Short version: we collect your email only if you subscribe to the newsletter. We use analytics tools to understand how readers use our articles. The ones that set cookies — including Microsoft Clarity, which records how pages are used — do not load at all unless you accept them. You can change your mind at any time, and you can delete everything we have on you by emailing us.
Changed on 2 September 2026: until that date the site used no tracking cookies at all. We added Microsoft Clarity, which does use cookies, and for two days it loaded without asking you first. That was wrong and we are not going to paper over it.
Fixed on 4 September 2026: nothing that sets a cookie now loads until you choose. Until you press “Yes, that’s fine”, Clarity and Google Tag Manager are not requested at all — not loaded-and-disabled, simply absent from the page. Declining is one click, exactly like accepting, and ignoring the banner leaves everything off.
Who we are
NeedSkincare.com ("NeedSkincare", "we", "us") is an independent skincare publication operated by Afthab Rahman. We serve readers in the US, UK, and Australia. For any privacy question or request, email [email protected].
What we collect
1. Newsletter email (only if you subscribe)
When you submit the newsletter form, we store your email address and the timestamp of your signup in our Supabase database. We use this to send you the newsletter, and for nothing else. We use a double opt-in flow — you confirm your subscription via an email link before we ever send you a newsletter.
Legal basis (GDPR Art. 6(1)(a)): your explicit consent at signup. You can withdraw consent any time by clicking the unsubscribe link in any newsletter, or emailing us.
2. Anonymous traffic analytics
We use Cloudflare Web Analytics to count page views and understand which content is useful. It is cookieless: it sets no cookies, stores nothing on your device and does not fingerprint your browser. It records the page you viewed, where you came from, your browser type and your country. We don't see your IP address, we don't build a profile of you, and the data cannot be linked back to you individually. No advertising IDs, no cross-site tracking.
Legal basis (GDPR Art. 6(1)(f)): our legitimate interest in understanding aggregate site usage, balanced against your privacy by Cloudflare's cookieless, non-identifying design.
Our own page counts. Our server also keeps a simple tally of what happens on each page: that a page was opened, read, or that a product link was clicked, and, when you leave a page, how far down it you scrolled and how many seconds it was on your screen. Each entry records the page address (without anything after a “?”), the name of the site you arrived from (for example “google.com” — never the page you were on there), a short campaign label if the link you followed carried one, your country, whether you were on a phone or a computer, and the answer you gave on the cookie banner. Within one visit, each entry also notes which page on our site you came from, the first page of your visit and whether you reached it from a search engine, an AI assistant, social media or directly, and how many pages into the visit you are. That is held only in the memory of the open tab while you move between our pages — it is not saved on your device, it is forgotten when you close the tab or reload the page, it never links one visit to another, and it is never sent to Google. It stores no cookie, no visitor ID, and no IP address, so no entry identifies you. Nothing is written to or read from your device to do this, which is why it runs whether or not you accept cookies. Entries are deleted after 13 months. We also add the tallies up to list the guides visited most in the past week; that list holds page addresses and nothing else. Same legal basis as above.
3. Aggregate search analytics (Google Analytics 4)
We use Google Analytics 4 to count visits, and it works in one of two ways depending on your answer to the cookie banner.
If you accept cookies, Google Analytics runs in your browser and sets its own cookies (_ga and _ga_…) so a return visit can be recognised. Saying “No thanks” later, or using “Change my cookie choice” below, deletes them.
If you have not accepted, Google Analytics writes nothing to your device. Instead our server passes Google the same page counts described above — the page address, the site you came from, your country, phone or computer, and your banner answer — tagged with a random number that is new for every single count, so no two counts can be linked to each other or to you. Your IP address is not passed on: the request comes from our server, not your browser.
Either way, Google Signals (cross-device tracking via your Google account) and ad personalization signals are disabled, so this data cannot be used for advertising or to profile you across sites.
Legal basis: your consent (GDPR Art. 6(1)(a)) for the browser version with cookies; our legitimate interest in understanding aggregate site usage (Art. 6(1)(f)) for the server-side counts, which store and read nothing on your device and carry no identifier.
