Privacy policy
This site has no accounts, no cookies and no analytics. The only personal data involved is what every web request carries, which our host processes to deliver the pages.
Last updated
Who is responsible
The Financial Repression Tracker (financialrepression.cc) is run by the Financial Repression Tracker project, the controller for the processing described here. Contact: contact@financialrepression.cc.
This notice tells you what personal data is processed when you use the site, why, on what legal basis and what your rights are, as the EU General Data Protection Regulation (GDPR) requires.
Legal basis GDPR Art. 13(1)(c), Art. 13(2)(b)
Regulation (EU) 2016/679 (General Data Protection Regulation), Article 13(1)(c)Primary source
“the purposes of the processing for which the personal data are intended as well as the legal basis for the processing”Regulation (EU) 2016/679 (General Data Protection Regulation), Article 13(2)(b)Primary source
“the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability”What data is processed
The site is a set of static pages. When you open one, your browser sends a normal web request, which includes your IP address, the address of the page, and technical details such as your browser type. An IP address can be used to identify a person, so we treat it as personal data.
Our host and content delivery network, Cloudflare, receives these requests to deliver the pages and protect the site against abuse. Cloudflare describes what it processes in its privacy policy (opens in a new tab): IP addresses, traffic routing data and other information about traffic to and from the sites it serves. Cloudflare may show us aggregated traffic figures and request logs; we use them only to run and secure the site.
We do not ask for, collect or store anything else. There are no accounts, forms or comments. If you write to us by email or on X, we process your message and contact details to reply.
You do not have to give us any personal data, but your browser cannot load the pages without sending your IP address.
Legal basis GDPR Art. 4(1), Recital 30, Art. 13(2)(e) and the host’s policy
Regulation (EU) 2016/679 (General Data Protection Regulation), Article 4(1)Primary source
“an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier”Regulation (EU) 2016/679 (General Data Protection Regulation), Recital 30Primary source
“Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses”Cloudflare Privacy Policy (effective 4 November 2025), End UsersSecondary source
“The information processed may include but is not limited to IP addresses, traffic routing data, system configuration information, and other information about traffic to and from Customers’ websites, devices, applications, and/or networks.”Regulation (EU) 2016/679 (General Data Protection Regulation), Article 13(2)(e)Primary source
“whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data”No cookies, tracking or browser storage
We checked the site’s code. It:
- sets no cookies and uses no local storage, session storage or similar browser storage;
- loads no analytics, advertising or tracking scripts, and no social media embeds;
- loads no fonts, scripts or images from other servers: everything comes from financialrepression.cc itself, including the data files the charts read and the map outlines.
Your browser may keep its own cache of the pages, as it does for any site; the site does not control that.
Why, and on what legal basis
Delivering the pages and keeping the site and its network secure and working are our legitimate interests, and processing your IP address and request data is necessary for them; it is limited to what any website needs to answer a request. Network and information security is recognised in the GDPR as a legitimate interest. Replying to a message you send us rests on the same basis. We do not use your data for profiling, marketing or automated decisions.
Legal basis GDPR Art. 6(1)(f), Recital 49
Regulation (EU) 2016/679 (General Data Protection Regulation), Article 6(1)(f)Primary source
“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data”Regulation (EU) 2016/679 (General Data Protection Regulation), Recital 49Primary source
“The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned.”Who receives the data
- Cloudflare, Inc. (hosting and content delivery). For the request logs it makes available to us, and for the content that passes through its network, Cloudflare acts as our processor, on our instructions. For some other data it collects, its privacy policy says it acts as a controller in its own right.
- Cloudflare Email Routing receives any email you send to contact@financialrepression.cc and forwards it to the mailbox we read.
- X, if you contact us there, processes your message under its own policy.
We do not sell or share personal data with anyone else.
Legal basis GDPR Art. 13(1)(e) and the host’s policy
Regulation (EU) 2016/679 (General Data Protection Regulation), Article 13(1)(e)Primary source
“the recipients or categories of recipients of the personal data, if any”Cloudflare Privacy Policy (effective 4 November 2025), Section 6, Notice to EU, UK, and Swiss residentsSecondary source
“Cloudflare is a data controller for the personal information collected from all categories of data subjects listed above, with the following exceptions: Cloudflare is a data processor of Customer Logs, Administrative User Audit Logs, and some account settings information. In addition, Cloudflare is a data processor for any of the content provided by Customers and End Users through the Services that transits, or in some cases, is stored on, the Cloudflare network.”Cloudflare Privacy Policy (effective 4 November 2025), End UsersSecondary source
“The End User data that we make available to our Customers via the Service dashboard or other online interface are specifically defined as “Customer Logs”.”International transfers
Cloudflare, Inc. is based in San Francisco, United States, so request data may be processed outside the European Economic Area. The European Commission has decided that the United States ensures an adequate level of protection for data sent to organisations certified under the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), and Cloudflare is certified.
Cloudflare states that, for transfers from the EEA, Switzerland and the UK to the United States, it relies on its certifications under the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework and the UK Extension, and on standard contractual clauses should those certifications lapse.
Email you send us passes through Cloudflare Email Routing and is covered by the same arrangements.
