Effective date: 18 October 2026
RSQ (Republic Square) is an independent investigative publication run by Dinidu de Alwis, based in Sri Lanka. In privacy language, he is the data controller — the person responsible for the data described here. If anything on this page is unclear, or you want to exercise any of the rights further down, write to publishing@dinidu.org and RSQ will respond within two working days (48 hours).
Each item below is something RSQ actually stores. For every one, RSQ explains what it is and the reason it exists. If a reason isn’t listed, RSQ doesn’t use the data for it.
What: When you sign in with Google, Apple, GitHub, Microsoft, or X, RSQ receives your verified email address, your chosen display name, and an account ID issued by that provider. If you sign in with a work email instead, RSQ stores that email address and sends you a single-use link to prove it’s yours. RSQ also stores your subscription state: whether it is active, which plan you hold, any expiry date, whether you may gift without a per-article limit, and — for card payments — the Paddle customer reference that links your account to that payment.
Why: To recognise you when you return, manage access to subscriber-only reporting, enforce your free-read allowance across linked accounts and devices, honour your gifting allowance, and email you about your account.
No passwords: RSQ doesn’t create, ask for, or store passwords. Signing in is handled by the provider you choose, or by a one-time link — so there’s no RSQ password that can leak. For email-link sign-in, the address you type is held in your own browser until you complete sign-in, then removed.
What: To recognise returning browsers without installing software, your browser combines several characteristics — your browser’s user-agent and platform strings, its language setting, screen size and colour depth, the timezone offset, and how a standard piece of text renders — and hashes them into a token. The token is saved in your browser’s local storage and registered against your account. Server-only records link recognised tokens, account identifiers, and a shared free-read allowance. Raw canvas images and the combined input used to generate the token are not stored in these linkage records.
Why: To count subscription devices and prevent repeated free allowances through multiple accounts. The code sits in your browser and is stored on your account. A server-only record links recognised devices and accounts to a shared free-read allowance. Creating another account on a recognised device does not reset that allowance; an account carries its shared usage to other devices it uses. RSQ stores no device name or page-view history against the token.
What a match means: A matching token is treated as suspected repeat use, not proof that two accounts belong to the same person. RSQ automatically applies the shared free-read allowance; it does not automatically ban an account or cancel a paid subscription because of a match. Linked account identities are not shown to other readers. RSQ does not use these tokens for advertising or to track activity on other websites.
If a link is wrong: Email the privacy contact below to request a review or correction. Browser fingerprints can change or match incorrectly; they do not establish a person’s identity.
What: The free tier provides five initial reads, then up to three reads in a rolling 30-day window. Recognised accounts and devices share this allowance. Creating another account with a different email address does not restart it. Existing usage is retained when accounts are linked, and usage follows a linked account onto additional recognised devices. RSQ stores remaining allowance, rolling-read timestamps, and account/device links to enforce this rule. Paid subscribers do not consume this allowance. When you unlock a report with a free read, RSQ records that piece against your account along with the date you unlocked it, and it stays unlocked for that account while the account is retained. Linking accounts does not copy those article unlocks to another account.
Why: To grant and enforce the free-read allowance, and to keep a report you unlocked available to you. This is a list of the pieces you chose to unlock — it is not a log of everything you open, and it is not a record of how long you read.
What: If you use the notification-preferences page, RSQ stores your on/off choice for each periodical — The Distillate, the bulletins, the weeklies, and the rest — the email address those choices apply to, and the time you last changed them.
Why: To send you exactly the newsletters you have asked for and to stop the ones you have switched off. You can change any choice at any time.
What: There are three ways to pay, and in none of them does RSQ see or store your card or bank credentials:
Why: to know whether your paid access should be switched on, and to keep the accounting records the law requires.
Each payment provider handles your data under its own privacy policy — see the Paddle Privacy Policy and, for payment requests, Payoneer’s published privacy policy. RSQ holds only the minimum needed to match a payment to your account.
