10 · The event log

The site has no third-party analytics script. Instead it has its own event log in its own database: an entry view, a rating, a comment, a comment stopped by bot verification, a click out to an external link, a film played, a share.

The reason is simple and follows directly from the assumptions in the first entry. An analytics script means handing data about your readers to a third party in exchange for charts. On a site that promises the author their data is theirs, that would be a promise with an asterisk.

With each event we record the time, the IP address, the country recognised by the edge network, the browser, the language and where the reader came from. The last of those turned out to be the most instructive and the most technically deceptive: the first version recorded the site's own address as the source, because the request header carried the previous subpage rather than the actual entry from outside. That information had to be passed from the browser instead.

The privacy question was settled unambiguously and against the first version. Originally, records older than ninety days were to be deleted. The rule now reads: we delete nothing, and after ninety days we mask the address. An IPv4 address loses its last octet, an IPv6 address is truncated to a prefix. The event stays, the historical statistics stay, the ability to tie it to a person disappears.

That change of direction is worth recording, because it shows the difference between regulatory compliance and design. Deleting was simpler and also compliant. Masking preserves the analytical value and removes the risk — at the cost of a dozen or so extra lines.