4. Session recording and heatmaps (Microsoft Clarity)
We use Microsoft Clarity to see how readers actually use our articles — how far down a page people scroll, what they click, and where they give up. It records a playback of the page as it was used, and it sets cookies in your browser to recognise a returning session.
Clarity masks the text you type, so anything you enter into a form is not recorded. We use it to decide where to improve articles, not to identify individuals — but unlike our other analytics, this data is at the level of a single session rather than an aggregate count. Microsoft processes this data as a separate controller under its own privacy statement.
How to prevent it: press No thanks on the prompt, or simply ignore it — Clarity is never requested unless you accept. To change an earlier answer, use the button at the end of this page. Blocking third-party cookies or using a tracking blocker also works, and you can email us to have recorded sessions deleted.
Your current choice: not chosen yet — nothing that sets a cookie is running
5. Google Tag Manager
Google Tag Manager loads on every page. It is a delivery mechanism, not an analytics tool — it is how we switch tools like Clarity on and off without changing the site's code. Loading it means Google receives the request, including your IP address and browser type. It does not itself set advertising cookies or build a profile of you.
6. What we don't collect
- No advertising pixels, no Facebook Pixel, no cross-site profiling, and no selling or sharing of your data with advertisers. We do now set cookies for session recording (section 4) — before 2 September 2026 we set none at all.
- No fingerprinting.
- No selling of any data to anyone. Ever.
- No reading product purchases back from affiliate networks — we receive only aggregate, anonymous commission reports.
Who we share data with
We share the minimum required data with these processors. Each one acts only on our instructions and is bound by data processing agreements.
- Supabase (database + storage host) — stores your newsletter email and our content. Supabase is GDPR and CCPA compliant.
- Hostinger (web host) — runs the server that builds and serves the site.
- Cloudflare (content delivery, security and analytics) — delivers pages from servers near you, protects the site from attacks, and records cookieless traffic counts. Like any network that carries web traffic, it processes your IP address to deliver the page.
- Google Analytics 4 (aggregate search analytics) — receives page-view counts: from your browser, with cookies, if you accept; otherwise from our server, with no cookie, no IP address and no visitor ID. Google Signals and ad personalization are disabled, so the data cannot be used for advertising or cross-site profiling.
- Microsoft (Clarity — session recording and heatmaps) — receives a recording of how pages are used, plus your IP address, browser and approximate location. Microsoft acts as an independent controller for this data under its own privacy statement.
- Google (Tag Manager) — receives the request that loads the tag container, including your IP address and browser type.
- Resend (email delivery) — sends newsletter confirmations and editions. We share your email and the content of the email; nothing else.
Where your data lives
Our Supabase database is hosted in the United States (Northern California). Hostinger, Cloudflare and Resend process data in several countries, with appropriate data transfer mechanisms (Standard Contractual Clauses) for EU/UK data.
How long we keep it
- Newsletter email: until you unsubscribe. After you unsubscribe, we keep your email on a suppression list (so we don't accidentally re-add you) but no longer send anything. You can request full deletion by emailing us.
- Session recordings (Clarity): Microsoft retains these for up to 30 days, then deletes them. Email us if you want yours removed sooner.
- Anonymous analytics: Cloudflare keeps aggregated page-view counts; there is no visitor ID to look anyone back up.
Your rights
Wherever you live, you can email [email protected] to:
- Ask what data we hold on you (access)
- Correct any inaccurate data (rectification)
- Have your data deleted (erasure / "right to be forgotten")
- Export your data in a portable format (portability)
- Object to processing or restrict it
- Withdraw consent for the newsletter at any time
We respond to verified requests within 30 days. EU/UK readers may also lodge a complaint with their national data protection authority. California readers have the same rights under CCPA / CPRA.
Children
NeedSkincare is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe we've received data from a child, email us and we'll delete it.
Security
All connections to the site use HTTPS. Database access is restricted by row-level security policies that prevent cross-account data access. Internal credentials are rotated regularly. No system is unbreakable, but we treat your data with the same care we'd want for our own.
Changes to this policy
If we change this policy in a material way, we'll update the "Last updated" date at the top and, where the change affects you directly (e.g. a new data processor), email subscribers ahead of the change. The current version always lives at this URL.
Contact
Privacy questions, data requests, or anything that isn't clear: [email protected]. See also our affiliate disclosure and about page.