Privacy policy
This site has no accounts, no sign-up, no cookies and no advertising. This policy explains the little data that does get processed, why, and what you can require of us.
1. Who is responsible
The controller of any personal data processed through this site is:
| Operator | C. Kerger |
|---|---|
| Trading as | XAU Ticker |
| Address | 1691 Oakdale Ave, San Francisco, CA, 94124, United States |
| Phone | (415) 647-8134 |
| info@xauticker.com |
We have not appointed a data protection officer, as we are not required to under GDPR art. 37.
2. What we process
Server logs
Our web server records each request: IP address, timestamp, the URL requested, HTTP status, referrer and user-agent string. This is standard web-server logging and we use it only to keep the service running and secure — diagnosing errors, spotting abuse and measuring load.
- Legal basis: legitimate interests (GDPR art. 6(1)(f)) — operating and securing the service.
- Retention: logs are rotated and deleted after 30 days.
- Recipients: nobody. Logs are not shared, sold or used for profiling.
Your settings, stored in your own browser
Your language, city, price alerts and calculator inputs are saved with
localStorage under the key aurum.v1. This is not a cookie
and it is never transmitted to us — it stays on your device, and we cannot read it. Clearing
your browser storage deletes it permanently.
Because it never leaves your device, this is not a disclosure of personal data to us and no legal basis is required for it. It is described here for completeness.
Browser notifications
If you create a price alert, your browser may ask permission to show notifications. That permission is granted to your browser, not to us; alerts are evaluated locally in the page. We do not operate a push server and we hold no device tokens. You can withdraw the permission in your browser settings at any time.
Market data requests
Price data is fetched by our server from our upstream sources and cached, then served to you from our own domain. Your browser therefore never contacts a market-data provider, and those providers never see your IP address. This is a deliberate design choice.
3. Third parties that can see you
Google Fonts
Our pages load typefaces from fonts.googleapis.com and
fonts.gstatic.com. To serve a font, Google necessarily receives your IP address
and user-agent. Google states that it does not use these requests to build advertising
profiles, but the request itself is a transfer of personal data to Google, including to
servers outside the EEA.
- Legal basis: legitimate interests (art. 6(1)(f)) — consistent presentation of the service.
- Transfers: to the United States, under the EU–US Data Privacy Framework and Google's standard contractual clauses.
- Avoiding it: a content blocker that blocks Google Fonts will make the site fall back to your system typefaces with no loss of function.
Our hosting provider
The site runs on a server operated on our behalf by a hosting provider acting as a processor under GDPR art. 28. It processes the connection data described above only to host the site.
Analytics
This site uses Ahrefs Web Analytics for aggregate audience measurement. The script is loaded from analytics.ahrefs.com on every page. It sets no cookies and reads nothing from your device; it reports which page was viewed and which page referred you. Serving the script necessarily discloses your IP address and user-agent to Ahrefs, as any request to a third-party host does. The legal basis is our legitimate interest (art. 6(1)(f)) in knowing which pages are read. A content blocker that blocks it costs you nothing on this site.
We will not deploy an analytics tool that sets cookies or fingerprints visitors without first asking your consent through a proper consent banner, as the GDPR and the ePrivacy Directive require for visitors in the EU and UK.
4. Cookies
This site sets no cookies at all — not analytics cookies, not advertising cookies, not "essential" ones. There is consequently no cookie banner, because there is nothing to consent to. If that ever changes, this section will be updated before the change goes live and consent will be requested where the law requires it.
5. What we deliberately do not do
- We do not ask for or store your name, email or phone number, unless you write to us.
- We have no user accounts and no login.
- We do not sell, rent or share data with data brokers or advertisers.
- We do not profile you or take automated decisions about you (art. 22).
- We do not track you across other websites.
6. If you write to us
If you email us, we process your address and whatever you put in the message, in order to reply. The legal basis is our legitimate interest in answering correspondence (art. 6(1)(f)), or taking steps at your request before entering into a contract (art. 6(1)(b)) where relevant. We keep correspondence for as long as needed to deal with the matter and up to 12 months afterwards, then delete it.
7. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you (art. 15).
- Rectify data that is inaccurate or incomplete (art. 16).
- Erasure of your data (art. 17).
- Restrict processing in certain circumstances (art. 18).
- Data portability for data you provided (art. 20).
- Object to processing based on legitimate interests (art. 21).
- Withdraw consent at any time, where processing relies on consent (art. 7(3)).
To exercise any of these, email info@xauticker.com. We will respond within one month, as art. 12(3) requires. In practice, note that because we hold almost nothing about you, an access request will usually return only server log entries, and only if you can identify the relevant IP address and timeframe.
8. California residents (CCPA / CPRA)
If you live in California you have the right to know what personal information is collected about you, to request its deletion or correction, and to opt out of its sale or sharing. In practice there is very little to exercise these against:
- The only personal information we hold is the server-log data described in section 2.
- We do not and will not sell or share your personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. There is therefore no "Do Not Sell or Share My Personal Information" mechanism to offer.
- We do not use personal information for cross-context behavioural advertising.
- We will not discriminate against you for exercising any of these rights.
To make a request, email info@xauticker.com with "PRIVACY" in the subject line. We will respond within 45 days as the CCPA requires. Because we hold no account or identifier for you, we may only be able to act on a request where you can identify the relevant IP address and timeframe.
9. Complaints
If you think we have handled your data unlawfully you may complain to the California Privacy Protection Agency at https://cppa.ca.gov. If you are in the EU or the UK you may instead lodge a complaint with the data protection supervisory authority in your country of residence, which is usually the better route for you. We would appreciate the chance to address it first.
10. Children
This site is a general-audience information service and is not directed at children. We do not knowingly collect data from anyone under 13 (COPPA), nor from anyone under 16 in the EU without the consent of a parent or guardian.
11. Changes to this policy
We will update this page when our processing changes, and the "last updated" date above will change with it. Material changes — a new analytics tool, advertising, anything that sets a cookie — will be announced on the site before they take effect, not after.
See also the terms of use and the risk disclaimer.