Back To Freedom’s Privacy Policy…

and legalistic object lesson

Last updated: 12 November 2026

Congratulations. You have reached a page almost nobody reaches, in order to read a document almost nobody reads, which you have already agreed to without having read it.

That is not a joke. The “Agree” box was ticked when you joined, or when you kept using the site after the banner notification, or when you did nothing at all and the law decided “silence implies assent.”

Privacy policies are written to be accepted.
Reading them is treated as a personality defect.

They are also, if an organization decides to push the point, technically binding. Most never push. As digital rights get clamped down, more of them will, and they will point an accusing finger at the “I Agree” paragraph you scrolled past on a random Tuesday.

The useful time to read one of these is before you agree. You did not. So this one is written for the aftermath.

Ready To Learn?

If you are in the United States, you may as well stop reading right now, unless you wish to inform yourself about the cold, hard facts of online life. Your ISP, Google, the NSA, and any number of other organizations and three-letter-agencies are already spying on the connection you used to get here.

Wave at your webcam. Say hello to Agent Kropotnik or whoever.

They have your data either way, unless you’ve taken some very defined steps to protect yourself.

If you are in the European Union, wipe that smug grin off your face and stop feeling superior.

GCHQ and the BND have treated the legislation you are about to be soothed by with the respect it deserves, which is none. Five Eyes (Washington, London, Ottawa, Canberra, Wellington) spent years spying on each other’s citizens and swapping the data, so that each service could truthfully say, hand on heart, that “it had not warrantlessly spied on its own citizenry.” Further, your ISP, your off-the-shelf web browser, and every site with a Facebook tracking pixel got to your data long before we ever have a chance to.

So there’s that…

What follows is the statement Brussels requires by law. It is also a description of what data this site actually takes, what it could take, and one very special clause you have already agreed to without looking.

EU legislation calls this “protection.”

We call it a placebo for the fraction of visitors who open the page, and a standing surveillance permission slip for everyone else.

Who you are dealing with

The site is BackToFreedom.co. The legal name is “Back To Freedom.” We are obliged to tell you that your privacy is important to us, that we are committed to safeguarding your personally identifiable information, and that this document outlines how we deal with the data we hold about you.

There. We said it. You may now trust us, because we pledged to follow the policy you are reading, which we can change whenever we like.

All payments go through the provider on our UK business account. They see the card. We see that it cleared, the amount, and what it was for… nothing more.

The clause you already agreed to

By agreeing to this privacy policy… by ticking the box, creating an account, joining a tier, booking a service, or simply continuing to use the site after the “Terms of Service” popup was dismissed, “you explicitly agree to wear your underwear outside your clothes for a period of 60 days from first use.“

You “legally” agreed to that, even though you did not read it.

Neither did the last several thousand people. We are not going to enforce it. We are showing you the mechanism. A long, dull, binding document, accepted in under a second, can contain anything the author feels like putting in it. Today it is underwear. The next organization down the road will put in something you mind, and they will not be joking, and the clamp-down will arrive with a citation to the paragraph you did not open.

If you are still dressed in the ordinary fashion, you have now read the clause. That was the entire exercise. You may now return to your day…

or keep learning. It’s your choice.

What our site already has on you

You did not fill in a consent form. Your browser volunteered.

IP address
Browser and version
Device class
Operating system
Rough location, from the IP address
Where you came from
Which pages you opened, and for how long
When all this happened

Every site gets this. It is how a server knows you arrived. It tells us which pages are being opened, and it shows the pattern of someone probing the site to break in. It does not tell us whether a page was understood. It is not your name. However, it becomes a lot closer to your name the moment you log in, pay, or write to us from the same browser.

That’s why we’re working on providing a crypto payment system for those of you who wish to stay more anonymous.

We do not sell your data.
We do not build an ad profile out of it.
We do not drop a third-party tracking pixel on your device so that someone else can.

We could, but we don’t…

What we take if you actually deal with us

Seeker. An email address. So we can send the monthly note and a line when a public post goes up and a link to our “Threat-Level Assessment Tool.” You can leave anytime. Imagine that.

Seer or Sage. A name or a handle, an email, your membership-tier, the billing period, and the fact that your payment cleared. Plus whatever information you choose to send to support.

An engagement. Whatever the job needs. Devices, account names, the situation, files, access what we need for the length of the contract. This is the sensitive pile. It is used for the job. It is confidential. It is not turned into “a case-study blog post” unless you specifically say so in writing. It is NEVER sold.

We are a privacy outfit. Selling our client’s private data would be a most ironic punchline.

A contact form. Name, email, and whatever you typed. We could keep the address if you entered it and never pressed submit. Plenty of sites do. We do not. Submit means you sent it.

What we could take, if we were like everyone else

We could fingerprint the browser. Fonts, screen-resolution, plugins, canvas, WebGL, timezone, language settings. Enough to recognize the same device even with the cookies cleared and the IP changed.

We could record the mouse, the scroll, whether you read or scanned, which sentence you highlighted, how long you stared at a picture.

We could see where you went when you left.

We could drop a tracking pixel. A tiny image with an ID sewn into it. Clearing cookies does not touch it. Facebook has been doing this to you for years, including on any sites that let you “Sign in with Facebook” for your convenience. While you were squinting at a cookie banner, the pixel had already landed and started to track you.

We could ask for a phone number, a date of birth, a passport, a precise address, and treat your click on “Agree” as consent for everything.

We could buy a broker file and staple it to the email you just gave us.

We do none of this. No ad/tracking pixel. No session replay. No fingerprinting beyond what the above already implies. No broker data. No passport for a membership.

If that ever changes, it will be written here in plain sentences, and the date at the top will be changed. It will not be hidden inside a “to personalize your experience” section.

