Privacy

Who runs this site?

Flight Risk Capital, an independent publication.

What does the site collect?

The contact form collects the details described below. The analytics counter collects daily totals only. Page and event counts are daily totals with no IP address, visitor ID, cookie or browser storage. The site respects Global Privacy Control: browsers sending it are not counted.

Our first-party counter stores daily page and event totals in Cloudflare D1. Page paths exclude queries and fragments. Allowed properties describe pages, tools, games, tracker filters, public tracker entries, link categories, share channels and salary or result bands. Exact salaries, user agents and free text are not sent. These totals do not track individual visitors.

Calculator inputs and results stay in page memory while you use the page. Tax Receipt and Where would you be richest? share links carry a salary in the URL only if you tick “Show exact figure” before copying. Anyone receiving that link, or serving the requested page, can read the salary in its URL. Analytics discard query strings. Without that tick, copied links carry no salary.

Hosting

Cloudflare hosts the site and processes IP addresses and request logs as part of serving pages. Read Cloudflare's privacy policy for how it handles this data.

Contact form

We collect your reason for writing, your message, the page or tracker entry you give, an optional reply email and the submission date. The publisher uses these details only to deal with your message. Our lawful basis is legitimate interests in answering messages, checking corrections and handling a right of reply.

Cloudflare hosts the form and its D1 database. Resend delivers messages by email when delivery is enabled and Google provides the mailbox. These services act as processors for contact messages.

We keep contact messages in the database and mailbox for only as long as needed, for up to 12 months. To limit spam, we use a salted hash of your IP address within an hourly window. A hash is a one-way code; we never store the raw IP address in the contact database. We delete rate-limit hashes and their salts after 24 hours.

Use the contact form to ask for deletion. Give enough information to find your earlier message and include a reply email if you want a reply.

Our lawful basis for sending the Flight Risk Capital monthly email is consent. The sign-up form sends your email address straight to Buttondown, our newsletter processor. This site does not store newsletter sign-ups. Read Buttondown's privacy policy.

Buttondown stores your email address and confirmation date for the newsletter. It uses double opt-in: you must follow the link in its confirmation email before you are subscribed. Every newsletter email includes an unsubscribe link, so you can withdraw consent at any time.

To ask for deletion of your newsletter data, use the contact form.

Public reporting

We keep and publish records about named public figures, including their public roles, reported moves, dates, sources and relevant public statements. Publicly available information about a living person is still personal data. Our lawful basis is legitimate interests in public-interest reporting, balanced against the person's rights and the possible harm. We publish only what is needed to explain a sourced report.

We retain tracker records and supporting evidence while they remain relevant to the reporting archive, reviewing them at least annually. We correct errors and remove details that are no longer needed; the archive has no fixed deletion date. Correction correspondence is kept for no more than 12 months. Anonymous daily counts may be retained indefinitely. Hosting logs follow Cloudflare's retention rules.

The journalism exemption is not automatic. It can limit particular UK GDPR duties only where we reasonably believe publication is in the public interest and complying with that duty would be incompatible with journalism. We assess this for each case; security and accountability duties remain. See the ICO guidance on exemptions, checked 25 October 2026.

Anyone named can ask for correction, removal or a right of reply through the contact form. We assess the evidence and the public interest rather than assuming that every request requires deletion.

Your rights

Under UK GDPR, you can ask for access to your personal data, correction, deletion, restriction of use or object to use based on legitimate interests. Data portability applies where its legal conditions are met. Rights can have limits, including for journalism. Send a data request through the contact form. We may need enough information to identify the data and check the request.

You can object to our use of your personal data where we rely on legitimate interests. Use the contact form to tell us what you object to.

You can complain to the Information Commissioner's Office.