Skip to main content
THE CITIZENSHIP DESK

Privacy

Last updated: 31 October 2026

This page describes what The Citizenship Desk stores and which outside services are involved. Reading the site does not require an account. An account is only needed to sync a shortlist across devices.

What we collect

  • Account (if you sign in): your email address, the time it was verified, and the date the account was created. If you sign in with Google we also store the name and profile picture URL Google returns, if any.
  • Shortlist (if you sign in): the visas, countries and other entries you star, each stored with the date you added it. Without an account the shortlist stays in your browser only.
  • Newsletter: if you subscribe, your email address, a confirmation status (pending, confirmed or unsubscribed), a private token used in confirm and unsubscribe links, and the dates you signed up, confirmed and unsubscribed.
  • Sponsor alerts: if you ask to be told when a UK licensed sponsor gains or loses its licence, your email address, the sponsor you chose, a private token, whether you have confirmed, and the related dates.
  • Page performance: when a page loads, your browser sends core Web Vitals measurements (metric name, value, rating) with the page path and your browser’s user-agent string to our server, which stores them. The stored record contains no account or email information.
  • IP address: your IP address is used to rate-limit requests to some endpoints and is held in the server’s memory for that purpose; the rate limiter does not write it to the database.

How we use it

  • To let you sign in and to keep you signed in.
  • To save your shortlist and show it on any device you sign in on.
  • To send the emails you ask for: the sign-in link, the newsletter confirmation link, and sponsor-alert confirmations and alerts.
  • To measure page performance and, through Google Analytics, how the site is used.
  • To find and fix errors, where error monitoring is switched on.

Sign-in providers

Email link. You enter your email address and we send a one-time sign-in link through Resend. The link is valid for 24 hours and works once. Until it is used, a record containing your email address, a token and its expiry is held in a verification table; it is removed when the link is used.

Google. If you choose “Continue with Google”, the site requests the openid, email and profile scopes. Google returns your email address, name and profile picture, and we only accept the sign-in if Google reports the email address as verified. We store the name, email and picture on your user record. We also store the Google account identifier and the tokens Google issues for the sign-in (access, refresh and ID tokens, where provided) in the accounts table. We do not use those tokens to read anything else from your Google account. If you sign in by email link and later with Google using the same address, the two sign-ins are joined into one account.

Cookies

When you sign in, the site sets Auth.js cookies: a session cookie (a signed token, valid for up to 30 days), a CSRF cookie and a callback-URL cookie. During Google sign-in Auth.js also sets short lived PKCE, state and nonce cookies. These are needed for sign-in to work.

Your theme choice (light or dark), your shortlist and comparison lists, recent searches, and the inputs of some tools are kept in your browser’s local or session storage, not in cookies, and are not sent to us unless you are signed in and they form part of your shortlist. Google Analytics, described below, may set its own cookies; those are set by Google’s script, not by this site’s code.

Third parties

  • Google Analytics 4 (googletagmanager.com): loaded after the page renders on the production site. It receives page views, including the path and query string of each page you visit as you navigate, and the Web Vitals measurements above.
  • Resend: delivers our emails, so it receives the address each email is sent to and the message content.
  • Google (sign-in): only if you choose Google sign-in, as described above.
  • Sentry: error monitoring is wired into the site and is active only when a Sentry project is configured. It is set up not to send default personally identifiable information.
  • panel.bazookaemail.com: a monitoring script is loaded from this host on every page, after the page has loaded.
  • open.er-api.com: the currency toggle and the currency converter fetch exchange rates directly from this service, so your browser contacts it when you use them.
  • Cloudflare: the site is served behind Cloudflare, which sits between your browser and our server.

We do not sell your data.

Keeping and deleting your data

The account page has a “Delete my account” button. It deletes your user record and, with it, your linked sign-in accounts (including any stored Google identifier and tokens), your sessions and your saved shortlist, then signs you out. This cannot be undone.

Deleting your account does not remove a newsletter subscription or a sponsor alert, because those are stored separately and are keyed only by email address. The unsubscribe link in those emails marks the subscription as unsubscribed; the address stays on record with that status. A sign-in link that was issued but not used is also not removed by account deletion.

Clearing your browser’s site data removes the shortlist, theme and other items kept in browser storage on that device. We have not set automatic retention periods for the data described on this page.

The newsletter list can be exported as a CSV (email, status and the sign-up, confirmation and unsubscribe dates) by site administrators.

Contact

For questions about this page or about data not covered by account deletion, email [email protected]. This is the address the site uses for corrections; see also the About page.