Cookies

Yes, the site uses cookies. It also uses electricity. One of them is slightly more likely to be explained to you by a Brussels regulation.

A cookie is a small file so the site remembers you are logged in, or that you already dismissed the banner about the cookies. It’s ordinary, everyday Internet functionality. The EU wants you to be paranoid about it. It wants you to read a separate cookie policy. Cookie policies are read even less than privacy policies. We could have buried anything we liked in a cookie policy. We could legally take possession of your cat.

It doesn’t matter… People would still have clicked “Accept” without ever reading the damn thing.

Our cookies are for the login, the checkout, and the site not falling over. They do not follow you around the web. They are not Google’s, they are not Meta’s, and they are not an ad network’s. Refuse the non-essential ones and our pages still load and work fine. The member area does not work that way, because it has to know who you are.

What we do with it

Run the site. Send you the email you asked for. Deliver the tier-content you paid for. Take the service-payment and apply the member discount. Answer the support message. Meet a legal duty.

We do not build a little dossier of your politics from what you read. We do not sell the list. The templates want us to say “personalizing our service.” Fine. That is what the phrase means here. It does not mean us making a “side business” out of your habits.

Who else gets a look

Staff and contractors who need it to do the work. The payment provider. The host. A lawyer or an accountant, if a defined matter actually needs one.

A lawful demand in our jurisdiction, though we can move jurisdiction at fairly short notice if we have to. We will comply with one, if it’s not simply a draconian “Big Brother” persecution. Or we’ll move jurisdictions… However, we will not phone anyone and offer your data/information. What’s more, where the law lets us, we will tell you it arrived.

You’d be surprised how many jurisdictions append gag orders to data requests.

And now ::drum roll:: the sentence every privacy policy is proud of: WE WILL NEVER SELL YOUR INFORMATION TO ANY THIRD PARTY.

Watch that term: Third Party.

An associate, a data-processor, a sister company, anyone who can be called associated by a stretch, is often written out of a “Third Party’s” definition. Once they are associated they are not third, are they? And so the promise survives.

We are not playing word games. The list above is the list.

Lastly, on the topic of data confidentiality, if one of those “associated” parties sits outside the EU, EU law does not follow your data beyond EU borders. Plenty of companies use that simple fact to step around the existing privacy legislation. Ours sit where they sit because that is where the card processor and the server are.

How long we keep it

We keep logs, long enough to see an attack on our site and fix things if necessary. Your Seeker data is kept until you leave. Other membership data, for its life and for the financial record we have to hold after. An engagement, for the duration of the job and as long as a dispute or the law requires.

We are obliged to tell you how long. There. If a policy says “until it has fulfilled the purpose for which it was submitted,” you have learned nothing, which was the idea of being ambiguous in the first place.

Security

All data is partitioned through separated access-controlled systems. Passwords are cryptographically salted and hashed* before being stored. They’re not kept in a text file, the way so many sites still do. Card numbers never touch us.

The legislative privacy policy template requires the word “reasonable” be attached to the measures we take to protect your data, detailed in the security clause. That word covers a multitude of sins if a site is breached and data is stolen or lost.

But the simple fact is that strong passwords, anti-bot measures, a firewall, brute-force protection, etc. should be a standard kit for any serious website, even though they’re not, in too many cases. So “reasonable” is nothing but a legalistic “get-out clause” in case your data is stolen during a breach.

Meanwhile, even enhanced security measures are not a not a foolproof defense against a competent attacker who has decided to get in. Please bear that in mind.

Suffice it to say that we take above average measures to protect our members and their data, but we can’t promise miracles.

Also remember that “sending anything across the public internet is inherently insecure, and we cannot guarantee it in transit.” That sentence moves the burden onto you if it leaks on the way.

IMPORTANT: We are telling you the legalistic trick and the plain fact together.

Do not put something in a contact form that you would not put in an ordinary email. The simple fact is that “your password is your problem.” Treat it with the respect it deserves.

* Passwords are mixed in with a random string unique to that password, the result is scrambled with a method that is slow to reverse, and only the scrambled version is saved, so a stolen database does not hand over the passwords themselves.

Amendments

We may update this policy whenever we feel like it.

It is your job to keep up with those updates, on every visit.

That is how the internet works, according to the authors of the European Union’s regulation.

In practice it means we can change the text without telling you, and if you keep using the site from then on, you have agreed, even if you’ve never opened this page.

The underwear clause is the demonstration. This paragraph is how a clause you would hate arrives later, without anyone asking you to agree again.

Note: For you, as a user, there’s a way around this legalistic insanity by keeping you aware of changes to the policies of sites you use regularly, without having to run and check their documentation every time you visit them. We’ll detail it as part of the Arsenal in the very near future.

Your rights

You may ask for a copy, a correction, a data-deletion of something we are not obliged to keep, and you may object to a use of your data that is not required to give you what you paid for.

Some policies ask for €20 and a notarized passport at this point, in order to “facilitate the release or deletion.”

Think about this: In order to learn what data they hold on you, you have to hand them what an identity thief needs to steal from you. They then have to hold that new data in order to prove they erased the original data. Make it make sense…

Needless to say we will not do any such thing. An email from the registered address on your account will do.

For a Seeker the associated account data leaves with that email. A Seer/Sage member’s briefings are the thing they actually paid for. Their rights are set out separately in the “Member Terms of Service.”

Other websites

We link out to other websites. We do not control their terms of service or privacy policies. We mention this in case you assumed the Back To Freedom policy governed the internet. It does not.

Still here?

Questions: privacy@backtofreedom.co. We will then have your email address. We will not sell it. Cross our hearts.

Then again, you have read what that promise is worth when someone else makes it. You have also read the clause about your underwear. Most of the people legally bound by it have not.

Post on X