Privacy

What we collect

Spotlito has no accounts, no sign-up and no newsletter. We do not ask you for your name, email address or any other personal detail, so we do not hold one.

When you open a page, our own analytics records five things:

• The path you visited, such as /analysis/btc-holds-structure.
• The site you arrived from, reduced to its domain — google.com, not the full search URL. Links from within this site are recorded as no referrer at all.
• Whether you are on desktop, mobile or tablet.
• The time of the visit.
• A one-way visitor code, described below.

The visitor code

To tell one reader from ten visits by the same reader, we need something stable within a day. We take your IP address and browser user-agent, combine them with the current UTC date and a secret value, and run the result through SHA-256. Only that hash is written to our database.

Your IP address and user-agent are used in that calculation and then discarded. Neither is ever stored. Because the date is part of the input, the code changes at midnight UTC — today’s reader cannot be linked to yesterday’s, and the record cannot be reversed to recover the address it came from.

Cookies

The analytics described above sets no cookies and uses no browser storage of any kind.

Google Analytics does set cookies, so we ask before loading it. Until you accept, no Google script runs on the page and no request is made to Google at all. Your answer is remembered in your own browser’s local storage — that is the one thing we store on your device, and only once you have answered.

One further cookie exists on this site: a sign-in cookie for the internal editorial console at /admin. It is set only when a member of staff signs in, holds no personal data, and is never set for readers.

What we never do

• Sell, rent or share visitor data with anyone.
• Store IP addresses or user-agent strings.
• Run advertising or cross-site tracking pixels.
• Build profiles of individual readers, or attempt to identify them.

Other services

Pages load typefaces from Google Fonts, so your browser makes a request to Google’s servers when you open the site. That request is between your browser and Google, and is subject to Google’s own privacy policy.

Market data comes from exchange APIs, which our servers call — not your browser — except for a live price feed that connects directly to a public Binance market-data endpoint. No identifying information is sent with it.

Google Analytics

Alongside our own counter we offer Google Analytics, which tells us how many distinct people read the site across days rather than within one — something the privacy-preserving method above cannot measure, because its identifier is designed to expire every night.

It loads only if you accept. It sets cookies, sends data to Google, and is governed by Google’s own privacy policy. Declining costs you nothing on this site: every page works identically either way, and our own counting is unaffected.

You can change your mind at any time, here:

Retention

Pageview rows are kept so we can see which analysis is read over time. They contain no personal data and are not linked to any identity.

Your rights

Data-protection law gives you the right to ask what a site holds about you, and to have it corrected or deleted. We can honour those requests in principle, but in practice we hold nothing that identifies you, so there is no record to return or erase. If you believe otherwise, write to us and we will look.