What we collect,
why, and your rights.

1. Data controller

The data controller responsible for personal data processed through thesatoshiarchive.com is Marek Safarik (The Satoshi Archive, Czech Republic). For any privacy-related request, contact info@thesatoshiarchive.com.

2. What we collect and why

Email address (waitlist) — when you submit the waitlist form, your email is sent to our email service provider MailerLite so we can notify you when Season 2 launches or send occasional updates. Legal basis: consent (GDPR Art. 6(1)(a)). Withdraw any time via the unsubscribe link in any email.

Analytics (Plausible) — we use self-hosted Plausible Analytics to understand which pages visitors read. Plausible is cookieless and does not track individuals — only aggregate page-level counts. No personal data leaves the EU. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) in understanding site usage.

Marketing pixels (opt-in only) — if you give consent via our cookie banner, we load marketing pixels from Meta (Facebook/Instagram), X (Twitter), and LinkedIn. These may set cookies and share browsing data with those platforms so we can measure advertising effectiveness and build retargeting audiences. Legal basis: consent (GDPR Art. 6(1)(a)). Withdraw consent anytime via the "Cookie preferences" link in the footer.

Bot and fraud prevention (future) — when registration or game features launch, we will use Fingerprint.com to detect automated bots and prevent duplicate accounts. Fingerprint is only called on registration and authentication endpoints — never on archive pages. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) in protecting account integrity.

Server and request logs — our hosting provider Cloudflare automatically processes technical data (IP address, user agent, timestamp, referrer) for security, abuse prevention, and basic operational analytics. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) in keeping the site online and secure.

3. Cookies & consent

This site uses a consent banner to give you control over what gets loaded. Cookies and similar technologies fall into two categories:

• Essential — strictly necessary to operate the site. Includes the banner's own consent state (stored locally in your browser), the MailerLite waitlist form, and Plausible (cookieless, aggregate only). These cannot be disabled.
• Marketing — Meta Pixel, X Pixel, and LinkedIn Insight Tag. Off by default; loaded only if you explicitly opt in.

You can change your choice at any time via the Cookie preferences link in the footer.

4. Third-party services

When you interact with embedded content, click an outbound link, or opt into marketing cookies, the respective third party processes data under its own privacy policy:

• YouTube — episode and interview videos are embedded via youtube-nocookie.com, which only sets cookies if you actually press play. Google privacy policy.
• MailerLite — waitlist email storage. Their policy.
• Plausible Analytics (self-hosted on our infrastructure) — cookieless site analytics. About Plausible.
• Meta Platforms (Facebook/Instagram) — marketing pixel, opt-in only. Meta privacy policy.
• X (Twitter) — marketing pixel, opt-in only. X privacy policy.
• LinkedIn — Insight Tag, opt-in only. LinkedIn privacy policy.
• Fingerprint.com (future) — bot / fraud detection on registration endpoints. Their policy.
• mempool.space — live Bitcoin block height on the homepage. Their policy.
• Cloudflare — hosting, TLS, DDoS protection. Their policy.
• Patreon · Geyser.fund · Trezor · Peach Bitcoin · Firefish · Nodl · Guardians of Blockchain · Liberation.Travel · Wallet of Satoshi · The Bitcoin Way · BTC Prague — outbound links (support and affiliate). We may receive a commission if you sign up through an affiliate link. See each provider's privacy policy for how they handle data.

5. Data retention

How long we (or our processors) keep your data:

• Waitlist emails (MailerLite) — until you unsubscribe or request deletion.
• Plausible aggregate stats — 24 months rolling.
• Meta pixel data — up to 180 days (Meta default).
• X pixel data — per X retention policy.
• LinkedIn Insight data — up to 180 days.
• Fingerprint identifications (future) — up to 30 days (Free tier).
• Cloudflare server logs — ~7 days rolling window.

We do not maintain a separate analytics database beyond what these providers expose.

6. Your rights under GDPR

Regardless of where you are, if GDPR applies to you, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data ("right to be forgotten").
• Restriction — ask us to stop processing your data while a dispute is resolved.
• Portability — receive your data in a machine-readable format.
• Object — object to processing based on legitimate interest.
• Withdraw consent — revoke consent you previously gave.

To exercise any of these rights, email info@thesatoshiarchive.com. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. In the Czech Republic that is the Úřad pro ochranu osobních údajů (ÚOOÚ).

7. Security

The site is served exclusively over HTTPS with HSTS preload. We use Content-Security-Policy, X-Frame-Options, and other security headers to reduce attack surface. Waitlist data is transmitted directly to MailerLite's servers using their standard encrypted API.

8. Children

The archive is intended for adults. We do not knowingly collect personal data from anyone under 16. If you believe a child has submitted data, please contact us and we will delete it.

9. Changes to this policy

We may update this policy to reflect operational changes. The revision date at the top of this page indicates the last change. Material changes will be announced on the homepage.

10. Contact

Questions, requests, or complaints: info@thesatoshiarchive.com.