Privacy policy | The Hardy Index

Who we are

The Hardy Index is published by Hardy, an independent research publication, and Hardy is the data controller for the personal data described on this page.

You can reach us about anything on this page, including a request to exercise your rights, at index@hardyindex.com.

This policy covers hardyindex.com and its subpages. It does not cover any site you reach by following a link from here, each of which has its own policy.

What we collect

Four things, and nothing else.

Analytics, only if you accept cookies. If you accept on the cookie banner, Google Analytics 4 records the pages you view, roughly where in the world you are, the type of device and browser you use, and how you arrived. It assigns your browser a random identifier so a second page view is not counted as a second person. It does not receive your name, your email address or anything you type.
Your email address, if you ask for alerts. If you sign up to be told when a rating moves, we hold your address, the chains or tiers you chose to watch, and a record of what we sent and whether it arrived. Nothing else. There is a section on this below.
Anything you send us. If you write to us, we hold your email address and the content of your message so that we can reply, and so that a correction can be traced back to the source that prompted it.
Server logs. Our hosting provider records the requests that reach the site, including IP address, user agent and the page requested, in order to serve the page, keep the site up and defend it from abuse. We do not use these logs to build a picture of individual readers.

There is no account system, no login, no comment box and no advertising network on this site, so none of the data those things involve exists. The alert list is the only list here, you are on it only if you asked to be, and it holds an address and a watch choice rather than a profile of you.

Why we are allowed to hold it

UK GDPR requires a lawful basis for each purpose. Ours are as follows.

What	Purpose	Lawful basis
Analytics	Understanding which pages get read, so that editorial effort goes where it is useful	Consent, given on the cookie banner and withdrawable at any time
Watch alerts	Emailing you when a rating you chose to watch actually moves	Consent, given by confirming your address and withdrawable in one click
Correspondence	Replying to you, and tracing a published correction to the source that prompted it	Legitimate interests: running a correspondence and keeping an audit trail for corrections
Server logs	Delivering pages, keeping the site available and defending it from abuse	Legitimate interests: security and availability of the service

Where we rely on legitimate interests, we have considered whether that interest is overridden by your rights and concluded that it is not, because the data is minimal, is not used to target you and is not combined with anything else. You can object to that processing at any time, and we will stop unless there is a compelling reason not to.

Google Analytics in detail

We use Google Analytics 4 with the measurement ID G-XLBJTGC9Q3. Google Ireland Limited acts as our data processor for it, with Google LLC as a sub-processor.

Google Analytics 4 does not log or store IP addresses. Your IP address is used in transit to work out an approximate location, at city level at most, and is then discarded.
We have not enabled Google Signals, advertising features, demographic reporting or data sharing with Google products. The property is configured for measurement, not for advertising.
Event level data is retained by Google for no longer than 14 months, which is the longest a standard property allows. Aggregate reports built from it can persist beyond that.
Until you accept, Google consent mode holds analytics storage in a denied state, which means no analytics cookie is written and no identifier is stored on your device.

If you would rather not be measured on any site, Google publishes a browser add-on that opts you out of Analytics everywhere, at tools.google.com/dlpage/gaoptout. Rejecting on our banner achieves the same thing for this site alone.

Watch alerts in detail

You can ask to be emailed when a Hardy Score or tier moves: for one chain, for a whole tier, or for any change at all. It is not a newsletter. An alert is sent because something you chose to watch actually moved, so most weeks it sends nothing, and that silence is the point of it.

Signing up takes two steps on purpose. You give an address, we email that address once to ask whether you meant it, and you are on the list only after you click the link in that email. Nobody can add you by typing your address into the form, and we do not buy, rent or import addresses from anywhere.

What we hold: your email address, the chains or tiers you asked to watch, the date you confirmed, and a log of each message we sent you and whether it was delivered, bounced or reported as spam.
What we do not hold: your name, your location, any holdings, and anything about what you own or trade. Watching a chain tells us you are interested in it, and we treat it as nothing more than that.
Who handles it: the list itself sits in our database at Supabase, and the messages are delivered by Brevo. Both are named again in the section on who else sees it.
Leaving: every alert carries a one-click unsubscribe link, and clicking it is enough. There is no login, no confirmation step and no form asking you to reconsider.

