Short version: we collect your email only if you subscribe to the newsletter. We use analytics tools to understand how readers use our articles. The ones that set cookies — including Microsoft Clarity, which records how pages are used — do not load at all unless you accept them. You can change your mind at any time, and you can delete everything we have on you by emailing us.
Changed on 2 September 2026: until that date the site used no tracking cookies at all. We added Microsoft Clarity, which does use cookies, and for two days it loaded without asking you first. That was wrong and we are not going to paper over it.
Fixed on 4 September 2026:nothing that sets a cookie now loads until you choose. Until you press Accept, Clarity and Google Tag Manager are not requested at all — not loaded-and-disabled, simply absent from the page. Declining is one click, exactly like accepting, and ignoring the banner leaves everything off.
Who we are
NeedSkincare.com ("NeedSkincare", "we", "us") is an independent skincare publication operated by Afthab Rahman. We serve readers in the US, UK, and Australia. For any privacy question or request, email hello@needskincare.com.
What we collect
1. Newsletter email (only if you subscribe)
When you submit the newsletter form, we store your email address and the timestamp of your signup in our Supabase database. We use this to send you the newsletter, and for nothing else. We use a double opt-in flow — you confirm your subscription via an email link before we ever send you a newsletter.
Legal basis (GDPR Art. 6(1)(a)): your explicit consent at signup. You can withdraw consent any time by clicking the unsubscribe link in any newsletter, or emailing us.
2. Anonymous traffic analytics
We use Vercel Web Analytics to count page views and understand which content is useful. Vercel's analytics are cookieless— they generate an anonymous, daily-rotating visitor ID from your IP plus user-agent. We don't see your IP address, we don't build a profile of you, and the data cannot be linked back to you individually. No advertising IDs, no cross-site tracking.
Legal basis (GDPR Art. 6(1)(f)): our legitimate interest in understanding aggregate site usage, balanced against your privacy by Vercel's cookieless, non-identifying design.
3. Aggregate search analytics (Google Analytics 4)
We also use Google Analytics 4 in cookieless mode (client_storage: 'none'), which counts page views and navigation patterns without ever writing a cookie to your browser. Google Signals (cross-device tracking via your Google account) and ad personalization signals are both disabled. IP addresses are not stored. Data is aggregate-only and cannot be used to identify you.
Legal basis (GDPR Art. 6(1)(f)):our legitimate interest in understanding aggregate site usage, balanced against your privacy by GA4's cookieless, non-identifying configuration.
4. Session recording and heatmaps (Microsoft Clarity)
We use Microsoft Clarityto see how readers actually use our articles — how far down a page people scroll, what they click, and where they give up. It records a playback of the page as it was used, and it sets cookies in your browser to recognise a returning session.
Clarity masks the text you type, so anything you enter into a form is not recorded. We use it to decide where to improve articles, not to identify individuals — but unlike our other analytics, this data is at the level of a single session rather than an aggregate count. Microsoft processes this data as a separate controller under its own privacy statement.
How to prevent it: press Rejecton the banner, or simply ignore it — Clarity is never requested unless you accept. To change an earlier answer, use the button at the end of this page. Blocking third-party cookies or using a tracking blocker also works, and you can email us to have recorded sessions deleted.
Your current choice: not chosen yet — nothing that sets a cookie is running
5. Google Tag Manager
Google Tag Managerloads on every page. It is a delivery mechanism, not an analytics tool — it is how we switch tools like Clarity on and off without changing the site's code. Loading it means Google receives the request, including your IP address and browser type. It does not itself set advertising cookies or build a profile of you.
6. What we don't collect
- No advertising pixels, no Facebook Pixel, no cross-site profiling, and no selling or sharing of your data with advertisers. We do now set cookies for session recording (section 4) — before 2 September 2026 we set none at all.
- No fingerprinting beyond Vercel's anonymous daily-rotating ID.
- No selling of any data to anyone. Ever.
- No reading product purchases back from affiliate networks — we receive only aggregate, anonymous commission reports.
Who we share data with
We share the minimum required data with these processors. Each one acts only on our instructions and is bound by data processing agreements.
- Supabase (database + storage host) — stores your newsletter email and our content. Supabase is GDPR and CCPA compliant.
- Vercel (web host + analytics) — serves the site and records cookieless traffic counts.
- Google Analytics 4 (aggregate search analytics) — receives cookieless, IP-anonymized page-view counts. Google Signals and ad personalization are disabled, so the data cannot be used for advertising or cross-site profiling.
- Microsoft (Clarity — session recording and heatmaps) — receives a recording of how pages are used, plus your IP address, browser and approximate location. Microsoft acts as an independent controller for this data under its own privacy statement.
- Google (Tag Manager) — receives the request that loads the tag container, including your IP address and browser type.
- Resend (email delivery) — sends newsletter confirmations and editions. We share your email and the content of the email; nothing else.
Where your data lives
Our Supabase database is hosted in the European Union. Vercel and Resend operate globally with appropriate data transfer mechanisms (Standard Contractual Clauses) for EU/UK data.
How long we keep it
- Newsletter email: until you unsubscribe. After you unsubscribe, we keep your email on a suppression list (so we don't accidentally re-add you) but no longer send anything. You can request full deletion by emailing us.
- Session recordings (Clarity): Microsoft retains these for up to 30 days, then deletes them. Email us if you want yours removed sooner.
- Anonymous analytics: Vercel retains aggregated counts indefinitely; individual cookieless visitor IDs rotate daily and cannot be looked back up.
Your rights
Wherever you live, you can email hello@needskincare.com to:
- Ask what data we hold on you (access)
- Correct any inaccurate data (rectification)
- Have your data deleted (erasure / "right to be forgotten")
- Export your data in a portable format (portability)
- Object to processing or restrict it
- Withdraw consent for the newsletter at any time
We respond to verified requests within 30 days. EU/UK readers may also lodge a complaint with their national data protection authority. California readers have the same rights under CCPA / CPRA.
Children
NeedSkincare is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe we've received data from a child, email us and we'll delete it.
Security
All connections to the site use HTTPS. Database access is restricted by row-level security policies that prevent cross-account data access. Internal credentials are rotated regularly. No system is unbreakable, but we treat your data with the same care we'd want for our own.
Changes to this policy
If we change this policy in a material way, we'll update the "Last updated" date at the top and, where the change affects you directly (e.g. a new data processor), email subscribers ahead of the change. The current version always lives at this URL.
Contact
Privacy questions, data requests, or anything that isn't clear: hello@needskincare.com. See also our affiliate disclosure and about page.