Legal basis GDPR Art. 13(1)(f), Art. 45(1), Art. 46(1); Commission Implementing Decision (EU) 2023/1795, Art. 1 and the host’s policy
Regulation (EU) 2016/679 (General Data Protection Regulation), Article 13(1)(f)Primary source
“the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission”Regulation (EU) 2016/679 (General Data Protection Regulation), Article 45(1)Primary source
“A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection.”Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (EU-US Data Privacy Framework), Article 1Primary source
“For the purpose of Article 45 of Regulation (EU) 2016/679, the United States ensures an adequate level of protection for personal data transferred from the Union to organisations in the United States that are included in the ‘Data Privacy Framework List’”Cloudflare Privacy Policy (effective 4 November 2025), Self-certification to the Data Privacy FrameworkSecondary source
“Cloudflare has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles”Regulation (EU) 2016/679 (General Data Protection Regulation), Article 46(1)Primary source
“a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards”Cloudflare Privacy Policy (effective 4 November 2025), Transfers from countries in the EEA, Switzerland, and the UKSecondary source
“When Cloudflare transfers personal data from the EEA, Switzerland, or the United Kingdom (UK) to the United States, we rely on our certifications under the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF), and the UK Extension to the EU-U.S. DPF. Should these certifications lapse or become otherwise invalidated, Cloudflare relies on the standard contractual clauses”How long data is kept
Request logs are kept only for as long as the Cloudflare dashboard retains them for this site; we do not export or copy them. We keep no visitor data outside Cloudflare’s logs, which identify people only by IP address. Messages you send us are kept only as long as needed to deal with them.
Legal basis GDPR Art. 13(2)(a), Art. 5(1)(e) and the host’s policy
Regulation (EU) 2016/679 (General Data Protection Regulation), Article 13(2)(a)Primary source
“the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period”Regulation (EU) 2016/679 (General Data Protection Regulation), Article 5(1)(e)Primary source
“kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”Cloudflare Privacy Policy (effective 4 November 2025), Section 6, Notice to EU, UK, and Swiss residentsSecondary source
“Cloudflare is a data controller for the personal information collected from all categories of data subjects listed above, with the following exceptions: Cloudflare is a data processor of Customer Logs, Administrative User Audit Logs, and some account settings information. In addition, Cloudflare is a data processor for any of the content provided by Customers and End Users through the Services that transits, or in some cases, is stored on, the Cloudflare network.”Links to other sites
The site links to X (@fin_repression) and to the official and research sources behind each entry. When you follow a link you leave this site, and the other site’s own privacy policy applies.
Your right to object
You have the right to object, at any time and on grounds relating to your particular situation, to our processing of your personal data based on legitimate interests. All the processing described on this page rests on legitimate interests. To object, email contact@financialrepression.cc.
Legal basis GDPR Art. 21(1), Art. 21(4)
Regulation (EU) 2016/679 (General Data Protection Regulation), Article 21(1)Primary source
“The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1)”Regulation (EU) 2016/679 (General Data Protection Regulation), Article 21(4)Primary source
“the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information”Your other rights
Under the GDPR you also have the right to:
- ask whether we process personal data about you, and get a copy (access);
- have inaccurate data corrected (rectification);
- have data erased, on the grounds the GDPR sets out (erasure);
- have processing restricted, in the cases the GDPR sets out (restriction).
The right to data portability applies only to processing based on consent or a contract, so it does not cover the processing described here.
We keep no visitor data outside Cloudflare’s logs, which identify people only by IP address. If we cannot tell which records are yours, we will tell you; you can help by giving the IP address and time of your visit.
To use a right, email contact@financialrepression.cc or message @fin_repression on X (opens in a new tab). We answer within one month. If a request is complex or we receive many, we may extend this by up to two further months; if so, we will tell you within the first month and explain why.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live, work or where you think the infringement took place.
Legal basis GDPR Art. 15(1), Art. 16, Art. 17(1), Art. 18(1), Art. 20(1)(a), Art. 11(2), Art. 12(3), Art. 77(1)
Regulation (EU) 2016/679 (General Data Protection Regulation), Article 15(1)Primary source
“The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed”Regulation (EU) 2016/679 (General Data Protection Regulation), Article 16Primary source
“The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her.”Regulation (EU) 2016/679 (General Data Protection Regulation), Article 17(1)Primary source
“The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay”Regulation (EU) 2016/679 (General Data Protection Regulation), Article 18(1)Primary source
“The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies”Regulation (EU) 2016/679 (General Data Protection Regulation), Article 20(1)(a)Primary source
“the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1)”Regulation (EU) 2016/679 (General Data Protection Regulation), Article 11(2)Primary source
“the controller shall inform the data subject accordingly, if possible. In such cases, Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification.”Regulation (EU) 2016/679 (General Data Protection Regulation), Article 12(3)Primary source
“within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.”Regulation (EU) 2016/679 (General Data Protection Regulation), Article 77(1)Primary source
“every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement”Changes to this policy
If the site starts processing personal data in a new way, for example by adding a feature that needs it, this page will be updated first and the date at the top will change.