Privacy Policy
Last updated: 2 September 2026
This policy explains what personal data One Field Theory collects, why, and what rights you have over it. It is written to be read, not to be waded through — the short version is that this site collects an email address if you choose to give one, uses a single strictly‑necessary cookie, and runs no analytics or advertising trackers of any kind.
Who is responsible for your data
The data controller is Gareth Davies, independent researcher, London, United Kingdom, operating this site as One Field Theory.
Contact for any privacy matter, including the rights listed below: gruff@gruffdavies.com.
What is collected, and why
Mailing list
If you subscribe to the mailing list, this site stores your email address, together with the dates you subscribed, confirmed, and (if applicable) unsubscribed, which of the two routes below verified your address, and the random tokens used to operate your confirmation and unsubscribe links.
The lawful basis is your consent. Subscription is double opt‑in: nobody is added to the list without following a confirmation link sent to their own address, or without an equivalent verified sign‑in that proves they control that address. You may withdraw consent at any time using the unsubscribe link in any email, with no need to contact anyone.
Accounts
If you register an account, this site stores your email address, your chosen username, and a cryptographic hash of your password produced with Argon2. Your password itself is never stored and cannot be recovered from the hash. The lawful basis is the performance of a contract — providing the account you asked for.
Signing in with Google
If you choose to sign in or subscribe using Google, Google provides this site with your email address and confirmation that Google has verified it. No password, no contacts, no profile data beyond that, and no access to any other Google service is requested or received. Your use of Google’s sign‑in is also governed by Google’s own privacy policy.
Server logs
The hosting infrastructure keeps ordinary web server logs, which include IP addresses and request details. These exist to keep the service running and secure, are not used to build any profile of you, and are not combined with the data above. The lawful basis is legitimate interest in operating a secure service.
Cookies
This site sets one cookie: a signed session cookie used to keep you signed in and to protect forms against cross‑site request forgery. It is strictly necessary for the site to function, which is why you are not being shown a cookie banner asking permission for it.
There is no Google Analytics, no advertising pixel, no social media tracker, no heatmap tool, and no third‑party analytics of any kind on this site.
Who your data is shared with
Your data is never sold, rented, or traded. It is shared only with the service providers strictly needed to run the site:
- the hosting provider, which runs the servers and database;
- the email delivery provider, which transmits confirmation and newsletter emails;
- Google, only if you choose to use Google sign‑in.
How long it is kept
- Mailing list: until you unsubscribe or ask for erasure. Sign‑ups that are never confirmed are deleted once the confirmation link has expired.
- Accounts: for as long as the account exists. Ask, and it is deleted.
- Server logs: a short rolling window, per the hosting provider’s standard retention.
Your rights
Under the UK GDPR you have the right to access your data, correct it, have it erased, restrict or object to its processing, receive a portable copy, and withdraw consent at any time. Exercising any of these costs nothing and will not be held against you.
Email gruff@gruffdavies.com and you will get a response within one month. If you are unhappy with the outcome, you may complain to the UK Information Commissioner’s Office at ico.org.uk.
Changes
If this policy changes materially, the date at the top will be updated, and anyone on the mailing list will be told by email rather than left to notice it.