Last updated 8 September 2026.
The short version
You can read everything on this site without telling us who you are. We run no advertising, no analytics product and no tracking of any kind. We set one cookie, and only after you have signed in. If you do sign in, we hold your email address so we can recognise you — and nothing else. Ask us and we will delete it.
Who we are
20 Keys publishes 20keys.org. For data protection purposes the controller is [to be completed], at [to be completed]. You can reach us at hello@20keys.org.
What we collect
When you are just reading. Our servers keep an ordinary request log — the page requested, the time, the browser's user agent and its IP address. We use it to keep the site up and to see which search and AI crawlers are reading us. It is not tied to any account and we build no profile from it.
When you sign in. We ask for an email address and nothing else. We store that address, a display name if you choose one, when you last signed in, and a record of your current session. There is no password, so there is none to lose.
When you comment. We store what you wrote and the name shown beside it. Comments appear on the page, so treat anything in one as public. Your first comment is held for review before it appears.
What we do not do
We do not sell or share your information. We run no advertising, no retargeting and no analytics product. We do not profile you, and nothing here makes an automated decision about you.
Cookies
One: a session cookie set when you sign in, so the next page knows it is still you. It is strictly necessary for that, which is why you are not being asked to accept anything — there is nothing optional to accept. Signing out clears it.
Services we rely on
Our hosting and file storage providers hold this site's data on our behalf, and sign-in emails go out through a transactional email provider. Typefaces come from Google Fonts, which means your browser requests them from Google directly and Google receives your IP address in doing so.
Why we are allowed to hold it (UK and EU readers)
Signing you in and publishing your comments is us doing what you asked, so the basis is performance of a contract. Keeping the site up and moderating comments before they appear are our legitimate interests. We do not rely on consent, because nothing here needs it.
How long we keep it
Request logs are kept briefly and then discarded. Sign-in links and codes expire within minutes and are deleted once used. Sessions expire on their own. Your account and your comments stay until you ask us to remove them.
Where it is held
Our providers operate in the United States and the European Union, so your information may be transferred out of the country you are reading from. Where that is a transfer out of the UK or EEA it is covered by the European Commission's standard contractual clauses.
Your rights
Wherever you are, you can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it — your account and every comment on it. Email hello@20keys.org and we will do it.
In the UK or EEA you can also object to or restrict how we use your information, receive it in a portable form, and complain to your national data protection authority. In California you have the right to know, delete, correct and opt out of sale or sharing — we do neither, so there is nothing to opt out of, and we will not treat you differently for asking.
Children
This site is written for people who run hospitality businesses. It is not directed at children and we do not knowingly collect anything from anyone under 16. If you believe a child has signed in, email us and we will remove the account.
Changes
If we change this policy we change the date at the top, and if the change is significant we will say so on the site.
Contact
Questions, requests and complaints all go to hello@20keys.org.