SirenPicks is a review publication, not a shop, and we collect as little as it is possible to collect. This page says exactly what is collected, why, for how long, and how to make us stop. It covers the EU/UK GDPR rights and the California CCPA/CPRA rights in the same place.
What data does SirenPicks collect about me?
At most three things: your email address if you subscribe to the newsletter, the details you type into a contact or brand-enquiry form, and — only if you explicitly allow it — aggregate analytics about which pages are read. There is no account system, we process no payments, we set no advertising cookies, and we do not sell or share reader data with advertisers, because there are no advertisers on this site. Analytics is off until you press Allow: the Google tag is not requested at all before that, so declining means nothing reaches Google — not even a cookieless ping.
- You can read the whole site with zero tracking. Decline the banner, or block cookies — the site works either way. That is why analytics is opt-in rather than opt-out.
- No ad cookies, no cross-site tracking, no data sales. There is not a single advertising tag on this site. The list of what is not for sale here is longer than the list of what is: a score, a ranking, a placement inside a roundup, a favourable verdict, or the removal of a measurement we published.
- The only thing stored in your browser by us is your own consent choice, kept in local storage for 180 days and clearable at any time.
- Your rights work everywhere, not just in the EU. Access, correction, deletion, portability, objection and withdrawal are honoured for every reader regardless of location.
The short version
- No analytics until you allow it. Google tags are not requested at all before you press "Allow analytics". Declining means zero data leaves your browser.
- No advertising, ever. No ad networks, no ad cookies, no remarketing, no cross-site tracking, no data sales.
- Emails only for what you asked for. A newsletter address is used to send the newsletter. A contact or enquiry message is used to reply.
- 18+. This site is intended for adults. We do not knowingly collect data from anyone under 18.
Who is responsible for your data
SirenPicks (the publisher of sirenpicks.com) is the data controller for the small amount of personal data described here. Privacy questions, access requests and deletion requests go through our contact page — mark the message "privacy request".
What we collect and why
| What | Why we have it | Lawful basis | Kept for |
|---|---|---|---|
| Newsletter email address | To send you new reviews. Nothing else, and no sharing. | Consent — you typed it in and submitted the form. | Until you unsubscribe, plus 30 days to process the removal. |
| Contact or brand-enquiry details (name, company, email, message) | To reply to you and, for brand enquiries, to run the partnership conversation. | Legitimate interest in answering the people who contact us, or consent where you asked for a reply. | Up to 24 months from the last message in the thread. |
| Aggregate analytics (pages viewed, referrer, approximate region, device class) | To see which tests are actually useful so we write more of them. | Consent — only after you press "Allow analytics". | Up to 14 months in Google Analytics, then expired. |
| Server logs at our host | Security, abuse prevention and keeping the site up. | Legitimate interest in operating a secure site. | Short-lived, per our hosting provider's standard retention. |
Cookies and local storage
| Name / type | Purpose | Set when | Retention |
|---|---|---|---|
| No cookie | The consent banner remembers your choice, stored in your browser's local storage — not a cookie, and not sent to us. | You click Allow or Decline. | 180 days, then we ask again. Clearable at any time. |
| Google Analytics (_ga, _ga_*) | Optional, aggregate measurement of which pages are read. IP is anonymised, Google Signals and ad-personalisation signals are disabled. | Only after you press "Allow analytics". | Up to 14 months, then expired. |
| Advertising cookies | None. This site runs no ad networks, no ad tags and no remarketing. | Never. | Not applicable. |
| Functional cookies | None beyond the local-storage entry above. Forms use no cookies. | Never. | Not applicable. |
If you have already accepted and want to change your mind, use the button below: it clears your stored choice and brings the banner back so you can decline. Declining is as easy as accepting, which is a legal requirement in the EU and UK, not a courtesy.
How long each thing we hold survives
The longest-lived item is an enquiry thread at 24 months and the shortest is a newsletter address, removed 30 days after you unsubscribe. Server logs are the one category with no bar: their retention is our host's to publish, and inventing a figure to complete the set is the failure this page exists to prevent.
Google Analytics and consent mode
When you allow analytics, we load Google Analytics 4 through Google Consent Mode v2 with ad storage, ad user data and ad personalisation permanently denied, and analytics storage granted only by your choice. IP anonymisation is on. Google acts as a processor for this measurement; see Google's privacy policy and how Google uses data from sites that use its services for their side of the arrangement. Because our implementation does not request the Google tag before consent, no data — and no cookieless ping — reaches Google if you decline.
Who else touches your data
- Supabase — stores newsletter addresses and enquiry messages for us, as a processor, under row-level security that prevents public reads.
- Cloudflare — serves this site and keeps the short-lived security logs described above.
- Google — only if you allow analytics, and only for aggregate measurement as described above.
We do not sell, rent or trade personal data. We do not share it with advertisers, and there are no advertisers on this site.
International transfers
Our processors may store data outside the EU/UK. Where that happens, transfer relies on the processor's standard contractual clauses and, for Google, the EU-US Data Privacy Framework. If you would rather no data left your region at all, decline analytics and contact us only when necessary.
Your rights
Depending on where you live, you may have some or all of the following, and we honour all of them for every reader regardless of location:
- Access — ask what we hold about you and get a copy.
- Correction — have inaccurate data fixed.
- Deletion — have your data erased, including a newsletter address.
- Objection and restriction — object to processing based on legitimate interest, or ask us to pause it.
- Portability — receive the data you gave us in a machine-readable format.
- Withdraw consent — at any time, including via the button above or the unsubscribe link in every email.
- No discrimination — exercising any of these rights will never change what you see on this site.
We answer verified requests within 30 days. You also have the right to complain to your local data-protection authority.
Our commitments on the awkward questions
- Do you track what I read across other sites? No. Analytics is first-party, aggregate and off until you allow it.
- Do you sell my email? No, and we never have.
- Can I read the site without any tracking at all? Yes. Decline the banner, or block cookies entirely — the site is fully functional either way. This matters in this category, and it is the reason analytics is opt-in rather than opt-out.
- Do you use dark patterns to make declining hard? No. Decline and Allow sit next to each other, at the same size, on the first layer. Declining takes one click and is not buried.
Changes to this policy
When this policy changes we update the date below and, for material changes, say what changed rather than quietly reissuing the page. Previous wording on material points is kept visible in the Trust Centre.
Last reviewed: September 2026.
Every field this site asks you for, and how many
The largest form on the site asks 6 required fields, and the smallest asks 1. Only required fields are counted; optional ones are choices rather than requests. The last row is not a count — there is no account, no profile and no checkout on this site, so there is nothing for it to count.