What this site collects, and what it does not.

This site argues that institutions should be able to say who their data is about. It would be a poor showing not to answer that about itself. Everything below was read out of the code rather than adapted from a template, and where the honest answer is that something was collected without this page existing, it says so.

Controller: Mikal Steen Monslaup, Norway, independently. For anything on this page, write to contact@unformentoo.org.
Supervisory authority: Datatilsynet, Norway.
Last checked against the source code on 26 August 2026.

01Said plainly, first

Until this page existed, on 26 August 2026, the site was collecting email addresses for a newsletter and had no privacy notice anywhere. That was an oversight rather than a decision, it lasted as long as it did because nobody asked, and it is exactly the kind of thing this site would report about somebody else.

02Everything that is collected

One block per thing, with the lawful basis under the GDPR and how long it is kept. There is nothing else. If you find something collected that is not on this list, that is a fault and it will be corrected and published like any other.

Reading a page

What: Cloudflare Web Analytics records the page, a rough country, and referrer, in aggregate. It sets no cookie, does not fingerprint the browser, and cannot follow anyone to another site.
Why: To know whether any of this is read at all. Before it was added on 17 August 2026 the honest answer to that question was that nobody knew.
Basis: Article 6(1)(f), legitimate interests
Kept: Aggregate only. No row is ever about one person.

The visit, read and check counters

What: The page name and which of the three events happened. Nothing identifying leaves the browser. A Do Not Track header switches the whole thing off before anything is sent.
Why: To answer the site's own question: of the people who arrive, how many read to the end, and how many open a source.
Basis: Article 6(1)(f), legitimate interests
Kept: Stored as running totals per page. Individual events are not kept.

Stopping the tap counter being faked

What: A salted SHA-256 hash of the network address, with a hit count and an expiry time. The address itself is never written down, and for IPv6 the hash covers the whole prefix so rotating inside it mints no fresh allowance.
Why: A public number that anyone can inflate is worth nothing, and the site publishes that number.
Basis: Article 6(1)(f), legitimate interests
Kept: Each row carries its own expiry and is discarded when it passes.

The newsletter

What: The email address given, and the date it was given. Nothing else, and it is stored in a table that holds those two columns and no others.
Why: To write to people who asked to be written to.
Basis: Article 6(1)(a), consent. This is the one thing on this page where consent is the right basis, because withdrawing it should and does remove the data.
Kept: Until unsubscribed. Every mail carries a link that works without a login and cannot be used against anyone else's address.

Suggesting a source or reporting a wrong figure

What: Whatever is typed into the box: a link, a note, and which page it came from. If someone types their name or their email into the note, that is stored too, because the box cannot tell the difference.
Why: The site promises to correct what it gets wrong, and this is the way in.
Basis: Article 6(1)(f), legitimate interests
Kept: Kept, because a correction and its origin are part of the record. Ask and it will be removed.

Writing to contact@unformentoo.org

What: Whatever is in the message. The address routes through the domain provider to a personal mailbox.
Why: To answer.
Basis: Article 6(1)(f), legitimate interests
Kept: Kept as ordinary correspondence.

03The contributions register

The register at Contribute publishes who gave, how much, when, and what it paid for. It is the one place on this site where something about a person is published on purpose, so it gets its own section.

It is published under Article 6(1)(f), legitimate interests, and deliberately not under consent. Consent can be withdrawn at any time under Article 7(3), and a register whose entries can be withdrawn cannot do the job it exists to do, which is to let a reader check that no funder dominates this work. This was decided while the register was still empty, so that nobody's entry was ever the reason for the rule.

Organisations. Name, date, amount and purpose, published permanently and without qualification. GDPR Recital 14: the Regulation does not cover data about legal persons. An organisation's entry is not personal data and nothing about it is withdrawable.
Named individuals. The same fields. The transaction record, date, amount and what it paid for, is permanent. The name is the one field that can be removed on request. A row reading a date, an amount and a purpose identifies nobody, so the accounting survives an erasure request intact while the name does not. Publication rests on Article 6(1)(f) and, for the academic and journalistic purpose, on personopplysningsloven section 3.

Refusals are published as a category, a date and an amount, with the giver not named. Someone who offered money never agreed to appear anywhere, and naming them beside a reason about party politics would publish a political opinion, which is precisely what this site refuses to do to anyone.

04Who else touches it

Who	What they do	Where
Cloudflare	Serves the pages, runs the API, holds the database, and provides the analytics.	United States company, processing on its global network.
GitHub	Holds the repository and builds the site.	United States company, owned by Microsoft.
Domene	Registrar and DNS, and routes mail sent to the domain.	Norway.

Two of the three processors are United States companies. Nothing here is sold, and nothing is passed to anyone for advertising, because nothing on this site advertises anything.

05What you can require

Ask what is held about you, and get a copy.
Have anything wrong about you corrected.
Have it deleted, subject to the one exception set out in the contributions register.
Object to processing based on legitimate interests, under Article 21. If you object, the processing stops unless there is a compelling ground that overrides it, and if there is, you will be told what it is rather than simply refused.
Complain to Datatilsynet in Norway, without going through me first.

Write to contact@unformentoo.org. There is no form and no ticket number. A request will be answered within a month, and if it cannot be, you will be told why before the month is up rather than after.

unformentoo.org · independent research by Mikal Steen Monslaup, supported by Manderådet and MannsForum · this page generated 26 August 2026
If anything on this page is wrong about what the code actually does, write and it will be corrected and the correction published, dated.