Privacy policy

1. Controller

The controller under the GDPR and the revised Swiss FADP is the operator of brokaro.io. We will add the name and postal address together with the legal notice; until then you can reach us for every data-protection matter at:

Email: info@brokaro.ch

2. Principle

We process as little personal data as possible. This site works without a user account, without third-party tracking cookies, without advertising networks and without loading a single script from someone else's server. Our audience measurement also runs on our own server and without a cookie — which is why you see no consent banner here. Section 4 explains why we consider that lawful.

3. Server and logs

This site runs on a server of its own (see section 10). Our web server keeps no access log: the pages you open are not recorded together with your IP address.

Your IP address is necessarily transmitted when you open a page and is processed briefly in memory, for example for the rate limit against automated access (sections 4, 6, 7, 8 and 9). For the abuse protection of user reviews we additionally store a hash that we compute from it with a secret key (section 9). Technical error messages of the server, such as failed connection attempts, may contain an IP address.

• Purpose: technical operation, security and error analysis
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation)
• Retention: error messages at most 14 days, then deleted automatically

4. Audience measurement — first-party and cookieless

We want to know which pages get read. So we run our own measurement: on a page view your browser sends one small record to our own endpoint /api/track. It contains only the page requested and its language. No third-party script is loaded, no cookie is set, and no identifier is placed on your device.

Exactly the following is stored — nothing more:

The visitor hash. So that ten page views by one person are not counted as ten visits, we need something to tell readers apart within a single day. We build it as a SHA-256 hash of a random daily salt, your IP address and your user-agent string, and store only the first 20 characters. The daily salt is 32 random bytes, generated fresh for each calendar day (UTC) and kept only in the server's memory: it is never written to the database or to a backup copy, and it is discarded once the day is over. The following day an automatic deletion run removes the hash from all of the previous day's rows (see retention). This limits the ability to reproduce past identifiers. It does not by itself rule out linkability using additional information.

What is not stored: no IP address, no user-agent string, no record of the page you came from (referrer), no cookie, no fingerprint, no cross-site identifier, no dwell time, no mouse or scroll movement, and no search terms. IP address and user agent are used transiently in memory only — to compute the hash, to determine the device class, to rate-limit automated requests, and for a simple filter that drops known crawlers — and are then discarded.

• Purpose: audience measurement as a basis for editorial decisions
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data-minimal audience measurement). A daily hash can connect visits within a day and is conservatively treated as pseudonymous data; hashing alone does not guarantee anonymity.
• Recipients: none. The rows sit in our own database; they are not shared, not combined with other sources and not sold.
• Retention: the visitor hash is only needed for the day it is created. The following day an automatic deletion run removes it from all of the previous day's rows; all that remains of it is that day's number of visits. The other details of a row (path, language, device class, country, timestamp) are deleted automatically 13 months after the page view. After that only daily totals remain — the number of page views and of visits per day — with no link to individual page views. In the file-based variant of the store, at most the most recent 50,000 rows are kept as well.

Objection (opt-out). Two ways, both effective immediately and without an account:

1. 1Turn on "Do Not Track" in your browser. The measurement reads that setting in your browser (navigator.doNotTrack) and then sends nothing in the first place — no record is created that we would have to discard. We do not evaluate the DNT: 1 HTTP header server-side; mainstream browsers set both together, and where they diverge the browser setting decides. Many sites ignore this signal — we do not.
2. 2Set the switch on the privacy settings page. It stores the value bp-no-analytics in your browser; while it is set, nothing is sent.

Why there is no cookie banner for this. Consent is required under Art. 5(3) of the ePrivacy Directive — in Germany § 25 TDDDG, formerly TTDSG — when information is stored on your device or read from it that is not strictly necessary for the service you asked for. This measurement sets no cookie and places no identifier on your device. It is limited to what a simple page counter needs: on every page view your browser reports to our own server which page was opened in which language. It does not read any other property of your device — such as screen or window size, installed fonts or the page you came from. Before sending, it only checks whether you have turned on "Do Not Track" or objected on the privacy settings page; that check serves solely to honour your objection. We therefore do not consider consent necessary for this measurement. A banner asking for it anyway would only teach you to click "accept" without reading.

