Privacy policy

Who we are

Report Reimagined (reportreimagined.com) is a publication about research reporting, run by Swapnil Gugale, who decides how your data is used (the “controller”). In this policy “we” and “us” mean Swapnil Gugale as the operator of Report Reimagined. Questions or requests: swapnil@reportreimagined.com.

If you only read the site

Reading needs no account and sets no cookies. To learn which pages are useful, the server records each view with:

the page you opened and the website that sent you there (the domain only, such as linkedin.com)
your country, worked out from your IP address at the moment of the visit (the address itself is never saved)
your device type (desktop, mobile or tablet) and roughly how long the page stayed open
a visitor code: a one-way scramble of your IP address and browser details mixed with a random daily key. The key is deleted after a day, so codes cannot be reversed or linked across days.

We also keep the words typed into the archive search (with no link to who searched), addresses of pages that could not be found together with the page that linked to them, and short-lived, scrambled records used to slow down spam and repeated sign-in attempts.

Likes. When you like a post or showcase item, we store a scrambled code made from your IP address and browser (or from your account, if you are signed in) so that each person counts once. Your browser also remembers locally which items you liked.

Comments

To comment you give a name and, optionally, an email address. The name and comment are published once approved; the email address is never shown and is used only to tell you about replies or to contact you about your comment. We also store a scrambled code (as for likes) to fight spam. Comments may be held for moderation, edited for formatting or removed.

If you create an account

An account lets you bookmark, comment and, if invited, write for the site. We keep:

your name, email address, username and password (stored only as a one-way hash we cannot read)
anything you add to your profile: photo, headline, organisation, bio, location, website and social links. Your profile page is public only if you switch it on, or once you have published work on the site as an author.
the IP address you signed up from, and for each signed-in device the IP address, browser and when it was last used, so you can review and sign out devices
a security log of account events (sign-ins, password changes, exports), with the IP address involved
your bookmarks, comments and, for contributors, the posts, drafts and revisions you write
if you turn on two-step sign-in, the secret your authenticator app uses

Emails

We only send emails about your account or your activity: confirming your address, password resets, approval decisions, replies to your comments and, for contributors, review notes. We keep a record of each email sent (recipient, subject, time) for 90 days; the message body is deleted after one day. There is no marketing email unless you sign up for a newsletter yourself (see below).

Cookies and browser storage

Name	What it is for	How long
rr_session	Keeps you signed in. Set only when you sign in.	Until you close the browser
rr_remember	Signs you in automatically on this device. Set only if you tick “Keep me signed in”.	30 days
rr-theme (browser storage)	Remembers light or dark mode. Never sent to us.	Until you clear it
rr-like-… (browser storage)	Remembers which items you liked on this device. Never sent to us.	Until you clear it

All of these are strictly necessary or store a preference you chose, so there is no cookie banner. There are no advertising or analytics cookies.

Why we use your data

To run your account and the features you use (bookmarks, comments, contributing): needed to provide the service you asked for.
To keep the site secure and free of spam: our legitimate interest in protecting the site and its readers.
To understand which content is read: our legitimate interest, met with anonymous, cookie-free counting.
Where you agreed to something (for example when registering): your consent, which you can withdraw by deleting your account.

We do not use your data for advertising, profiling or automated decisions about you.

Who else handles it

We never sell or rent personal data. A few services process it on our behalf, only to run the site:

Web hosting and email delivery: our hosting provider stores the site, its database and outgoing email.
Content delivery and security: if the site is served through Cloudflare, your requests pass through its network, which provides the country of each visit.
Backups: a nightly copy of the database and uploaded files is stored in a private Google Drive account controlled by the site owner, and deleted after the backup retention period.
AI writing tools: editors may use an AI provider (such as Anthropic, OpenAI or Google) to help draft or edit articles. Only the text being worked on is sent, never reader accounts, comments or analytics.
Embedded content: videos, dashboards and other embeds load from their own providers (YouTube in its privacy-enhanced mode, Vimeo with “do not track”), which may receive your IP address when you view them.
Newsletter: if a newsletter sign-up box is shown and you use it, your email address goes straight to the newsletter provider named there, under its own privacy policy.

We may also disclose information if the law requires it, or to protect the rights and safety of the site and its users. These providers may be in other countries; where the law requires it, we rely on appropriate safeguards for those transfers.

How long we keep it

Data	Kept for
Daily key behind visitor codes	1 day, then deleted
Anonymous view counts, likes and missing-page records	While the site runs (they cannot identify you)
Archive search terms	2 years
Email records	90 days (message bodies 1 day)
Account security log	2 years
Sign-in, reset and invitation links	Until they expire or are used
Your account, profile, bookmarks and devices	Until you delete your account
Database backups	The backup period set by the owner (30 days by default)

When you delete your account, your profile, photo, bookmarks and devices are removed at once. Comments stay, signed “Former member”; posts you wrote stay on the site under the publication. Backups age out on their normal schedule.

Your rights

Depending on where you live (including under the GDPR, the UK GDPR and India’s Digital Personal Data Protection Act, 2023), you can ask to access, correct, delete or receive a copy of your personal data, object to or restrict how we use it, withdraw consent, and nominate someone to act for you. With an account you can do most of this yourself:

edit your details in Account → Profile
download everything as a file, or delete your account, in Account → Privacy & data

For anything else, such as a comment you posted without an account, email swapnil@reportreimagined.com. We reply within 30 days and may need to confirm it is you. If you are unhappy with our answer, you can complain to your local data protection authority or, in India, the Data Protection Board of India.

Security

The site runs over HTTPS. Passwords are stored as one-way hashes, sign-in attempts are rate-limited, two-step sign-in is available, and only approved staff can reach the admin area. No system is perfectly secure; if a breach affects you, we will tell you and the relevant authorities as the law requires.

Children

Report Reimagined is written for professionals and is not aimed at children. Accounts are only for people aged 18 or over. If you believe a child has given us personal data, email us and we will delete it.

Changes to this policy

When this policy changes, the “Last updated” date above changes too. If a change materially affects how we use account data, we will tell account holders by email before it takes effect.