One thing worth saying plainly about leaving. When you unsubscribe we do not erase the row, we mark it stopped, and we keep that mark. It is what stops a later sign-up form or an import putting you back on. If you would rather we deleted the record outright, ask us and we will, and you can join again whenever you like.

If a message to your address hard bounces, or you report one as spam, we stop sending to it permanently and without asking. That is the same mark as an unsubscribe and it is there to protect you as much as us.

Cookies

The only cookies this site can set are the two Google Analytics uses, and they are set only after you accept. Each one is named, explained and dated in the cookie policy, along with how to change your mind. The subscribe form sets no cookie at all.

Four processors, each acting on our instructions and none of them free to use your data for their own ends, and nobody else.

Google, for analytics, if you have accepted cookies.
Vercel, which hosts the site and therefore handles the request logs described above.
Supabase, which hosts the database the alert list is stored in.
Brevo, which delivers the alert and confirmation emails and tells us when one bounces or is reported as spam.

We do not sell personal data, we do not share it with data brokers, advertisers, blockchain projects or anyone else, and no commercial arrangement described on the disclosure page involves passing anything about you to a third party. Affiliate links are plain outbound links: no script, no pixel and no identifier follows you when you click one.

We would disclose data if the law required it, and we would say so publicly wherever we were permitted to.

Where the data goes

Every processor listed above operates outside the UK. Transfers rely on the UK International Data Transfer Addendum to the European Commission standard contractual clauses, together with the UK extension to the EU to US Data Privacy Framework where the recipient is certified under it. Those are the safeguards UK GDPR requires for an international transfer.

The alert list is deliberately kept closer to home than that suggests. The database holding it is hosted in Paris and Brevo is a French company delivering from the European Union, so in normal running your address does not leave the EU. The safeguards above still apply, because both providers are corporate groups whose staff can reach their own systems from elsewhere, and we would rather state that than imply a guarantee we do not control.

How long we keep it

Analytics: at most 14 months at event level, held by Google.
Alert subscriptions: for as long as you want them. An address that never confirms is deleted after a few days. Once you unsubscribe, or an address bounces, we keep a stopped record rather than the live subscription, so that the stop is honoured, and we delete that too if you ask.
The send log: the record of which alerts went to your address, and whether they arrived, for two years. It is what lets us answer whether you were sent something and prove we stopped when you told us to.
Correspondence: for as long as the exchange is live, and then for up to two years, so that a published correction can be traced to what prompted it. Longer if the exchange concerns a dispute.
Server logs: for the short period our host retains them, which is a matter of days rather than months.

Your rights

Under UK GDPR you have the right to ask us for the following. There is no charge, and we will answer within one month.

A copy of the personal data we hold about you, and confirmation of what we do with it.
Correction of anything inaccurate, or completion of anything incomplete.
Erasure of your data, where we have no overriding reason to keep it.
Restriction of what we do with it while a question about it is resolved.
A portable copy of anything you gave us, in a machine-readable form.
An objection to any processing we base on legitimate interests.
Withdrawal of your consent, at any time, which is as easy to do as giving it was. For analytics that is the cookie banner, and for alerts it is the unsubscribe link in any message we send you. Neither affects anything that happened before you withdrew.

To exercise any of these, write to index@hardyindex.com. If you are not satisfied with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. We would rather you came to us first, but you are not obliged to.

Automated decisions and children

We do not carry out automated decision making or profiling that produces legal or similarly significant effects. Nothing on this site scores, ranks or targets a reader: the scores here are about blockchains.

This site is written for a general adult audience and is not directed at children. We do not knowingly collect data about anyone under 13. If you believe we hold such data, write to us and we will delete it.

Security

The site itself is a set of static files served over HTTPS, and reading it stores nothing about you anywhere. The one place reader data exists is the alert list, and it is kept deliberately thin: an address, a watch choice and a send log, with no name, no password and no account attached to it.

That database is closed by default. Row level security is on with no public access rules, so an ordinary client key can read and write nothing at all, and the only key that can reach the data is held on the server and never sent to your browser. Correspondence sits in an ordinary email account protected by two-factor authentication.

Changes to this policy

If this policy changes in a way that affects what we collect or why, the date at the top of the page changes with it and, where the change is material, the cookie banner will ask you again. Every previous version of this site is public in its published record, so a quiet rewrite is not available to us.