Privacy Policy

Who is responsible

OpenGTM is operated by Oliver Longhurst. For the purposes of UK data protection law, OpenGTM is the controller for the personal information described here. To ask a privacy question or make a request, email olly@oliver-longhurst.co.uk.

Reading public content and analytics

You can read OpenGTM without an account. OpenGTM and its hosting provider process the limited technical information needed to deliver and secure a website, such as IP address, browser or device information, request time, and security logs. OpenGTM does this to provide the site and for its legitimate interests in keeping it reliable and secure.

OpenGTM may use Vercel Web Analytics to understand the use of selected public pages, including the launch article, Subscribe, and Pinball. This is limited to anonymous, aggregate page-use signals. OpenGTM does not intentionally send raw Assistant questions, email addresses, names, score details, session replay, heatmaps, or an email-linked reading history to analytics. OpenGTM does not use advertising cookies or create advertising audiences.

Optional email updates

If you choose to subscribe, OpenGTM sends your email address and affirmative subscription choice to EmailOctopus so it can send OpenGTM updates. The legal basis is your consent. You can withdraw it using the unsubscribe link in any email. OpenGTM keeps the subscription separate from reading analytics and does not use it to build a wider profile.

EmailOctopus manages its own subscriber-list retention and suppression records. Its privacy information is available at EmailOctopus Privacy Policy.

Optional LinkedIn and DeepSeek Assistant

Local Search is anonymous and does not send your query to OpenGTM. The live Assistant is different and remains optional. After you choose LinkedIn sign-in, LinkedIn supplies an identity assertion to OpenGTM. OpenGTM converts the provider identifier to a purpose-specific pseudonymous digest for the Assistant. It does not retain the raw LinkedIn subject, profile, email address, access token, refresh token, or authorisation code.

When you send an Assistant question, OpenGTM forwards that question and relevant published OpenGTM content to DeepSeek to create a cited response. OpenGTM does not retain Assistant conversations. DeepSeek controls its own provider-side retention and processing, which may change independently of OpenGTM; see the DeepSeek Privacy Policy.

OpenGTM stores the pseudonymous Assistant account, a rolling five-conversation allowance, and the minimum session and security state needed to run the feature and prevent abuse. Logging out ends the browser session. Using the unlink control erases the purpose-specific account, its sessions, and its allowance. A non-linkable calendar-month spend record remains for up to 60 days to enforce the site-wide Assistant spend cap, including when a provider outcome is uncertain. This processing is necessary to provide the Assistant you request and for OpenGTM's legitimate interests in preventing misuse and enforcing its safety limits.

LinkedIn's processing is governed by the LinkedIn Privacy Policy. LinkedIn identity used for the Assistant is kept separate from optional Pinball claims and subscriptions; OpenGTM does not create a general account from these features.

Pinball scores and optional LinkedIn claims

Pinball is playable without sign-in. If you submit a score, the display name, score, achieved time, rank, and whether a score has been LinkedIn-claimed can be public on the all-time leaderboard and its shareable score page. Do not submit a name or other information that you do not want to be public.

OpenGTM keeps a visible ranked score for the life of the leaderboard. It keeps a score-claim proof only as a score-scoped HMAC digest, not as a raw LinkedIn identifier or cross-score identity. Authorisation and rate-limit records are short-lived; quarantined display names are redacted after 90 days and moderation audit records are retained for up to 365 days. The unlink control removes a LinkedIn claim without deleting the guest score. This processing is necessary to provide the score and claim features you request and for OpenGTM's legitimate interests in preventing fraud and abuse. Contact OpenGTM if you need help with a public score.

Cookies and local browser storage

OpenGTM uses strictly necessary, HttpOnly cookies only when you start a LinkedIn Assistant or Pinball-claim flow. They secure the sign-in transaction and session and are not used for advertising. Control Panel preferences, such as sound, motion, and Assistant visibility, stay in your browser's local storage. Pinball may keep an opaque, per-score management capability in session storage so that you can manage that score; it is not placed in a public URL.

Processors and international transfers

OpenGTM uses Vercel for hosting, security, and optional analytics; Sanity for published content; EmailOctopus for email updates; Upstash for necessary operational state; LinkedIn for optional identity; and DeepSeek for optional Assistant responses. These providers may process information in countries outside the UK. Their processing and transfer arrangements are described in their respective privacy information.

OpenGTM does not sell personal data or combine subscription, Assistant, and leaderboard activity into a general profile.

Your rights and choices

Subject to applicable law, you can ask OpenGTM to access, correct, erase, restrict, or provide a copy of your personal information; object to processing based on legitimate interests; or withdraw consent for email updates. Email olly@oliver-longhurst.co.uk with enough detail to locate the relevant feature or public score.

If you are in the UK and are unhappy with how a request is handled, you can complain to the Information Commissioner's Office.

Changes to this policy

OpenGTM will update this page when its data practices materially change and will revise the date above. Continued use of public reading does not require an account; optional features remain your choice.