Privacy policy

This is a translation of the Hebrew original. Where the two differ, the Hebrew version applies.

This policy explains what information is collected when you browse the Liba website ("the site"), why, for how long, and what your rights are. It is written in plain language and describes how the site is actually built. The rules for using the site are in the terms of use.

In short

There are no trackers on the site, and the ads don't follow you. We only see general counts, such as how many times each page was read, without identifying anyone.
Subscribers: we keep your email address and your subscription status. Payment happens at Paddle, and your card details never reach us.
One cookie is stored only after you sign in to a subscriber account, to remember that you signed in. If you don't sign in, you get no cookies.
Every file loads from the site itself. There are no third-party scripts, fonts or images.
The site is hosted on Cloudflare. Like any host, Cloudflare receives your IP address to deliver the site to you and protect it from attacks. We don't receive or store IP addresses.
The connection to the site is always encrypted (HTTPS).

Who is responsible for your data

The site is run by [name of the site owner or company, and business number] ("we"). For any question about privacy, write to us at dudu240315@gmail.com.

What we collect

Technical information your browser sends

As on any website, on every visit your browser sends the server some technical information: an IP address, the browser type and operating system, the page requested and the time of the request. This is how it is used:

IP address: our hosting provider, Cloudflare, uses it to deliver the site to you and to block heavy load and attacks. We don't receive it and don't store it.
Page views: in the Cloudflare dashboard we see general totals, such as the number of visits to each page each day, and which countries they came from. That is all the analytics on the site: no measuring tools in the browser and no cookies, and there is no way to know who viewed a page.

We don't keep any of the other technical details.

Information you send us

If you email us, we get your email address and the content of your message, and use them only to answer you.

Subscriber information

When you sign in or subscribe, we keep only what is needed to give you access:

Email address: the sign-in link is sent to it, and it is how we know you are a subscriber.
Subscription status: active, canceled and so on, and your Paddle customer and subscription numbers, to open the subscription management page for you.

Payment is handled by Paddle, which sells the subscription on our behalf (Merchant of Record). Paddle collects payment details, name and country under its own privacy policy. Your card details never reach us.

What we don't collect

The ads on the site are an image and a link stored on our own server: they carry no advertiser script, cookie or tracking, and the advertiser doesn't know who saw them. If you click an ad, you go to the advertiser's site, and its privacy policy applies there.

There are no passwords, social media pixels or advertising profiles on the site. If you haven't signed in to a subscriber account, you stay anonymous: we don't know who you are, and we don't try to find out.

Cookies and browser storage

If you haven't signed in to a subscriber account, we don't give you any cookies.

After you sign in, your browser keeps one cookie named __Host-liba-session. It holds your email address and an expiry time, is signed so it can't be forged, and lasts 30 days or until you sign out. It is needed so the site remembers that you signed in, and isn't used for tracking or advertising.

On your first visit a short notice says so. When you click "Got it", the browser saves one marker in Local Storage named liba-cookie-notice, so the notice doesn't appear again. The marker stays on your device: it isn't sent to the server, doesn't identify you, and you can delete it any time from your browser settings. This storage is needed only for the notice to work, so it doesn't require consent.

Why we use the information

To show you the site and keep it available.
To know which pages are read, as a general count only.
To detect and block unusual load, scans and attacks.
To give subscribers access to the full reviews and email them a sign-in link.
To answer messages you send us.

For visitors from the European Union and the United Kingdom, the legal basis for processing is performing our agreement with you, for subscribers (GDPR Article 6(1)(b)), and our legitimate interest in running and securing the site and answering messages (Article 6(1)(f)).

How long we keep it

IP addresses and technical logs: we don't keep them. Cloudflare keeps them under its privacy policy.
General page-view counts: for as long as the Cloudflare dashboard keeps them. They hold no information about people.
Subscriber record (email and subscription status): for as long as the subscription exists, and up to 12 months after it ends, unless you ask us to delete it sooner. Billing records are kept by Paddle as the law requires.
Email messages: as long as they are needed to deal with your message, and no more than a year after that.

Security

The best way to protect information is not to collect it. Beyond that, the site is protected in several layers:

Every connection is encrypted with HTTPS. HTTP requests are redirected to HTTPS automatically, and the browser is told (HSTS) to connect only over an encrypted connection from now on.
A strict Content Security Policy lets the browser run only code that comes from the site itself, and stops the site from being embedded in other sites.
The site blocks access to the camera, the microphone, your location and payment features.
The hosting provider protects the site from overload and attacks (DDoS). There are no passwords on the site to steal: you sign in with a link sent to your email, which works for 15 minutes.
Payment happens entirely on Paddle's page. Your card details never pass through our site.

No system is completely secure. If you find a security problem, we'd like to hear about it: dudu240315@gmail.com.

Links to other sites

The reviews link to the testing sites the scores and numbers came from, and sometimes to manufacturers' sites. When you go to another site, its privacy policy applies to you. Our site is set up not to tell the next site which page you came from.

Your rights

Under Israel's Protection of Privacy Law, 5741-1981, you may see the information about you that is held in a database, and ask us to correct or delete information that is wrong, incomplete, unclear or out of date. Visitors from the European Union and the United Kingdom also have rights under the GDPR: access, correction, deletion, restricting processing, objecting to processing, and data portability.

We don't keep IP addresses, so for anyone who isn't a subscriber we hold no information that can be linked to them. Subscribers can ask to see their subscriber record, correct it or delete it. Send the request, or requests about email messages, to the address at the end of this page, and we will answer within 30 days. Deleting the record ends access to the full reviews; the subscription itself is canceled on your account page.

If you think we didn't handle your information properly, you can complain to the Privacy Protection Authority at Israel's Ministry of Justice, or to the data protection authority in the country where you live.

Children

The site is meant for the general public and doesn't knowingly collect personal information about children.

Changes to this policy

If we change this policy, we will update the date at the top of the page. A significant change, such as adding a measuring tool or an outside service, we will also announce on the home page before it takes effect.

Contact

Questions, requests and complaints about privacy: dudu240315@gmail.com.