Template — have a lawyer review
This is a proposed notice dated October 14, 2026. The owner must verify the live site's data flows, suppliers, retention periods, international transfers, and controls before publication. Planned safeguards below are requirements to implement and test, not a certification that they already operate. This notice covers Pocket Plain's US and Brazilian editions.
Controller and privacy contact
Thiago Costa is the data controller. Send privacy questions and rights requests to contact@pocketplain.com. This is also the LGPD DPO/encarregado communication channel. A separate certified DPO, local representative, or office address is not asserted by this template; the owner and counsel must determine any required designation and additional contact details.
Information and purposes
Depending on the enabled features, processing may include:
- Contact correspondence: email address, message, and information you voluntarily include, to answer questions, investigate corrections, and handle rights requests. Avoid sending passwords, account numbers, tax returns, or identity documents without a justified secure process.
- Service and security records: IP address, request time, browser or device information, requested URL, and error records handled by hosting, delivery, or security suppliers, to deliver pages and prevent abuse.
- Preferences: edition selection and cookie or privacy choices, including a consent record in browser localStorage where implemented. LocalStorage is browser storage even though it is not a cookie.
- Optional subscriptions and measurement: email and signup details for a newsletter only if signup is enabled; usage and advertising identifiers only if the related services are enabled with the required legal basis.
The controller should use only necessary information. Under GDPR or LGPD where applicable, the basis may be consent for optional tracking or newsletters, documented legitimate interests for proportionate security and correspondence, steps connected with a requested service where appropriate, or a legal obligation. These bases must be checked against the actual purpose; consent is not a blanket basis for all processing.
Cookies, consent, and external media
The intended cookie controls offer Accept, Reject, and Configure, with optional analytics and advertising off until the required permission exists. Rejecting optional storage should leave ordinary editorial reading available. A persistent “Cookie settings” control should let you change your choice. Necessary security or preference storage must be described accurately.
A stored preference alone does not block trackers: the integration must enforce it before loading optional scripts. YouTube videos should load only after a deliberate action and any required consent. Loading a video or following an external link may send information to that service under its own terms.
TradingView market widgets (optional external content)
The ticker and Markets snapshot use free TradingView embeds. TradingView's widget FAQ states that its widgets do not set cookies, but receive the embedding page URL, widget type, displayed symbols, and your IP address to deliver market data and protect the service. See TradingView's privacy policy for its processing and international transfers. Following a TradingView link opens that external service under its own privacy and cookie practices.
Pocket Plain nevertheless treats these embeds as optional. No TradingView script, iframe, or preconnection loads until you either grant Analytics consent or click Load market data from TradingView on that widget. A click permits only that widget on the current page; it does not enable GA4, advertising, or other embeds, and is not saved as a general cookie choice. GPC prevents automatic loading, even with analytics enabled; you can still deliberately request a widget with its load button. After permission, the embed waits until it is near the viewport and the browser has idle time.
Rejecting or withdrawing analytics consent, using Do Not Sell or Share, or clearing privacy preferences removes active embeds and cancels pending loads. A subsequent click can request the widget again. Removal cannot undo data already sent to TradingView. Editorial reading and the separately sourced, server-fetched indicators remain available without loading TradingView. Those indicators show their source and observation time; browser requests to their data providers are not needed to display them.
Google Analytics 4 (optional analytics)
Both Pocket Plain editions use Google Analytics 4 (GA4) to understand page views, sessions, and how readers use the site. The Google tag loads only after you grant Analytics consent in the cookie controls; before consent, no GA4 tag or GA4 measurement request is sent. Google's Consent Mode v2 starts with analytics storage, advertising storage, advertising user data, and advertising personalization denied. Granting analytics enables analytics storage only; Google signals and advertising personalization are disabled in this integration.
With your consent, Google may receive page URLs and titles, referring URLs, usage events, browser and device information, approximate location, and cookie identifiers. Requests to Google include your IP address; Google states that GA4 does not log or store individual IP addresses. GA4 uses first-party _ga and _ga_<container-id> cookies to distinguish visitors and maintain session state. Their default lifetime is two years, subject to browser limits and the property's cookie settings; cookie lifetime is separate from Google's server-side data retention. See Google's GA4 cookie documentation, how Google safeguards Analytics data, and Google's privacy policy. Google may process data outside your country; the owner must verify the applicable transfer safeguards and property retention settings.
