Privacy policy | The Hardy Index

Who we are

The Hardy Index is published by Hardy, an independent research publication, and Hardy is the data controller for the personal data described on this page.

You can reach us about anything on this page, including a request to exercise your rights, at index@hardyindex.com.

This policy covers hardyindex.com and its subpages. It does not cover any site you reach by following a link from here, each of which has its own policy.

What we collect

Three things, and nothing else.

Analytics, only if you accept cookies. If you accept on the cookie banner, Google Analytics 4 records the pages you view, roughly where in the world you are, the type of device and browser you use, and how you arrived. It assigns your browser a random identifier so a second page view is not counted as a second person. It does not receive your name, your email address or anything you type.
Anything you send us. If you write to us, we hold your email address and the content of your message so that we can reply, and so that a correction can be traced back to the source that prompted it.
Server logs. Our hosting provider records the requests that reach the site, including IP address, user agent and the page requested, in order to serve the page, keep the site up and defend it from abuse. We do not use these logs to build a picture of individual readers.

There is no account system, no login, no comment box, no newsletter and no advertising network on this site, so none of the data those things involve exists.

Why we are allowed to hold it

UK GDPR requires a lawful basis for each purpose. Ours are as follows.

What	Purpose	Lawful basis
Analytics	Understanding which pages get read, so that editorial effort goes where it is useful	Consent, given on the cookie banner and withdrawable at any time
Correspondence	Replying to you, and tracing a published correction to the source that prompted it	Legitimate interests: running a correspondence and keeping an audit trail for corrections
Server logs	Delivering pages, keeping the site available and defending it from abuse	Legitimate interests: security and availability of the service

Where we rely on legitimate interests, we have considered whether that interest is overridden by your rights and concluded that it is not, because the data is minimal, is not used to target you and is not combined with anything else. You can object to that processing at any time, and we will stop unless there is a compelling reason not to.

Google Analytics in detail

We use Google Analytics 4 with the measurement ID G-XLBJTGC9Q3. Google Ireland Limited acts as our data processor for it, with Google LLC as a sub-processor.

Google Analytics 4 does not log or store IP addresses. Your IP address is used in transit to work out an approximate location, at city level at most, and is then discarded.
We have not enabled Google Signals, advertising features, demographic reporting or data sharing with Google products. The property is configured for measurement, not for advertising.
Event level data is retained by Google for no longer than 14 months, which is the longest a standard property allows. Aggregate reports built from it can persist beyond that.
Until you accept, Google consent mode holds analytics storage in a denied state, which means no analytics cookie is written and no identifier is stored on your device.

If you would rather not be measured on any site, Google publishes a browser add-on that opts you out of Analytics everywhere, at tools.google.com/dlpage/gaoptout. Rejecting on our banner achieves the same thing for this site alone.

Cookies

The only cookies this site can set are the two Google Analytics uses, and they are set only after you accept. Each one is named, explained and dated in the cookie policy, along with how to change your mind.

Two processors, both acting on our instructions, and nobody else.

Google, for analytics, if you have accepted cookies.
Vercel, which hosts the site and therefore handles the request logs described above.

We do not sell personal data, we do not share it with data brokers, advertisers, blockchain projects or anyone else, and no commercial arrangement described on the disclosure page involves passing anything about you to a third party. Affiliate links are plain outbound links: no script, no pixel and no identifier follows you when you click one.

We would disclose data if the law required it, and we would say so publicly wherever we were permitted to.

Where the data goes

Both processors operate outside the UK, including in the United States. Transfers rely on the UK International Data Transfer Addendum to the European Commission standard contractual clauses, together with the UK extension to the EU to US Data Privacy Framework where the recipient is certified under it. Those are the safeguards UK GDPR requires for an international transfer.

How long we keep it

Analytics: at most 14 months at event level, held by Google.
Correspondence: for as long as the exchange is live, and then for up to two years, so that a published correction can be traced to what prompted it. Longer if the exchange concerns a dispute.
Server logs: for the short period our host retains them, which is a matter of days rather than months.

Your rights

Under UK GDPR you have the right to ask us for the following. There is no charge, and we will answer within one month.

A copy of the personal data we hold about you, and confirmation of what we do with it.
Correction of anything inaccurate, or completion of anything incomplete.
Erasure of your data, where we have no overriding reason to keep it.
Restriction of what we do with it while a question about it is resolved.
A portable copy of anything you gave us, in a machine-readable form.
An objection to any processing we base on legitimate interests.
Withdrawal of your consent to analytics, at any time, which is as easy to do as giving it was. It does not affect anything measured before you withdrew.

To exercise any of these, write to index@hardyindex.com. If you are not satisfied with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. We would rather you came to us first, but you are not obliged to.

Automated decisions and children

We do not carry out automated decision making or profiling that produces legal or similarly significant effects. Nothing on this site scores, ranks or targets a reader: the scores here are about blockchains.

This site is written for a general adult audience and is not directed at children. We do not knowingly collect data about anyone under 13. If you believe we hold such data, write to us and we will delete it.

Security

The site is a set of static files served over HTTPS. There is no database of readers to breach, because there is no reader database. Correspondence sits in an ordinary email account protected by two-factor authentication.

Changes to this policy

If this policy changes in a way that affects what we collect or why, the date at the top of the page changes with it and, where the change is material, the cookie banner will ask you again. Every previous version of this site is public in its published record, so a quiet rewrite is not available to us.