Privacy Policy

The short version

• We run no advertising and no tracking scripts, and we never sell or rent data. We count visits with Cloudflare Web Analytics, which sets no cookies and does not identify you.
• We do not store your email address. We store only a one-way scrambled version of it, used to count unique participants.
• If you send the letter with Gmail, Google gives us a short-lived access token. We use it for that one send and do not store it.
• We never read, list or delete anything in your mailbox.

Who we are

NoToLana.com is run by an independent citizen campaign. It is not affiliated with any government, political party or the United Nations. Our contact address is contact@notolana.com.

Who handles your data

• Cloudflare hosts the website, which is a static site. Like any web host, it sees your IP address and browser details when your browser asks for a page. It also runs Cloudflare Web Analytics, described below.
• Google Firebase and Google Cloud run the sending service (Cloud Functions in the europe-west1 region) and the database (Firestore). We use the same Google Cloud project as our sister campaign, stoprsfterror.com, with separate records for each campaign.
• Google also supplies the sign-in window (Google Identity Services), the bot protection described below, and the fonts used on this site (Google Fonts). Google receives your IP address when your browser loads them.

Reading the site

Just reading the site needs no account and no consent. We count visits with Cloudflare Web Analytics, a small script that sets no cookies, stores nothing in your browser and does not follow you across sites. It gives us totals only: page views, the site that sent you, browser and device type, country, and how fast the page loaded. It does not tell us who you are. To suggest your country in the send window, Cloudflare tells the page which country your connection comes from, based on your IP address; we do not store it. Shortly after the page opens, your browser connects to Firebase to show the live counter of letters sent, and bot protection starts (see below).

Sending the letter with Gmail

When you press the Gmail button and agree on Google’s screen, this is what happens:

• Google asks you to allow two things: gmail.send, which lets us send email from your account, and userinfo.email, which tells us which address you are signing in with.
• Your browser passes the short-lived access token to our sending service over an encrypted connection. The service uses it to send the letter and to look up your email address once, for the participant count described below. The token is not written to our database or our logs, and it stays in your browser’s memory, not in storage.
• The service sends one message per recipient, only after you press Send. The text of the letter is fixed. The only thing you can add is your name, which is placed in the letter. The messages appear in your Gmail Sent folder, and the recipients see your Gmail address as the sender.
• When the whole send has finished, the service sends one more message, from your account to your own address: a short summary of how many recipients your letter reached. Your address is used for that in memory and is not stored.
• We never read, list, search or delete your emails. We have no access to your contacts, your drafts or anything else in your Google account.

You can withdraw access at any time at myaccount.google.com/permissions. Withdrawing access does not recall letters that were already sent.

What we store

We store only what is needed to run the campaign. None of these records contains your email address, your name, the access token or the text of your letter.

• A record for each send. A random request ID, the country you chose, the internal IDs of the recipients, whether each message was sent or failed and why, the totals, and timestamps. We use it to show you live progress, to resume a send that was interrupted, and to avoid emailing the same person twice.
• A participant record. We turn your email address into a keyed one-way hash (HMAC-SHA256) with a secret key that is not stored in the database. The record holds that hash, how many letters were sent with it, and the first and last time it was used. It lets us count unique participants without keeping addresses. Because the same address always produces the same value, we still treat it as personal data. The same key is used by our sister campaign, which keeps its own records.
• Public counters. The total number of letters, the number of participants, and totals per country and per day. These are shown on the site and are not linked to any person.
• Step counters. For each day, how many visits reach each step of the send dialog, counted again separately for pages opened inside an app’s built-in browser (such as Instagram’s). They help us find where sending fails. They are plain totals, not linked to any person or visit.
• Service logs. Our sending service logs the request ID, the country, counts, error types and the kind of browser used (for example Chrome, or an app’s built-in browser). It does not log email addresses, names or tokens. Cloudflare and Google Cloud also keep their own technical logs, such as IP addresses, under their own policies.

We keep these records while the campaign runs, because they are needed to resume interrupted sends and to keep the public totals correct.

Bot protection

To stop automated abuse, the sending service accepts requests only from genuine visits to this site, checked with Firebase App Check and Google reCAPTCHA Enterprise. reCAPTCHA looks at signals such as your IP address, browser and device details and how you interact with the page, and Google processes them under its own Privacy Policy and Terms of Service.

Cookies and local storage

The code we wrote sets no cookies. When you start a send, it remembers that send in this browser’s local storage (the request ID, the country, the recipients’ internal IDs and the name you signed with, if any; no email address) for up to three days, so you can close the page and see the result or continue later. It is removed once the send has finished. The Google and Firebase components that run on the page also store data, only for security and basic operation:

• Firebase App Check keeps its token in your browser’s IndexedDB, and Firebase keeps a small record there of which of its features were used. Both help the service run and are not used to identify you.
• Google reCAPTCHA saves an identifier called _grecaptcha in this site’s local storage and sets a cookie called _GRECAPTCHA on Google’s own domain, to tell visitors from bots.
• The Google sign-in window may set its own cookies on Google’s domains.

You can clear all of this in your browser settings at any time. We use none of it for advertising or tracking.

The recipients

The letter goes to public officials: the Permanent Missions to the United Nations, taken from the UN’s public list, and members of parliament and other officials, taken from public sources. We use these addresses only to send the letter. If you are on the list and think your details are wrong, write to us and we will look at it.

Google API Services User Data Policy

NoToLana.com’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms: we use Google user data only to send the letter you ask us to send and to count participants. We do not transfer it to others, use it for advertising, or let people read it.

Your rights

You can ask us what we hold about you, or ask us to delete it. Our records hold a hash, not your address, so to find yours we need you to write from the email address you used. We can then look up and delete your participant record. Send records are not linked to your hash, and the public totals are plain counts, so neither can be traced back to you. If you are in the EU or UK, you may also complain to your local data protection authority.

Children

This site is not directed at anyone under 16, and we do not knowingly collect data from children.

Changes to this policy

If we change how the site handles data, we will update this page and the date at the top. Please check it from time to time.

Contact

Questions about this policy or requests about your data: contact@notolana.com.