Privacy policy

Effective 2026-10-17. WorldRealDebt (worldrealdebt.com, the "site") is an independent project that visualises and explains public macroeconomic statistics. There are no accounts, and reading indicators such as government debt, household debt or GDP never requires personal details. This document sets out what the site processes and why, what it deliberately does not do, and what you can ask of us.

1. Who is responsible, and how to reach us

The data controller is the WorldRealDebt operating team. Send any privacy request to [email protected]. If you prefer a publicly traceable record you may use GitHub Issues (https://github.com/eightynine01/WorldRealDebt/issues), but requests that contain personal data are safer by email than in a public repository.

2. What we process, and for what purpose

2-1. Connection logs (server and CDN)

The site is delivered through the Cloudflare network. Request time, requested URL, IP address, browser user-agent string, referring page, response status and error logs are processed for security, incident response and abuse prevention. These logs are not used to identify individuals and are rotated once they are no longer needed for operations.

2-2. Community features (anonymous identity cookie)

Reactions, polls and predictions use an anonymous identity cookie named wrd_uid so that each visitor is counted once. It contains only a server-signed random identifier and is never linked to a name, an email address or any other real-world identity. It is issued with the httpOnly, Secure and SameSite=Lax attributes and expires after one year. Because the participation features cannot work without it, it is set without separate consent; deleting it in your browser simply issues a fresh identifier.

2-3. Guestbook and comments

When you post in the guestbook, the display name you enter, the text, the time of writing and the country page it belongs to are stored in our operational database and shown publicly. If you use the report function, the reported item and the time of the report are kept for moderation review. We advise against writing personal data in the body of a post; you can request deletion of your own posts under section 6.

2-4. Advertising (Google AdSense)

The site may display advertising through Google AdSense. Third-party vendors, including Google, use cookies (such as Google's advertising cookies) and web beacons to serve ads based on your prior visits to this and other websites. How Google uses advertising cookies is described in Google's advertising technologies notice, and its data handling in the Google Privacy Policy. You can opt out of personalised advertising in Google Ads Settings, and manage other vendors' personalised ads at aboutads.info or youronlinechoices.eu. Visitors in regions where consent is required, or who have not consented, may be shown non-personalised ads instead.

2-5. Analytics (Google Analytics)

We may use Google Analytics to improve the site. Page views, traffic sources, device and browser type, approximate location (country or city level) and events such as copying a widget are processed for statistical purposes. IP addresses are made non-identifiable during aggregation, and the resulting statistics are never used to follow an individual visitor. You can refuse analytics collection with the Google Analytics opt-out add-on.

2-6. Public API and embeddable widget

The public JSON API (for example /api/*/live.json) and the embeddable widget collect nothing beyond ordinary request logs. When a third-party site embeds the widget we record only the embedding page's domain (origin) and the date, for abuse prevention and usage statistics. We collect no information about that site's visitors.

2-7. Browser storage (not personal data)

Display preferences such as currency, language and country, and the record that you have acknowledged the cookie notice (wrd:cookie-consent:ack), live only in your browser's local storage and are never sent to our servers. Clearing browser data resets them.

3. What we do not do

The site has no registration or login and never asks for your name, email address, phone number or payment details. We do not sell personal data or pass it to third parties for their own advertising, and we collect neither financial information nor precise location. Values you enter in the calculator, such as household size, are computed inside your browser and never transmitted.

4. Legal basis

Connection logs and abuse prevention rest on our legitimate interest in running the site securely. The anonymous identity cookie is necessary to provide the participation features you request. Advertising and analytics cookies rely on your consent where applicable law requires it; in those regions only non-personalised ads are shown until consent is given.

5. Retention

Security and CDN logs are kept only for the short period needed for incident analysis and abuse handling, then rotated. Guestbook posts and community aggregates remain until you ask for deletion or they are hidden or removed under our moderation policy. The anonymous identity cookie expires one year after issue. Retention of data held by Google for advertising and analytics follows Google's own policies.

6. Your rights and how to exercise them

You may request access to, correction or deletion of information about you, restriction of processing, and withdrawal of consent. For requests that need verification, such as deleting a guestbook post, include the time of writing, the display name and the page URL and email [email protected]. We aim to respond within 30 days and will tell you first if verification needs longer. If you disagree with the outcome you may lodge a complaint with the data protection authority in your region.

7. Children

The site is not directed at children under 14 and does not knowingly collect their personal data. If we learn that a child has left personal data in the guestbook we delete it without delay.

8. International processing

Processors such as Cloudflare and Google operate data centres worldwide, so connection logs and advertising or analytics data may be processed outside your country of residence. Each processor protects that data under its own privacy commitments and standard contractual clauses.

9. Security

All traffic is encrypted with TLS. The anonymous identity cookie is server-signed to prevent forgery, and the operational database is not exposed to the internet. Our most important safeguard is collecting as little as possible: information a feature does not need is never requested in the first place.

10. Changes to this policy

When the categories of processing or the processors change, we update this document and the effective date above. The before-and-after wording is visible in the public repository's change history, and material changes are announced at the top of the site for a period of time.