you send	To reply to you and nothing else	Up to 12 months from the last message
Message content	You, voluntarily	To answer the point you raised or publish a correction	Up to 24 months where it led to a correction
Topic selection	The write-in form	To route the message to whichever of us handles it	Same as the message
Notice acknowledgement	Your own browser storage	So the cookie strip does not reappear on every page	Until you clear site data
Anonymous page tally	Your own browser storage	A private counter, visible only to you	Until you clear site data

We do not collect IP addresses ourselves, do not run analytics of any kind, do not use tracking pixels, and do not operate accounts, logins or comment threads. There is no advertising on this site and no third party is paid or permitted to observe your visit.

3. Our lawful basis

Where you contact us, we rely on legitimate interests under Article 6(1)(f) of the UK GDPR: we have a plain interest in answering readers who write to us, and replying to correspondence is what any reasonable person expects when they send a message. Where you tick the consent box on the form, that also records your agreement to be replied to by email, which you can withdraw at any time by telling us.

The two values stored in your browser are covered by the Privacy and Electronic Communications Regulations rather than the UK GDPR. One is strictly necessary to remember your own choice; the other is optional and only begins counting if you press Fine by me.

4. Hosting and server logs

This site is a set of static files served by a commercial hosting provider on our behalf. Like any web server, that host records technical request data — an IP address, a timestamp, the file requested and a user-agent string — for security and reliability purposes. Those logs belong to the host, are retained under their own schedule, and we neither read them nor receive copies. Our hosting provider acts as a processor for that limited purpose.

We hold no database. There is no application layer on this site, nothing is written to a server when you use the form, and consequently there is nothing on the server that identifies any reader.

5. The write-in form specifically

The form on the write in page validates your entries in your own browser and, in this published version of the site, does not transmit them anywhere. If we later connect it to an email endpoint we will amend this policy first and note the date of the change in section 11 rather than doing it silently.

Anything you send us by ordinary email is held in our mail provider's system, which is an established provider operating under its own security and retention terms as our processor.

6. Who we share things with

Nobody. We do not sell, rent, licence, trade or otherwise disclose reader data, and we have never been asked to. The only third parties involved at all are our hosting provider and our email provider, both strictly as processors and both limited to what is described above.

We would disclose information only where we were legally compelled to by a UK court or a competent authority. That has not happened; if it did, we would tell the person affected unless we were prohibited from doing so.

7. Transfers outside the UK

Our hosting and email providers operate infrastructure that may sit outside the United Kingdom. Where that is the case, transfers rely on the UK's adequacy arrangements or on the International Data Transfer Addendum to the standard contractual clauses. We have not chosen to move any data outside the UK ourselves and hold no copies abroad.

8. How we keep it safe

Correspondence is read on two personal machines, both with full-disk encryption and separate accounts for this work. Mail accounts use two-factor authentication. The site itself is served only over HTTPS, and every asset it loads — styles, fonts, icons, images — is stored in the same package as the pages, so your browser makes no request to any other domain while reading us.

We do not keep spreadsheets of readers, because there is nothing to put in them.

9. Children

This site is written for an adult general readership and is not directed at children. We do not knowingly hold data about anyone under 13. If you believe a child has sent us personal information, write to us and we will delete it without asking for anything further.

10. Your rights

Under UK data protection law you may ask us for a copy of anything we hold about you, ask us to correct it, ask us to delete it, object to our holding it, ask us to restrict what we do with it, or ask us to transfer it to you in a portable form. You may also withdraw consent to being replied to at any time.

Write to [email protected] or to the postal address above. We answer within one month and in practice usually within a week, because the search consists of two people looking in one mailbox. We will not charge you and will not ask for identification beyond what is needed to be sure we are talking to the right person.

If you are unhappy with how we have handled a request, you can complain to the Information Commissioner's Office, the UK's independent data protection regulator. We would rather you told us first so we can put it right, but you are under no obligation to.

11. Changes to this policy

This is the third version of this policy. The previous version, dated 04 January 2026, described the write-in form as sending directly to email, which was inaccurate for the published site; section 5 now states the position correctly. Material changes are recorded here rather than replaced quietly, and the review date at the top of the page always reflects the current text.

For the two values stored in your browser and how to remove them, see our cookie policy, which lists both by name.