MoneyMeta is a static site: there is no database, no user accounts and no server-side code running behind it. That keeps the list of parties who ever see your data short. This page names all three of them, in plain language, because a meaningful number of our readers are in Germany and France and are covered by the GDPR.
Who we are
MoneyMeta ("we," "us") is the publisher of moneymeta.gg. For any privacy question or to exercise a right described below, contact privacy@moneymeta.gg.
The three processors this site actually uses
1. beehiiv — email
If you submit your email address through a signup form on this site (the waitlist, or the in-article and homepage sign-up bands), it is sent directly from your browser to beehiiv, our email newsletter provider — it never passes through a MoneyMeta server, because we don't run one. beehiiv stores your address, sends the emails you signed up for, and gives us aggregate open/click statistics; we do not receive your address as a separate copy outside beehiiv's platform. beehiiv acts as our data processor for this purpose and is bound by its own privacy policy and data processing terms, available at beehiiv's website. You can unsubscribe from any email we send using the link in that email, which removes you from the list at the source.
Legal basis: your consent, given by submitting the form. Data: email address only — we do not ask for your name or any other field. Retention: until you unsubscribe or ask us to delete it.
2. Cloudflare — content delivery and security
Every request to moneymeta.gg passes through Cloudflare, which serves our static files from servers near you and filters malicious traffic before it reaches our host. As part of that, Cloudflare processes standard connection data — your IP address, browser user-agent and request metadata — for the time needed to route and secure the request. We do not use Cloudflare's optional visitor-analytics or tracking features, and the base CDN/security service does not set tracking cookies; if Cloudflare's security layer ever needs to issue a strictly-necessary cookie (for example, during a bot challenge), it exists only to complete that check and is not used to track you across visits. Cloudflare acts as our data processor for this infrastructure layer.
Legal basis: our legitimate interest in keeping the site available and secure. Retention: governed by Cloudflare's own log-retention policy, which is materially shorter than the data we control ourselves.
3. Google Analytics 4 — visitor statistics, only after you say yes
We use Google Analytics 4 ("GA4"), a service provided by Google Ireland Limited, to see aggregate numbers — which pages get read, roughly how much traffic we get, which countries readers come from — so we know what to write next. Unlike some analytics tools, GA4 sets cookies and can be used to build a profile of how a device browses this site over time, which under the GDPR and the ePrivacy Directive means it may not run until you actively consent. So it doesn't: every page on this site shows a consent banner before anything else loads, and the banner's "Accept" and "Decline" buttons are the same size and equally prominent — declining is exactly as easy as accepting, and neither box is pre-ticked. No GA4 script, no GA4 cookie and no network request to Google happens until you click "Accept." If you click "Decline," or never make a choice at all, GA4 never loads for that visit — the site works identically either way. Your choice is remembered (in your browser's local storage, not a cookie) so the banner doesn't reappear on every page; you can withdraw or change it at any time using the "Manage cookie preferences" link in the footer of every page.
What GA4 collects, once you've consented: pages viewed, approximate location (country/region, derived from IP address — Google's IP-anonymisation setting is enabled, so your full IP address is not stored), device and browser type, referring site, and how long you stay. It sets first-party cookies (prefixed _ga) to distinguish one visitor's sessions from another's. We do not use GA4 to build cross-site advertising profiles, we have not enabled Google Signals or advertising features, and we do not pass your email address or any other directly-identifying field to Google.
Legal basis: your explicit, opt-in consent (Article 6(1)(a) GDPR), collected before GA4 loads. Data: the pageview and device data described above — no email address, no name, no account. Retention: governed by our GA4 property's retention setting, capped at 14 months, after which Google automatically deletes it.
Cookies
MoneyMeta ships minimal JavaScript, and none of it sets a cookie without your consent. Two categories apply:
- Strictly necessary — no consent required. Cloudflare's security layer described above may issue a cookie only when it needs to (for example, during a bot challenge); it exists solely to complete that check and is exempt from consent under Article 5(3) of the ePrivacy Directive because it's essential to deliver a service you explicitly requested. It is never used for tracking or profiling.
- Analytics — consent required, opt-in only. GA4's
_ga-prefixed cookies, described above, are set only after you click "Accept" on the consent banner. If you decline, or simply close the banner without choosing, these cookies are never set and the GA4 script is never even requested from Google's servers.
You can change your analytics choice at any time via "Manage cookie preferences" in the footer, or by clearing this site's data in your browser (which also clears the remembered choice, so the banner reappears).
Your rights under the GDPR
If you are in the EU/EEA (or anywhere the GDPR applies), you have the right to: access the personal data we (via beehiiv or, if you've consented to analytics, GA4) hold about you; rectify it if it's wrong; erase it; restrict or object to its processing; and receive a copy of it in a portable format. You also always have the right to withdraw consent for GA4 at any time — use "Manage cookie preferences" in the footer, which reopens the banner so you can choose "Decline"; withdrawing takes effect immediately for all future page loads and does not affect the lawfulness of any processing already carried out under your earlier consent. To exercise any of these rights, email privacy@moneymeta.gg — for email-list data specifically, the fastest route is unsubscribing directly from any newsletter, which triggers deletion at beehiiv immediately; for GA4 data, you can also use Google's own account tools if you're signed into a Google account, independent of anything we do. You also have the right to lodge a complaint with your local data protection supervisory authority — in Germany, the relevant Landesdatenschutzbehörde for your state; in France, the CNIL.
International transfers
beehiiv, Cloudflare and Google (GA4) are all U.S.-headquartered providers, so data they process can be transferred outside the EEA. Each covers that transfer with a recognised safeguard: beehiiv and Cloudflare rely on the EU Standard Contractual Clauses in their data processing terms; Google participates in the EU-U.S. Data Privacy Framework and also offers the Standard Contractual Clauses as an alternative safeguard for GA4 data. Because GA4 only ever runs after your explicit consent, this transfer only happens for visitors who have clicked "Accept" — declining means no GA4 data, and so no GA4 transfer, exists for you at all.
Changes to this policy
If what we collect or who we share it with changes, we'll update the effective date at the top of this page and, for any change that adds a new use of personal data, describe it here before it takes effect.