That is a statement about today, not a permanent guarantee: the moment we embedded a third-party tool — Google Analytics, a Meta pixel, an ad network or a hosted analytics script — the assessment would change. Such tools set identifiers and pass data to third parties; they need consent before they load. We would update this policy first and actually collect that consent.

5. Local browser storage

We use localStorage and two cookies for purely functional purposes:

The four local-storage values never leave your device — they are not sent to the server. The bp-locale and bp-country cookies are sent with every request because language routing and the country selection are decided on the server; they contain nothing but a language or country code and are not used to recognise you. When you follow a broker link, the chosen country code is stored with the click, so that we can analyse clicks by market and — where partner agreements that apply per country exist — attribute them correctly (see section 6). None of these values is used for profiling or for tracking across websites. As these are strictly necessary or user-initiated functions, no consent is required.

You can inspect all six entries, and clear them with one click, on the privacy settings page.

6. Clicks on links to providers

Every link to a broker on this site, whether labelled a direct link or a partner link, goes through an internal redirect (/go/...) that forwards you to the provider. For every such click we store: a click identifier, the broker clicked, where on the site the link sat, the language version, a country code, whether the click ran through a partner agreement (with our internal contract reference), the time, and only the hostname of the referring website. The country code is the country of residence you selected, otherwise the market the link belongs to, otherwise the code the hosting platform supplies. The click identifier is a random number; it is not derived from your IP address, your device or your browser. IP addresses, URL paths, query parameters and user-agent strings are not stored.

We do not count requests that identify themselves as search engines, link previews or other programs, browser prefetches, or bare HEAD requests. To tell them apart, the server reads the user agent in memory without storing it. So that the same click on the same day is not counted twice, the server forms a hash of IP address and user agent in memory, using the daily key described in section 4. That value is never stored and is gone when the day ends (UTC) or the server restarts.

Where a partner agreement only covers certain countries and we do not know your country of residence, we ask before redirecting you. We store your answer as the bp-country cookie (section 5). "Another country or rather not say" sets no cookie and takes you to the provider's regular website; only the click is then counted as described above. The question itself is not logged.

• Purpose: measuring reach; for partner links also reconciling payouts with the partner programme concerned. Whether any partner agreements currently exist is stated in the advertising disclosure.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reach measurement and in verifiable reconciliation with partner programmes)
• No personal profile: we do not store an IP address and build no user profile. Click counts do not prove registration or a commission entitlement; confirmed partner statements are authoritative for that.
• Retention: individual clicks are deleted after 18 months. What remains is the number of clicks per day, broker, placement, language version, country code and agreement, without click identifiers. 18 months cover the period in which partner programmes report or reverse account openings late. Where a partner has sent a report about a click, that click's identifier and details stay with the report for as long as the report is kept (see below). In the file-based variant of the store, only the most recent 20,000 clicks are kept in addition.

Partner links and reports from partners

Where the link does not run through a partner agreement, we append utm_source=brokaro, utm_medium=referral and utm_campaign with the placement to the destination URL, unless the link already carries its own parameters. Those parameters say nothing about you; we do not pass on the click identifier in this case.

Approved partner links are used unchanged so that required or signed tracking parameters remain valid. Where the partner agreement provides for it, we append exactly one further parameter: the click identifier, possibly together with placement, language version and country code. The partner receives it through your browser when it opens the partner's page. If you then open an account, the partner programme can use this identifier to tell us that the click led to a registration, a qualified account or another event defined in the agreement, and which commission is due for it, or was confirmed, reversed or paid. We receive these reports directly from the partner programme (postback) or as a statement file.

From them we store only: the partner programme, the partner's transaction reference, the click identifier, the type of event, its status, amount and currency, the times, the details of the matching click (broker, placement, language version, country code, agreement) and these fields as worded in the report, plus further fields the agreement provides for that say nothing about you, such as the partner's product or campaign identifier. We do not request names, email addresses, account numbers or other details about you; if a partner sends such fields anyway, we do not store them. This tells us which click led to a paid account opening, but not who you are. The partner knows you from your account opening; the identifier lets it match your account to a click on our site.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in verifiable reconciliation); for retention additionally the Swiss bookkeeping obligation under Art. 958f of the Code of Obligations.
• Retention: these reports are business records. We keep them for ten years after the end of the year of their last change and then delete them automatically. Technical receipt logs of the reports (time, result, names of the fields sent, no contents) are deleted after 90 days.