What: Holding a reader account puts your email address on the newsletter recipient list, which is held in RSQ’s own self-hosted infrastructure together with your periodical choices. For each edition, RSQ keeps a delivery record confirming who received it; that record stores a per-day salted fingerprint of each address rather than the address itself (see the next section). When you first sign up, your email and display name are held briefly to send the welcome email, after which the name is discarded and the sign-up record is reduced to an opaque delivery marker.
Why: To send the newsletter, to format it the way you like (light or dark), to stop sending anything you have switched off, and to keep an honest record that a given edition reached a given address without holding the address in that log.
What: If you gift an article to someone, RSQ stores the email address you enter (up to three people per article), which article it was, and which account shared it.
Why: To let that person open the article you shared, and nothing more.
RSQ has built the platform so that this information isn’t gathered in the first place. The site’s one performance-timing code path is switched off unless RSQ deliberately turns it on: when on, it beacons a page’s path and its load-timing numbers to RSQ’s own endpoint, carries no account identifier, and is not used to follow anyone. It is off today.
A hash converts input data into a fixed code. RSQ uses it to compare device tokens and delivery records without storing the original input in those records. Hashing reduces exposure; it does not make every record anonymous or make a database harmless if stolen.
Device tokens: The browser uses SHA-256 and retains a shortened token. This token is not salted. Because RSQ links it to account identifiers, RSQ treats the token and those links as personal data. Hashes are designed to be one-way, but matching or guessing inputs can still reveal connections.
Delivery records: These use a separate process with a secret value and the edition date to generate an address fingerprint. They do not store the recipient’s email address in that fingerprint field. RSQ still holds real email addresses where needed to operate accounts and send mail.
Wherever you live, you can ask RSQ to:
Email publishing@dinidu.org to do any of these. RSQ answers within 48 hours, and doesn’t charge you for it.
If you are in the EU or the UK, data protection law applies to RSQ. Here is how RSQ meets it, in plain terms:
You also have the right to complain to your national data protection authority. RSQ would rather you came to RSQ first, but the choice is always yours.
RSQ is based in Sri Lanka and complies with the Personal Data Protection Act, No. 9 of 2022 (PDPA). The Act sets out principles that, refreshingly, line up with how RSQ already works:
Under the PDPA you can access, correct, or delete your data, and withdraw consent — the same rights listed above. The same email address reaches RSQ’s privacy desk, and the same 48-hour clock applies. If you are ever unsatisfied with RSQ’s response, you may raise it with Sri Lanka’s Data Protection Authority.
Your account, subscription status, device tokens, account/device links, shared free-read allowance and unlock records, email preferences, gift links, and reader-notification records are held in Google Cloud Platform / Firebase, with the Firestore database in Asia-South (Mumbai) and the free-read cloud functions in the United States (us-central1). Authentication and other managed services may process data in other locations. The newsletter recipient list, delivery records, and RSQ’s editorial content are also processed in RSQ’s own self-hosted infrastructure — a self-hosted database operated by RSQ in Sri Lanka.
When data moves between countries, RSQ protects it with appropriate safeguards, including encryption in transit.
If your local law gives you stronger rights than those described here — for example, California’s right to know, delete, and opt out of the sale of personal information — RSQ honours them. In practice, the “opt out of sale” right is moot: RSQ doesn’t sell personal information, and never has.
© 2026 Republic Square. Some rights reserved. Republic Square does not operate under a blanket “all rights reserved” notice. Some uses of this publication’s reporting, text, data, and imagery are permitted, and some are reserved. The precise terms — what you may quote, reuse, republish, or build upon, and the conditions attached — are being finalised and will be published here.
Until then, please contact the publisher at publishing@dinidu.org for details of permitted use and licensing. Rights details to be added
If RSQ changes how it handles your data, RSQ will update this page and the effective date at the top. RSQ won’t quietly widen what it collects.