Privacy & cookie policy
Last updated: 22 August 2026
This policy explains how The Fish Site (thefishsite.com) handles your personal data and uses cookies. It is written to comply with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act.
1. Who is responsible for your data
The data controller is Emma Barbier, sole trader trading as Ocean Desk, 1 rue de la Porte Goliva, 51140 Pévy, France (SIREN 944 288 158). For any privacy question or to exercise your rights, contact [email protected]. Full publishing details are in our legal notice.
2. What we collect and why
| Data | When | Legal basis |
|---|---|---|
| Account data (email, first/last name, hashed password, preferences) | When you create a reader account | Performance of a contract |
| Social-login profile data (verified email address, first and last name) received from Google or LinkedIn | Only if you choose "Continue with Google" or "Continue with LinkedIn" | Performance of a contract (creating and signing you into your account) |
| Email address | When you subscribe to a newsletter | Consent |
| Comment content & name | When you comment on an article | Consent / legitimate interest |
| Free-article count (a cookie listing articles read) | When you read articles without an account | Legitimate interest (metered access) |
| Technical data (IP address, user-agent, pages viewed) | Automatically, in server logs | Legitimate interest (security, abuse prevention) |
| Analytics data (pseudonymous usage statistics) | Automatically, on every page you view | See the note below |
| Saved reading list, and reading history linked to your account | When you save an article, or open one while signed in | Legitimate interest |
We do not collect special-category data and this site is not intended for children. The "recently viewed" list is stored only in your browser (localStorage) and is never sent to us. Two things are different if you are signed in to a reader account: articles you save to your reading list are stored on our servers, so that your list follows you from one device to another; and, if enabled, we record which articles you open and when — at most one entry per article per day. Both are deleted when you delete your account, and reading history is deleted after 180 days in any case.
3. Signing in with Google or LinkedIn
Creating an account with a password is always possible. As an alternative you may sign in with Google or LinkedIn. If you choose to, here is exactly what happens.
- You are redirected to Google or LinkedIn, where you authenticate. Your password for that provider is never seen by, or sent to, The Fish Site.
- After you approve the request, the provider sends us only the data covered by the
openidcode,emailcode andprofilecode scopes: your verified email address and your first and last name. We request nothing else — no contact list, no posts, no connections, and we cannot act on your behalf on those platforms. - Why: to create your reader account, or to sign you into the existing account matching that email address, and nothing more.
- Accounts created this way have no password stored on our side. We record which provider you used so we can show you the right sign-in option later.
- Being redirected necessarily discloses to Google or LinkedIn that you are signing in to The Fish Site. Their own handling of that is governed by their privacy policies: Google and LinkedIn.
- You can stop using social sign-in at any time and set a password instead, or ask us to delete the account entirely (see “Your rights” below).
4. Cookies and similar technologies
A banner lets you record a cookie preference, stored in your browser. Essential cookies are always active because the site cannot function without them. Please note: analytics currently load on every page, before and regardless of that choice. We are working on making the preference take effect; until it does, the banner records your choice but does not yet control analytics. To prevent analytics entirely today, use your browser's tracking protection or an ad-blocker.
Essential (always active)
tfs_readercode — keeps you signed in (authentication).tfs_metercode — counts your free articles for the metered paywall.cookieConsentcode — remembers your cookie choice.- Theme / display preference.
Analytics
- Google Analytics 4 (
_gacode,_ga_*code) — measures audience and how the site is used, in pseudonymous form. Set on every page view. Google's advertising features are switched off: we send no data to Google Signals and no advertising personalisation, so this measurement is not used to build an advertising profile of you.
Embedded third-party content
Some articles embed YouTube, Vimeo, X (Twitter), Flourish, Datawrapper, Infogram or SoundCloud. These providers may set their own cookies when their content loads; they are governed by the providers' own policies.
5. Search-engine & webmaster tools
To monitor and improve how the site appears in search, we use webmaster tools: Google Search Console, Bing Webmaster Tools and Yandex Webmaster. These verify site ownership and give us aggregated search-performance statistics (queries, impressions, clicks). They do not set advertising or tracking cookies on visitors through this site.
6. Who we share data with (processors)
We only share data with service providers acting on our instructions:
- OVH (France) — website & database hosting.
- Cloudflare — image storage (R2 object storage).
- Brevo — sending newsletters and account emails.
- Google and LinkedIn — only if you use social sign-in (see section 3). They act as independent controllers for the authentication itself; we receive your verified email address and name.
- Google — analytics (on every page view, see section 4) and Search Console.
Some providers may process data outside the European Economic Area. Where they do, the transfer is covered by an adequacy decision or the European Commission's Standard Contractual Clauses. (Note: the EU–US "Privacy Shield" is no longer valid and is not relied upon.)
7. How long we keep your data
- Account data: while your account is active; deleted on request or after prolonged inactivity.
- Newsletter: until you unsubscribe.
- Server logs: a limited period for security, then deleted or anonymised.
- Analytics: per the retention window configured in the analytics tool.
- Reading history: 180 days. Saved reading list: until you remove the item or delete your account.
8. Your rights
Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest or for direct marketing. You can withdraw consent at any time (this does not affect prior processing). To exercise any right, email [email protected]. We aim to respond within one month. You may also lodge a complaint with the CNIL (cnil.fr).
9. Data security
We use appropriate technical and organisational measures: HTTPS/TLS everywhere, hashed passwords (Argon2), a strict content-security policy, and restricted access to personal data. No method of transmission is perfectly secure, but we work to protect your data and will notify you and the CNIL of a breach where legally required.
10. Changes
We may update this policy; the "last updated" date above reflects the latest version. Material changes will be signposted on the site.