Rally Radar
Privacy Notice
Rally Radar loads no third-party analytics, embeds no third-party tracking scripts, and shares nothing with advertisers. It sets a single first-party cookie and runs one small first-party script, both used for nothing but counting visitors accurately, and it can remember one preference if you ask it to. This page explains the little that is collected and why.
Who is responsible
Rally Radar is the controller for the data described here. You can reach us at contact@rallyradar.net with any question about this notice or about your data.
What is collected
To count how many people use the site each day, the server derives a short identifier from your IP address and browser user-agent string, combined with a random secret that is replaced every day.
Alongside that identifier, we store a coarse device class (desktop, mobile or tablet), a browser family, a flag marking automated traffic, and — where your browser sends one — the domain that referred you.
Your IP address and user-agent are used only as inputs to that calculation. Neither is written to our database, not even in shortened form.
The counting script
Most pages here are plain files, and serving a file tells us nothing about whether a person or a machine asked for it. So each page loads one small script of ours, count.js, whose entire job is to tell our own server that the page was opened.
It exists because automated crawlers fetch every link we post, usually within seconds, and they do not run scripts. Counting arrivals in the script rather than on the server is what keeps those machines out of the visitor numbers.
It is served from this site, sends nothing anywhere else, reads nothing from your device, and collects nothing beyond what is described above. If your browser blocks scripts, the page works exactly the same and the visit is simply not counted.
The counting cookie
Your browser is given one cookie, named rr_v. It holds a random number. It is not derived from you, your address or your device, and it expires after 30 days.
It exists because mobile networks reassign addresses constantly: the same phone can appear at three different addresses in the time it takes to read two pages, which made one person look like three visitors. The cookie lets the server see that those requests are one visit.
The cookie's value is never stored. What reaches our database is that number combined with the daily secret and then hashed, so the cookie can sit on your device for 30 days while the records it produces still cannot be linked from one day to the next.
It is set and read only by this site, never by anyone else, and it is not used for advertising, profiling, or any purpose besides counting.
Alongside it, and in the same form that expires with the daily secret, we record how many distinct network addresses a day's visits arrived from. That is a temporary measurement to find out how far the old address-based count overstated our audience, and it will be removed once we have the answer.
A remembered preference
The front page shows new visitors a short welcome card with a "Don't show again" button. Clicking it stores a single entry named rr_guide_dismissed in your browser's local storage, holding the fixed value 1. It is written only when you click that button, it is never sent to the server, it identifies nothing, and it is not combined with the counting described above. Clearing your site data removes it, and the only effect is that the card shows again.
Why it cannot be traced back to you
The daily secret is overwritten when the date changes. It is never archived, copied or logged. Once a day has passed, the identifiers generated during it cannot be recalculated by anyone — including us — because the secret that produced them no longer exists.
This means we can see that a certain number of people visited on a given day, but we cannot tell whether any of them had visited before, and we cannot connect a visit to a person.
The cookie does not change this. It gives your browser a steady identity for as long as it lasts, but because only its hashed form is ever stored, and that hash dies with each day's secret, it cannot be used to join one day's records to another's either.
Legal basis
We process this data under our legitimate interest in understanding aggregate audience size (Article 6(1)(f) GDPR).
Placing the cookie on your device is strictly limited to measuring that audience: it is set and read only by this site, it produces nothing but aggregate counts, it builds no profile, it is not combined with any other processing, and its results are shared with no one. On that basis we treat it as exempt audience measurement rather than asking for consent, which is why you are not shown a cookie banner.
If you would rather not be counted this way, send the Global Privacy Control signal — many privacy-focused browsers and extensions can, often labelled "Do Not Sell or Share My Personal Information". When we receive it (the Sec-GPC header), no cookie is set and nothing is stored on your device, apart from a preference you ask for yourself by clicking it (see "A remembered preference" above). You can also block or delete the cookie at any time; the site behaves exactly the same without it.
How long it is kept
The cookie expires 30 days after it is set. Daily visit records are deleted automatically after 13 months.
Who else is involved
The site runs on Render, our hosting provider. Like any web host, Render's server logs record IP addresses for operational and security purposes, under its own retention policy. This happens independently of anything described above.
Our Telegram channel and X account are ordinary external links. Nothing is embedded in this site, and neither service receives information about your visit unless you choose to follow those links.
Your rights, and an honest limit
Under the GDPR you have rights of access, rectification, erasure, restriction and objection, and you may lodge a complaint with a supervisory authority — in Finland, the Office of the Data Protection Ombudsman.
We have to be straightforward about one thing: because the data described above is irreversibly pseudonymised every day, we hold nothing that can identify you. If you write to us, we will not be able to locate, produce or delete "your" records, because we cannot tell which they are. Article 11 GDPR covers this situation — we are not required to collect extra information about you purely in order to be able to identify you, and we will not do so.
Changes
If this notice changes materially, the date at the top of the page changes with it.