Skip to content
BrokerPick

Privacy

Privacy policy

This page describes what happens to data when you use BrokerPick, based on how the site actually works. There are no user accounts, forms or newsletters, and analytics tools run only if you accept them.

Last updated:

Who is responsible

The controller of personal data processed through the site is Paweł Waliłko, a private individual, Poland. For all privacy matters, write to contact@brokerpick.net.

In short

  • Without your consent, the site sets only cookies needed for language, appearance and for remembering your analytics decision, and a country cookie only when you choose a country yourself.
  • Google Analytics 4 and PostHog load only after you click “Accept”. Before that, and after “Reject”, their scripts are not loaded and nothing is sent to them.
  • We do not use advertising cookies, we do not sell data and we do not pass data to brokers.
  • The database contains broker data, a list of countries and anonymous broker-button click events. It stores no IP address, user agent, referrer or other information that identifies a person with a click; a session identifier is attached only after analytics consent.

Hosting and technical data

The site runs on the Cloudflare platform (Workers hosting, content delivery network and attack protection). To deliver and secure pages, Cloudflare processes technical connection data, including your IP address; see Cloudflare's privacy policy.

Cloudflare adds to each request a two-letter code of the country the connection comes from. Until you choose a country yourself, the site uses this code on each request to show availability for that country and to select the broker link, and does not store it in your browser. A country cookie is created only when you choose a country in the country selector or confirm the detected country. Our code does not read or store your IP address.

Site logs (Workers Observability) are switched on at Cloudflare so that faults can be diagnosed. They contain request and response data, including the page address with its query string, method, time, response status and error messages. They may also include request headers, for example information about your browser (User-Agent) and the address of the page the request was sent from (Referer). Cloudflare keeps them for 7 days.

Broker data and anonymous broker-button click events are stored in a Supabase database in the EU region (Ireland).

Cookies that do not require consent

These cookies are needed for functions of the site that you use. They contain no identifier of you and are not sent to third parties.

analytics_consent
Remembers whether you accepted or rejected analytics.
Lifetime: 1 year
Set: when you click “Accept” or “Reject”
Set by: this site
country
The country of residence you chose, used to show availability, leverage and the legal entity for that country.
Lifetime: 1 year
Set: only when you choose a country in the country selector or confirm a detected country with the “Confirm” button
Set by: this site
country_detected
A marker from an earlier version of the site, which stored the detected country automatically; it lets the site ask you to confirm that country.
Lifetime: 1 year
Set: no longer set; may remain in the browser from earlier visits and is removed when you choose or confirm a country
Set by: this site
brokerpick_theme
Your appearance setting: light or dark.
Lifetime: 1 year
Set: when you change the appearance
Set by: this site
NEXT_LOCALE
The interface language of the pages you open.
Lifetime: until you close the browser
Set: when a page loads in a language other than your browser's language, or when you change the language
Set by: this site

Analytics, only after consent

If you click “Accept”, two analytics tools start. We use them to understand how the catalogue, broker profiles and comparisons are used and where the site is hard to use.

Google Analytics 4 (Google). Enhanced measurement is switched off, as are Google signals, ad personalisation signals, automatic page view collection and sharing of data with Google for its own purposes. Page addresses are sent without the page title or the address of the previous page, and keep only the query parameters listed below. According to Google, Google Analytics 4 does not log or store IP addresses. See Google's privacy policy.

PostHog, EU data region. PostHog stores a random anonymous identifier in a cookie. We do not create user profiles and never link the identifier to a name or an e-mail address. Session recordings capture how pages looked and how you moved through them (visible text, clicks, scrolling). Every form field is masked, and request headers and bodies are not recorded. PostHog receives your IP address with each request, but our project has IP discarding switched on, so the IP address is not stored with events. Our configuration also switches off location lookup from the IP address. See PostHog's privacy policy.

In page addresses sent to Google Analytics 4 and PostHog, including session recordings, only the query parameters a and b (brokers selected for comparison), platform (the catalogue platform filter) and available (the filter for availability in your country) are kept. All other parameters are removed before sending, including q, the text typed into the catalogue search. Text typed into the catalogue search is never sent to either tool: it is not in page addresses, and the search field is masked in session recordings.

PostHog also records separately, from the address a visit started on, campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and ad click identifiers (for example gclid or fbclid), if the address contains them. If the visit started from a web search engine that passed the words searched for in its address, PostHog also records those words. For automatically recorded clicks, PostHog records the address of the clicked link as it appears on the page; the site's links do not contain text from the catalogue search.

To Google Analytics 4, our code sends only the events listed below. Google Analytics 4 also collects some events automatically on every website, such as the start of a visit and engagement time. PostHog receives the events listed below, except page views by page type, and the standard PostHog events named in the last item of the list. Every other PostHog event, including dead clicks, rage clicks, page performance measurements (web vitals), heatmap data and JavaScript errors, is dropped in the browser before it is sent. Our events are:

  • page views by type of page and language (Google Analytics 4 only);
  • broker profile and comparison views, and choosing brokers to compare: broker identifiers, the country the site uses (chosen by you or detected from your connection) and the language;
  • use of catalogue filters: which filter was used and its setting; for the name search only whether text was entered, never the text itself;
  • changes of country, language and appearance;
  • broker-button clicks: the broker, the country the site uses, language, source page type and button placement;
  • in PostHog, also page views ($pageview), page leaves ($pageleave) with time on page and scroll depth, automatically recorded clicks, field changes and form submissions ($autocapture), and session recordings. Copied text and the values of form fields are not recorded.

Cookies and browser storage used by analytics:

brokerpick_outbound_session
A random, short-lived session identifier attached to the record of a broker-button click; it does not identify you.
Lifetime: 30 minutes
Set: when you use a button leading to a broker, only after analytics consent
Set by: this site
_ga
Google Analytics: distinguishes browsers.
Lifetime: 2 years (Google's default)
Set: only after you click “Accept”
Set by: Google
_ga_<ID>
Google Analytics: keeps the state of a visit.
Lifetime: 2 years (Google's default)
Set: only after you click “Accept”
Set by: Google
ph_<key>_posthog
PostHog: a random anonymous identifier and information about the current visit.
Lifetime: 1 year (PostHog's default)
Set: only after you click “Accept”
Set by: PostHog
ph_<key>_window_id, ph_<key>_primary_window_exists
PostHog, in the tab's session storage (sessionStorage): a window identifier that tells browser tabs apart in visit data.
Lifetime: until you close the browser tab
Set: only after you click “Accept”
Set by: PostHog

When you write to us

If you e-mail us, we use your e-mail address and the content of your message to reply and to deal with your matter, for example to correct data. Providing this data is voluntary, but without it we cannot reply.

Messages sent to contact@brokerpick.net are forwarded by Cloudflare Email Routing to a Gmail mailbox (Google). We keep correspondence until the matter is dealt with, then for 12 months after the last message.

Your rights

Under data protection law you have the right to access your data, to have it corrected or deleted, to restrict its processing, to object to processing based on legitimate interest, to data portability and to withdraw consent at any time. To exercise these rights, write to contact@brokerpick.net.

Analytics data does not tell us who you are. To find data about you in PostHog, we may need the identifier stored in the cookie whose name starts with ph_ in your browser.

We do not make decisions about you based solely on automated processing, including profiling.

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland). You can also lodge a complaint with the supervisory authority in the EU member state of your habitual residence, place of work or place of the alleged infringement.

Changes to this policy

We update this page before adding a new tool or starting to collect a new kind of data. The date at the top of the page shows the current version.