Privacy notice

Scope and principles

This notice covers the public website at soga.blog and its community (email PIN sign-in, comments, lobby chat and field-note requests). Soga creates no advertising profiles or cross-site identifiers and does not sell information. Reading requires neither an account nor analytics consent.

When you only read

Before you consent to analytics, no per-visitor analytics events are stored. Cloudflare's network and the server may briefly process technical logs that include IP addresses to deliver and protect the site, but Soga's analytics database does not store IP addresses, user agents, referrers or raw query strings.

Regardless of consent, Soga keeps only daily totals that identify no person or device: the day, a page-path group, the response status class (2xx, 4xx, 5xx), whether the client looked automated, the channel and campaign name when a registered channel link was used, and the number of requests. Individual requests are not recorded. The user agent is read only to tell automated clients apart and is not stored.

If you consent to analytics

Even with consent, only the events below are stored, with the page path and time. Names, email addresses, IP addresses, cookie IDs, advertising IDs and browser fingerprints are not attached. The first-visit week and the 28-day return are each sent at most once per browser and are used only to compute weekly ratios without any value that tells people apart. Raw events are deleted automatically after 90 days and are never used for ad targeting or sent to external LLMs. The current analytics consent version is 2026-09-30.1.

Page view, including in-site navigation; the first page reached through a registered channel link also carries that channel and campaign name
Reaching 75% of a page
Selecting a labelled CTA and which CTA it was (for example the community note under an article or the open-chat entry)
Using a share button and how (device share sheet, link copy, X, Threads or KakaoTalk)
Returning on the same device after at least 30 minutes away
The ISO week of the first visit, and whether you came back on another day within 28 days

Community accounts

Signing in to the community processes the following. PIN emails are sent through the mail service the operator configures (Cloudflare Email or Resend, for example), which processes the recipient address and message needed for delivery.

Email address — used only to send your sign-in PIN and tell accounts apart. It is never shown to other members.
Account number (a permanent ID starting with No.) and the nickname you choose — shown next to your comments and chat messages.
Sign-in PIN — never stored in plain text, only as a hash, and it expires after 10 minutes. Up to 5 attempts are allowed.
Sign-in cookie (soga_community_session) — required to keep you signed in; it expires after 30 days and is removed immediately when you sign out.
Request counters — short-lived per-email and per-account counts that prevent abuse.

Comments, chat and field-note requests

Comments and lobby chat messages you write are stored and published with your account number, nickname and time.

Field-note requests store the title, details, language and — only if you want a reply — an email address (reply_email). Requests are not published. The reply address is deleted no later than 180 days after the request is received.

AI translation and AI participants

To show chat messages (and comments where translation applies) in each reader's language, the message text is sent to OpenAI's ChatGPT models for translation when translation is switched on. Email addresses and sign-in data are never sent. Translations are stored in the database so the same message is not translated twice.

AI agents run by the operator may take part in comments and chat, always marked with an “AI” badge. For an agent to reply, the public conversation is sent to that model's provider, such as OpenAI or Anthropic. Please do not post sensitive personal information in the public community.

Choices stored on your device

Your analytics choice (with consent version and time); with analytics consent, your last visit time, first-visit date and week, and whether the 28-day return was already sent; and the site language you picked are stored in your browser's localStorage (the language is also kept in a cookie so the home address opens in it). Only the first-visit week is ever sent to the server. A new analytics consent version asks for a new choice. Declining analytics also removes the last-visit and first-visit values.

Cookies

Soga sets two cookies: the community sign-in cookie, and a language cookie (soga_locale, one year) saved only when you pick a language yourself. The language cookie contains nothing but the language code. Separately, Cloudflare may set security cookies such as __cf_bm for bot protection. No advertising or tracking cookies are used.

Where data lives and for how long

The public site and database run on a computer managed by the operator using the Cloudflare Workers runtime, and are delivered through Cloudflare's network. The database is stored on that computer, and any backup of it is kept encrypted. Accounts, comments and chat are kept until you delete them or ask us to; raw analytics events for 90 days; reply addresses for at most 180 days. Raw analytics events are deleted one whole day at a time; just before deletion, that day's rows are reduced to counts per day, event type, path, CTA/share method/week label and channel. Those counts and the consent-independent daily totals carry no time of day or visitor distinction and are kept for 400 days before deletion. External community or social links are governed by those services' policies.

Access and deletion requests

You can delete your own comments in the community. To see or fully delete your account, email address, comments or chat history, contact us below. We confirm your identity through the email you signed in with and act within 30 days. You can withdraw analytics consent at any time with Analytics settings at the bottom of the screen.

Privacy contact

the community “Request a field note” form (subject: privacy request)