The short version
- There are no accounts, no sign-up and no mailing list. The site never asks for your name or email.
- The only thing collected is Google Analytics, to count visits.
- It is off until you accept it. Decline and no analytics cookie is set.
- Nothing is sold, shared or handed to advertisers. There are no ad networks.
- You can change your answer at any time using .
What is collected
When analytics is switched on, Google Analytics 4 (property
G-QZGB06N33B) records the ordinary things an analytics tool records:
| Collected | Why |
|---|---|
| Pages viewed, and time on them | To see which entries people actually read |
| Approximate location, derived from IP | Country-level only. The full IP is not stored by GA4 |
| Device, browser, screen size | To know which layouts matter |
| Referrer — how you arrived | To see where readers come from |
| A randomly generated visitor ID | To distinguish a returning visitor from a new one |
That identifier is not a name. Nothing on this site asks who you are, and no attempt is made to work it out or to join this data to anything else.
What is not collected
- No name, email address, postal address or phone number — none are ever requested.
- No advertising or cross-site tracking. Google Consent Mode is configured with
ad_storage,ad_user_dataandad_personalizationpermanently denied, whatever you choose. - No data is sold or shared with anyone for their own purposes.
- No health information. The site cannot see what you read anywhere else, and nothing you read here is tied to you.
Cookies
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
_ga | Google Analytics | Distinguishes visitors | Up to 2 years |
_ga_QZGB06N33B | Google Analytics | Maintains session state | Up to 2 years |
pi-consent | This site | Remembers your consent answer so you are not asked again. Stored in your browser only, never sent anywhere | Until you clear site data |
The two Google cookies are only set if you accept. Decline and they
are never created. pi-consent is set either way, because remembering
"no" is the only way to avoid asking again.
Legal basis, and your rights
Analytics runs on consent, asked before anything is set, which is what the UK and EU rules require. Consent is freely given, specific and as easy to withdraw as it was to give.
If you are in the UK or EEA you have the right to:
- Withdraw consent at any time — , or clear this site's data in your browser.
- Ask what is held about you, and to have it deleted. In practice there is very little: no account exists, and the analytics identifier is not linked to a person.
- Object to the processing, or complain to your data protection authority. In the UK that is the Information Commissioner's Office.
Analytics data is retained by Google for 14 months, after which it is deleted automatically.
Who else is involved
Google processes the analytics data, which may involve transfer outside the UK and EEA under their standard data protection terms.
Vercel hosts the site and, like any web host, processes server logs including IP addresses in order to serve pages and resist abuse.
Nothing else loads from another origin. Fonts and photographs are served from this site rather than from a CDN, specifically so that visiting a page does not announce you to anyone else.
Commercial links
Some pages link to Nalu Labs, with whom Protocol Index has a financial relationship. Those links are labelled where they appear and are described in full under independence and funding. Following one takes you to a different company with its own privacy policy; nothing about you is passed along when you do.
Contact
Questions about any of this, or a request about your data: hello@protocolindex.org.
The date at the top changes with it. If the change is material — a new processor, a new category of data — the consent banner is shown again rather than assuming the previous answer still stands.