Global Privacy Control (GPC) keeps analytics off by default, including when an earlier analytics choice was made without GPC. You can explicitly enable analytics through Configure while GPC is active; advertising remains disabled. Your analytics choice is stored in localStorage and shared between editions and other open tabs on the same origin. If browser storage is blocked, the choice works for the current page but may not persist.
Use Cookie settings to withdraw analytics consent at any time. Revocation disables further GA4 measurement and attempts to delete accessible _ga cookies; browser restrictions can prevent deletion of some cookies. It does not undo data already sent to Google. Rejecting analytics does not prevent reading the site.
Google AdSense and advertising
AdSense is planned, not confirmed active by this template. If enabled, Google and other advertising vendors may use cookies, web beacons, IP addresses, or device identifiers to deliver and measure ads. Google's advertising cookies can support personalized ads based on visits to this and other sites. See how Google uses partner site information, Google's privacy policy, and My Ad Center for provider controls.
Nonpersonalized advertising can still involve storage or data processing; it is not automatically consent exempt. Before activation, identify actual ad partners and processing, implement regional consent and opt out requirements, and meet Google's applicable CMP requirements. The custom banner alone must not be represented as a certified Google CMP.
Do Not Sell or Share My Personal Information
To opt out, use the site's “Do Not Sell or Share”/privacy settings when implemented, or email contact@pocketplain.com with that subject. No account is required. Do not send identity documents for a browser based advertising opt out.
We do not propose selling contact messages for money. Advertising disclosures may nevertheless constitute a “sale” or “sharing” under California law, including cross context behavioral advertising. Do not infer a blanket “we never sell or share” promise. The owner must disclose actual practices, categories of recipients, and the applicable preceding period before launch.
The implementation must honor Global Privacy Control (GPC) as an opt out of sale or sharing for the browser or device sending it, including disabling affected advertising processing. It must not ask you to override an active GPC signal. A browser signal does not necessarily identify your other devices; set it on those too. See California's GPC guidance.
Where CCPA/CPRA applies, rights may include knowing and accessing information, correction, deletion, opting out of sale or sharing, limiting qualifying uses of sensitive information, and nondiscrimination. Authorized agents may submit requests; proportionate verification may be needed for access or deletion. We do not propose using sensitive information to infer personal characteristics. Actual eligibility and exceptions require review. See the California privacy rights overview.
GDPR and LGPD rights
Where applicable, GDPR rights include access, correction, erasure, restriction, portability, objection, withdrawal of consent, and safeguards concerning solely automated decisions with significant effects. You may complain to a competent supervisory authority. See the EDPB rights overview.
Under LGPD, rights may include confirmation and access, correction, anonymization, blocking or deletion of unnecessary or unlawfully processed data, portability subject to regulation, information about sharing, information about refusal of consent and its consequences, consent withdrawal, and review of qualifying automated decisions. Direct requests first to the controller/DPO channel above; complaints may also be addressed to ANPD. Rights have legal limits, and withdrawal does not undo earlier lawful processing. This template does not claim automated credit or eligibility decision making.
Recipients, transfers, retention, and security
Potential recipients are hosting and delivery services, email or newsletter providers, consent providers, and enabled advertising or media services. Disclosures may also be needed to meet lawful requests or protect legal rights. Confirm the actual supplier list and international locations. Where required, document an applicable transfer mechanism and how safeguards can be obtained.
Keep data only as long as needed for the stated purpose and relevant legal obligations; delete or anonymize it afterward. Exact retention periods or criteria for correspondence, security logs, consent records, and subscriptions still need owner verification. Do not treat this draft as a completed retention schedule. Security measures reduce risk but cannot guarantee absolute security.
Children and changes
Pocket Plain is intended for a general adult audience and does not seek children's information. Report a child's submission to the privacy contact so it can be assessed and removed where appropriate. Applicable child privacy rules and age thresholds must be reviewed before any child directed feature is added.
Material changes should be reflected in the date and an appropriate notice. A policy update cannot substitute for a new consent when one is required. Contact contact@pocketplain.com for the live configuration or to report a privacy control that is missing or failing.