Legal
Privacy policy
Last updated 28 September 2026
This policy explains how State of the Realm Media Ltd ("we", "us"), which publishes State of the Realm, handles personal data when you read, join or take part in the publication. We are the data controller and follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
State of the Realm Media Ltd, registered in England and Wales, company no. 17485542.
What we collect
- Account details: your email address, a display name, an optional first name (used only to greet you in emails) and, if you sign in with Google, your name and profile photo from Google.
- Profile details you choose to add: username, bio, location and interests. These are visible only to you and our editors.
- What you post: comments, community posts, replies and likes. Follows are visible only to you and our editors.
- Payments: if you become a paid member, Stripe collects your card details, billing name, postcode and country. We receive only your plan, payment status, renewal date and a Stripe customer reference. We never see your full card number. We also record when you confirmed immediate access and that you are 18 or over.
- Newsletter: your email address and when you subscribed.
- Security: if you turn on two-step verification, a record that it is enabled. We never see your authenticator codes.
- Google Analytics (only with your consent): pages visited, approximate location, device and browser, collected by Google using cookies.
- Usage (only with your consent): anonymous page visits, including the page, the referring website, and device, browser and operating-system type. We do not record your IP address or link visits to your account.
Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Running your membership, sign-in and security | Contract |
| Taking payment for paid membership | Contract |
| Keeping payment and tax records | Legal obligation |
| Welcome and account emails | Contract |
| Showing your comments and posts | Contract |
| Sending the weekly newsletter | Consent. You can unsubscribe at any time |
| Account emails (password resets, sign-in codes) | Contract |
| Visitor statistics and Google Analytics | Consent, via the cookie banner |
| Moderating content and preventing abuse | Legitimate interests |
Who we share it with
We do not sell your data or use it for advertising. We use trusted processors to host the site, store data, send email (from notify.stateoftherealm.org), process payments (Stripe), measure site use with your consent (Google Analytics) and provide Google sign-in. They act only on our instructions. Some may process data outside the UK; where they do, we rely on UK adequacy regulations or the International Data Transfer Agreement.
How long we keep it
- Account and profile data: until you delete your account.
- Public contributions: until you delete them or your account.
- Newsletter records: until you unsubscribe, plus a suppression record so we don't email you again.
- Visitor statistics: up to 24 months, and never linked to you.
- Payment and billing records: six years after the transaction, as UK tax and company law requires.
Your rights
You have the right to access, correct, delete or export your data, to object to or restrict processing, and to withdraw consent at any time. Email privacy@stateoftherealm.org and we will respond within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Children
Free accounts are for people aged 13 and over; paid membership is for people aged 18 and over. We do not knowingly collect data from younger children.
Changes
If we change this policy in a meaningful way, we will update the date above and tell members by email.