Privacy policy

1. Controller

The controller under the GDPR and the revised Swiss FADP is the operator of brokaro.ch. We will add the name and postal address together with the legal notice; until then you can reach us for every data-protection matter at:

Email: info@brokaro.ch

2. Principle

We process as little personal data as possible. This site works without a user account, without third-party tracking cookies, without advertising networks and without loading a single script from someone else's server. Our audience measurement also runs on our own server and without a cookie — which is why you see no consent banner here. Section 4 explains why that is lawful.

3. Server and logs

This site runs on a server of its own (see section 10). Our web server keeps no access log: the pages you open are not recorded together with your IP address.

Your IP address is necessarily transmitted when you open a page and is processed briefly in memory, for example for the rate limit against automated access (sections 4, 7 and 8). Technical error messages of the server, such as failed connection attempts, may contain an IP address.

• Purpose: technical operation, security and error analysis
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation)
• Retention: error messages at most 14 days, then deleted automatically

4. Audience measurement — first-party and cookieless

We want to know which pages get read. So we run our own measurement: on a page view your browser sends one small record to our own endpoint /api/track. No third-party script is loaded, no cookie is set, and no identifier is placed on your device.

Exactly the following is stored — nothing more:

The visitor hash. So that ten page views by one person are not counted as ten visits, we need something to tell readers apart within a single day. We build it as a SHA-256 hash of a random daily salt, your IP address and your user-agent string, and store only the first 20 characters. The daily salt is 32 random bytes, generated fresh for each calendar day, and the previous day's salt is deleted. This limits the ability to reproduce past identifiers. It does not by itself rule out linkability using additional information.

What is not stored: no IP address, no user-agent string, no cookie, no fingerprint, no cross-site identifier, no dwell time, no mouse or scroll movement, and no search terms. IP address and user agent are used transiently in memory only — to compute the hash, to rate-limit automated requests, and for a simple filter that drops known crawlers — and are then discarded.

• Purpose: audience measurement as a basis for editorial decisions
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data-minimal audience measurement). A daily hash can connect visits within a day and is conservatively treated as pseudonymous data; hashing alone does not guarantee anonymity.
• Recipients: none. The rows sit in our own database; they are not shared, not combined with other sources and not sold.
• Retention: the stored rows are currently not deleted automatically. In the file-based variant of the store, only the most recent 50,000 rows are kept.

Objection (opt-out). Two ways, both effective immediately and without an account:

1. 1Turn on "Do Not Track" in your browser. The measurement reads that setting in your browser (navigator.doNotTrack) and then sends nothing in the first place — no record is created that we would have to discard. We do not evaluate the DNT: 1 HTTP header server-side; mainstream browsers set both together, and where they diverge the browser setting decides. Many sites ignore this signal — we do not.
2. 2Set the switch on the privacy settings page. It stores the value bp-no-analytics in your browser; while it is set, nothing is sent.

Why there is no cookie banner for this. Consent is required under Art. 5(3) of the ePrivacy Directive — in Germany § 25 TDDDG, formerly TTDSG — when information is stored on your device or read from it that is not strictly necessary for the service you asked for. This measurement does neither: it sets no cookie and places no identifier. The only thing read is the opt-out key you set yourself — precisely the value with which you objected, and reading it is necessary to honour your wish. A banner asking for permission nobody needs would only teach you to click "accept" without reading.

That is a statement about today, not a permanent guarantee: the moment we embedded a third-party tool — Google Analytics, a Meta pixel, an ad network or a hosted analytics script — the assessment would change. Such tools set identifiers and pass data to third parties; they need consent before they load. We would update this policy first and actually collect that consent.

5. Local browser storage

We use localStorage and two cookies for purely functional purposes:

The four local-storage values never leave your device — they are not sent to the server. The bp-locale and bp-country cookies are sent with every request because language routing and the country selection are decided on the server; they contain nothing but a language or country code and are not used to recognise you. When you follow a broker link, the chosen country code is stored with the click, because partner agreements apply per country (see the section on the redirect). None of these values is used for profiling or for tracking across websites. As these are strictly necessary or user-initiated functions, no consent is required.

You can inspect all six entries, and clear them with one click, on the privacy settings page.

6. Partner link click measurement

When you click a partner link, an internal redirect (/go/...) forwards you to the broker. We log the broker clicked, where on the site the link sat, the language version, the country code (if the hosting platform supplies it or you select it), and only the hostname of the referring website. URL paths, query parameters and user-agent strings are not retained.