The broker you are forwarded to is independently responsible for its own processing and usually sets its own cookies. Please read its privacy policy.

7. Newsletter and price-change alerts

If you subscribe, we store your email address, the language version, the sign-up source (e.g. the site footer), the timestamp, a random token, and the confirmation and unsubscribe status. We do not store your IP address; it is used transiently for rate limiting only.

• Legal basis: Art. 6(1)(a) GDPR (consent)
• Process — genuine double opt-in: the address is stored unconfirmed first. You receive a single email with a confirmation link carrying a random token. Only when you open that link does the subscription take effect. Without confirmation you receive no newsletter — after the confirmation email, nothing further goes out to an unconfirmed address.
• The token: a random string that exists only in the email, is never shown on a page, and later also powers one-click unsubscribe.
• Unsubscribing: every email carries an unsubscribe link plus the List-Unsubscribe and List-Unsubscribe-Post headers per RFC 8058. Your mail client can therefore remove you with a single click — no confirmation step, no login. Withdrawal takes effect for the future.
• Unconfirmed sign-ups: if the confirmation link is not opened, an automatic deletion run removes the address 30 days after sign-up.
• After unsubscribing: the record is kept with the time of the unsubscribe so the address is not accidentally mailed again. On request we delete it entirely.
• Sending: emails go out over the operator's own SMTP server or SMTP service. No third-party newsletter tool that measures opens or clicks is involved. Mail is sent through the mailbox info@brokaro.ch at METANET AG, Josefstrasse 218, 8005 Zurich, Switzerland.

Price-change alerts. When you set up alerts for individual brokers on a broker page or on the price-change alert page, we store your email address, the brokers you chose, the language version, the times of sign-up and of confirmation (of the address and of each individual broker) and a random key. We do not store your IP address; it is used transiently for rate limiting only. Signing up for alerts does not sign you up for the newsletter, and vice versa.

• Purpose: a program fetches the providers' websites and the provider pages that our entries cite as sources. If this comparison detects a change and we have confirmed it, we send everyone who subscribed to that broker a short email with our summary and a link to the source. We use this information for nothing else.
• Legal basis: Art. 6(1)(a) GDPR (consent)
• Process — double opt-in: address and selection are stored unconfirmed first. The confirmation email leads to a page where you switch the alerts on with "Confirm alerts"; merely opening the link changes nothing. If you add brokers later, the same applies to the new ones. Until then we send no alert for those brokers.
• The key: a random string that appears only in our emails to you. With it you see, change or stop your alerts without an account. The management page does not pass it on to other pages as a referrer.
• Retention: an automatic deletion run removes unconfirmed sign-ups 30 days after the latest sign-up, and brokers added but not confirmed 30 days after the request. Confirmed data stays until you unsubscribe. To send a notice we create one delivery job per recipient (address and notice). It is deleted as soon as the email has been delivered or after the third failed attempt, at the latest after 30 days; only counts (recipients, delivered, failed) stay with the notice.
• Withdrawal and unsubscribing: every alert email contains a link to manage and unsubscribe plus the List-Unsubscribe and List-Unsubscribe-Post headers per RFC 8058. Unsubscribing deletes your address, your selection and open delivery jobs immediately and completely; we keep no suppression list for the alerts. Withdrawal takes effect for the future. Without the link, we delete on request to info@brokaro.ch.
• Sending: as with the newsletter, through the mailbox info@brokaro.ch at METANET AG, with no third-party tool. The emails contain no images and no tracking pixels, and their links carry no identifier — except the link to manage and unsubscribe, which has to contain your key. We do not measure opens or clicks.

8. Contact form

Messages from the contact form are stored and additionally emailed to the operator's inbox — stored because a message must not be lost to a mail outage.

