Policy

Privacy

What we collect when you read, subscribe or sign in, and who else sees it. Last updated November 2, 2026.

Reading the site

You don't need an account to read anything, and unless you sign in we don't know who you are.

Our host. The site runs on Cloudflare, which handles every request. Like any web host, it sees your IP address and browser to deliver pages and protect the site from attacks.
Google Analytics. We use it to count visits and see which stories people read. It sets cookies in your browser, and Google receives your IP address and details about your browser and device. Google's opt-out add-on or your browser's cookie settings can turn it off.
Where you came from. If you followed a link with campaign tags in it (the utm_ part of an address, which we add to our own posts and ads), your browser keeps them for 30 days so we know which post or ad brought you. They're saved with a newsletter signup.
Maps. Story maps draw their streets from OpenStreetMap, so your browser fetches map pieces from OpenStreetMap's servers, which see your IP address. County aerial photos come through our own server instead.

The newsletter

To subscribe we need only your email address. We send a link to confirm it, and nothing more until you do. We also record when you signed up, the page you signed up on, and any campaign tags from above.

Emails are delivered by SendGrid. We switch off its open and click tracking, so we don't know whether you opened an email or which links you followed.

Every email has an unsubscribe link. When you unsubscribe we keep your address marked as unsubscribed, so it isn't emailed again. If you'd rather we delete it entirely, email us.

We never sell or share your email address.

A free account

An account lets you save stories, keep crossword results and see what's new since your last visit. It holds:

your email address, and a display name if you choose one;
the stories you save and the crosswords you finish;
when you last visited, so we can mark stories published since;
when you signed in on each device, and which browser it was.

You sign in with a link or code we email you; there's no password. To stop abuse, we count sign-in requests per email address and per IP address, and delete those counts within two days.

On your account page you can download everything the account holds, or delete it. Deleting the account doesn't change your newsletter subscription; unsubscribe separately if you want that too.

Cookies and browser storage

ss_session: keeps you signed in, for up to 90 days. Only set if you sign in.
ss_in: tells our pages you're signed in, so they show "Your account". Same lifetime.
ss_pending: holds a sign-in in progress, for 10 minutes.
Google Analytics cookies (named _ga and similar).
In your browser's own storage, not cookies: the campaign tags described above (30 days), and your progress on a crossword, so you can come back to it.

Questions and requests

To ask what we hold about you, or to have it deleted, email news@thesurprisestandard.com. If we change what we collect, we'll update this page and the date at the top.