• Purpose: measuring reach and reconciling partner programme payouts
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reach measurement)
• No personal profile: we do not store an IP address for this purpose and build no user profile. Click counts do not prove registration or a commission entitlement; confirmed partner statements are authoritative for that purpose.
• Retention: clicks are not currently deleted automatically. In the file-based variant of the store, only the most recent 20,000 clicks are kept.

We append utm_source=brokaro, utm_medium=referral and utm_campaign with the placement to the destination URL, unless the link already carries its own parameters. Those parameters say nothing about you. Approved affiliate links are preserved unchanged so signed or required tracking parameters remain valid.

The broker you are forwarded to is independently responsible for its own processing and usually sets its own cookies. Please read its privacy policy.

7. Newsletter

If you subscribe, we store your email address, the language version, the sign-up source (e.g. the site footer), the timestamp, a random token, and the confirmation and unsubscribe status. We do not store your IP address; it is used transiently for rate limiting only.

• Legal basis: Art. 6(1)(a) GDPR (consent)
• Process — genuine double opt-in: the address is stored unconfirmed first. You receive a single email with a confirmation link carrying a random token. Only when you open that link does the subscription take effect. Without confirmation you receive no newsletter — after the confirmation email, nothing further goes out to an unconfirmed address.
• The token: a random string that exists only in the email, is never shown on a page, and later also powers one-click unsubscribe.
• Unsubscribing: every email carries an unsubscribe link plus the List-Unsubscribe and List-Unsubscribe-Post headers per RFC 8058. Your mail client can therefore remove you with a single click — no confirmation step, no login. Withdrawal takes effect for the future.
• After unsubscribing: the record is kept with the time of the unsubscribe so the address is not accidentally mailed again. On request we delete it entirely.
• Sending: emails go out over the operator's own SMTP server or SMTP service. No third-party newsletter tool that measures opens or clicks is involved. Mail is sent through the mailbox info@brokaro.ch at METANET AG, Josefstrasse 218, 8005 Zurich, Switzerland.

8. Contact form

Messages from the contact form are stored and additionally emailed to the operator's inbox — stored because a message must not be lost to a mail outage.

• What is stored: the topic you chose (data error, partnership, press, general), your name, your email address, the subject, the message text (including the broker and page URL if you supplied them), the language version, the timestamp, and a note of whether the notification email could be delivered.
• What is not stored: your IP address. It is used transiently for rate limiting only.
• Sending: the notification goes to the operator's inbox with your address as the reply-to. You receive an acknowledgement at the address you gave. If no SMTP access is configured, the message is stored only and flagged internally as undelivered — we do not pretend an email went out.
• Legal basis: Art. 6(1)(a) GDPR (your explicit, not pre-ticked consent when submitting) and Art. 6(1)(f) GDPR (legitimate interest in answering you).
• Use: solely to handle your request. Your address is not added to the newsletter and not shared.
• Retention: until your request is settled and no retention obligation stands in the way. No automatic deletion period is configured technically. On request we delete a message at any time.

9. User reviews

When you submit a review we process the name you provide, optionally your country, your rating and your text.

• Legal basis: Art. 6(1)(a) GDPR (consent through submission)
• Publication: after moderation, under the name you provided
• Note: use a pseudonym if you do not wish to be identifiable. Never include account numbers or other sensitive data in a review.
• Deletion: on request, at any time

10. Hosting

The website runs on a server we rent from netcup GmbH, Emmy-Noether-Strasse 10, 76131 Karlsruhe, Germany; the server is located in a data centre in Nuremberg. We operate the server and its software ourselves. Email to and from info@brokaro.ch is handled by METANET AG, Josefstrasse 218, 8005 Zurich, Switzerland.

Your data is therefore processed in Germany and Switzerland. It is not transferred to any country outside the EU, the EEA and Switzerland.

11. Fonts

Fonts are served from our own server. No connection is made to Google Fonts or any other external font service.

12. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You may withdraw consent at any time with future effect.

One honest note about audience measurement: from what we store we cannot attribute those rows to a person — we keep neither your IP address nor your user-agent string, and yesterday's daily salt is deleted. Access or targeted deletion would require additional information from you that makes attribution possible; if you can supply it, we will act on your request. We are expressly not claiming those rows are anonymous — section 4 treats them conservatively as pseudonymous data. Independently of that, the objection described in section 4 takes effect immediately and prevents future records.

You also have the right to complain to a supervisory authority.

13. Changes

We update this policy when our processing changes. The version published here is authoritative.