Last updated: 2026-10-22
Who controls your data
The data controller is Rob Montgomery. Contact: rob@thirdrail.blog. Address: 123 North Main St.
Rochester, NH 03867.
Information we process
When you submit a comment, we process your display name, email address, comment, reply relationship, verification status, and timestamps. We use an email link to verify your address before moderation.
For security and audience measurement, the site records article-view timestamps and a daily pseudonymous browser/network hash. The hash is designed not to store your raw IP address in the blog database. DreamHost may separately process server logs.
Your privacy choices are stored in your browser. If you allow optional advertising or external media, Google and YouTube may process device identifiers, IP addresses, usage information, and cookies or similar storage under their own policies.
Administrators provide account information. Article text is sent to OpenAI only when an administrator requests keyword generation; visitor comments and email addresses are not sent for keyword generation.
Purposes and legal bases
We process comment information to verify submissions, prevent abuse, moderate discussion, notify commenters, and publish approved comments. Depending on the circumstances, the legal basis is our legitimate interest in operating and protecting the discussion service or steps requested by you. Optional advertising and external media are activated only after your consent. We may also process data where required by law.
Sharing and international transfers
Service providers may process data on our behalf, including DreamHost for hosting and the configured email provider for transactional messages. Google, YouTube, and OpenAI may process data internationally under their own legal mechanisms. Optional Google and YouTube resources are not loaded until the relevant choice is enabled.
Retention
Unverified comments are removed after approximately 48 hours. Pending or rejected comments are removed after approximately 30 days. Email addresses associated with approved comments are removed after 365 days, while the public display name and comment may remain for the integrity of the discussion. Pseudonymous view records are removed after approximately 90 days. Other records may be kept where reasonably necessary for security, legal obligations, or dispute resolution.
Your rights
Depending on applicable law, you may request access, rectification, erasure, restriction, objection, or portability of your personal data. Submit a verified request through our Privacy Request form. We normally respond without undue delay and within one month. We may request further identity information where necessary and may retain information when the law permits or requires it.
You may withdraw optional advertising and external-media consent at any time using “Privacy choices” in the footer. Withdrawal does not affect earlier lawful processing. You may also complain to the data-protection authority in your country.
Security
We use access controls, email verification, encrypted secrets, data minimisation, and retention controls. No online service can guarantee absolute security.
Changes
We may update this notice to reflect changes in the site or law. The current version and date appear on this page.
Form submission source IP addresses
When you submit a comment, contact message, or privacy request, we store the source IP address observed by our web server. We use it to investigate abuse, spam, fraud, and security incidents and to maintain the integrity of submissions. The IP address remains attached to the submission for the lifetime of that record and is deleted when the associated record is deleted. It may therefore remain with an approved public comment for as long as that comment is retained, although it is never displayed publicly with the comment.
Email subscriptions and article alerts
If you join the mailing list, we process your email address, subscription and confirmation status, subscription and unsubscription timestamps, article-delivery status, and clicks on tracked article links. We use this information to operate the double-opt-in mailing list, deliver requested article alerts, measure whether article links are useful, prevent duplicate mailings, and honor unsubscribe requests. Each article email contains an unsubscribe link. Subscription lifecycle events are retained for approximately three years, and click records for approximately two years, unless they must be kept longer for legal or security reasons or you exercise an applicable data-protection right.