• What is stored: the topic you chose (data error, accessibility, partnership, press, general), your name, your email address, the subject, the message text (including the broker and page URL if you supplied them), the language version, the timestamp, and a note of whether the notification email could be delivered.
• What is not stored: your IP address. It is used transiently for rate limiting only.
• Sending: the notification goes to the operator's inbox with your address as the reply-to. You receive an acknowledgement at the address you gave. If no SMTP access is configured, the message is stored only and flagged internally as undelivered — we do not pretend an email went out.
• Legal basis: Art. 6(1)(a) GDPR (your explicit, not pre-ticked consent when submitting) and Art. 6(1)(f) GDPR (legitimate interest in answering you).
• Use: solely to handle your request. Your address is not added to the newsletter and not shared.
• Retention: until your request is settled and no retention obligation stands in the way. An automatic deletion run removes the message stored in our database no later than 12 months after it was received. On request we delete a message earlier, at any time.

9. User reviews

When you submit a review we process the name you provide, optionally your country and how long you have used the broker, your overall rating and any sub-ratings, the headline and text, and the date of submission. If your text closely resembles that of another review, we note this on your review for moderation; the note is not published and is deleted with the review.

We do not store your IP address itself; in memory it is used briefly for rate limiting. To protect reviews against automated and repeated submissions, we store for each accepted review a hash that we compute from your IP address with a secret key (for IPv6, from its first 64 bits), together with the broker reviewed and the time. This record does not name the review, but it can be matched to it by broker and time. This way we accept at most three reviews per day and one per broker in 30 days from any one internet connection. When you mark a review as helpful, we likewise store a hash of IP address and review, together with the review you marked and the time; this way an internet connection counts only once per review in 30 days. The key is stored neither in the database nor in its backups. When it loads, the form fetches a signed time stamp that contains no information about you and is not stored.

• Legal basis: Art. 6(1)(a) GDPR (consent through submission)
• Legal basis of abuse protection: Art. 6(1)(f) GDPR (legitimate interest in protecting reviews and their helpful count against automated and repeated submissions)
• Publication: after moderation, with the name you provided, the date and — if provided — your country and usage period, together with the headline, text and ratings
• Note: use a pseudonym if you do not wish to be identifiable. Never include account numbers or other sensitive data in a review.
• Retention: published reviews are kept until you ask for deletion or we remove them; reviews not yet moderated until the decision. An automatic deletion run removes rejected reviews once 30 days have passed since submission.
• Retention of abuse protection data: an automatic deletion run deletes the hashes 30 days after they were created. When we delete a review, we delete the votes on it along with it; the submission record remains until its 30 days have passed, because it does not name the review.
• Deletion: on request, at any time

10. Hosting

The website runs on a server we rent from netcup GmbH, Emmy-Noether-Strasse 10, 76131 Karlsruhe, Germany; the server is located in a data centre in Nuremberg. We operate the server and its software ourselves. Email to and from info@brokaro.ch is handled by METANET AG, Josefstrasse 218, 8005 Zurich, Switzerland.

Your data is therefore processed in Germany and Switzerland. It is not transferred to any country outside the EU, the EEA and Switzerland.

Backups: the database is backed up once a day on the same server. The backup copies are accessible to the operator only and are deleted automatically no later than 16 days after they were made. Whatever we delete from the database — on request or through the deletion runs described above — is therefore also gone from the backups after that period at the latest. Only the database is backed up: the key of the abuse protection (section 9) is kept outside it and is contained in no backup.

11. Fonts

Fonts are served from our own server. No connection is made to Google Fonts or any other external font service.

12. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You may withdraw consent at any time with future effect.

One honest note about audience measurement: from what we store we cannot attribute those rows to a person — we keep neither your IP address nor your user-agent string, the daily salt exists only in memory and is discarded once the day is over, and from the following day the rows no longer carry the visitor hash either. Access or targeted deletion would require additional information from you that makes attribution possible; if you can supply it, we will act on your request. We are expressly not claiming those rows are anonymous — section 4 treats them conservatively as pseudonymous data. Independently of that, the objection described in section 4 takes effect immediately and prevents future records.

You also have the right to complain to a supervisory authority.

13. Changes

We update this policy when our processing changes. The version published here is authoritative.