The Mobile TakeawayPrivacy Policy
Last updated 19 October 2026.
The Mobile Takeaway is a free email newsletter and installable web app. This policy explains what personal data we collect, why we collect it, who we share it with, and what you can do about it.
Who we are
The Mobile Takeaway is operated by Filip Kowalski, based in Spain, who is the controller of the personal data described in this policy.
For privacy questions, write to [email protected]. For anything else, write to [email protected].
What we collect
When you subscribe, we collect your email address and the language you choose.
If you enable phone notifications, we store your browser’s push endpoint and encryption keys, your chosen language, and whether each notification was accepted, shown or tapped. We do not need your email address for this.
When you confirm, we record the IP address and time of your click as the record of your consent, together with a referral tag if the link you used carried one.
We keep a record of each issue we send you, including whether your mail provider accepted and delivered it, and whether its unique tracking image was loaded.
We record pseudonymous usage counts linked to your subscription, and aggregate subscriber counts published on our stats page. Aggregate counts do not identify individual readers.
How we use it
To send you the newsletter you asked for.
To send the daily phone notification you asked for.
To keep a record of your consent.
To check that our email is being delivered, and to stop sending to addresses that bounce or report us as spam.
We do not sell, rent or share your personal data for marketing.
Legal basis
We send the newsletter on the basis of your consent under Article 6(1)(a) of the GDPR, given by clicking the confirmation link. You may withdraw it at any time by unsubscribing.
We send phone notifications on the basis of the consent you give in your browser or phone. You may withdraw it at any time by turning notifications off on the front page or in your device settings.
We keep consent records, delivery records, our suppression list and our internal notifications on the basis of our legitimate interests under Article 6(1)(f): proving that a subscription was requested, monitoring whether our email arrives, and not emailing people who have asked us to stop.
Cookies and tracking
This site sets no cookies. It loads our own script and service worker to install the web app and manage notifications, and no scripts, fonts or images from third parties.
If you enable notifications, the service worker reports when a notification is shown and when you tap it. We use those events only to measure notification delivery and opens.
Each newsletter contains a unique one-pixel image so we can estimate opens. Mail privacy services may load it automatically, and image blocking may prevent it from loading, so the count is only an estimate. We do not rewrite links to count clicks. If you sign up from a country whose regulator requires consent for this image, we ask on the confirmation page and it stays off until you say yes. Anyone can turn it off from the link on the unsubscribe page and keep the newsletter.
We protect the signup form against automated submissions and abuse.
Service providers
We use the following providers to operate the service:
Cloudflare, Inc. — DNS, delivery of this website, sending of our confirmation emails and of some newsletter issues, and backup storage.
Amazon Web Services (Amazon SES) — sending of the newsletter, from its eu-west-1 region in Ireland.
Your browser’s push provider — Apple, Google, Mozilla or Microsoft, depending on your browser — routes encrypted notifications to your device.
Hetzner Online GmbH — our server and database, located in Germany.
Backblaze, Inc. — backup storage.
Google — the Gemini API, which writes and translates each issue. It receives article text only, and never your address, language or IP address.
Our own analytics service, self-hosted on separate infrastructure, which stores the pseudonymous counts described above and never receives your address.
Telegram — we receive a private notification containing your email address and language when you confirm your subscription and when you unsubscribe. The unsubscribe notice also says how many days you were subscribed, how many issues we sent you and, if you allowed the open pixel, roughly how many of them you opened.
International transfers
Our server and database are in Germany. Some of the providers above are established outside the European Economic Area. Where that is the case, transfers are made under standard contractual clauses approved by the European Commission, or under an adequacy decision.
How long we keep it
Unsubscribing deletes your subscriber record and its attached delivery history. It does not automatically erase the separate support notifications, suppression records or backups described below.
A subscription that is never confirmed is deleted when its confirmation link expires, 48 hours after it is issued.
Email delivery events are kept for 90 days. Push delivery and tap records are kept for up to 400 days. A disabled or expired push endpoint is deleted after 30 days.
An active push endpoint is kept until you disable notifications or the push provider reports that it has expired.
If our email bounces or you report it as spam, we keep your address on a suppression list to avoid sending again. Subscription notices already delivered to our private Telegram channel remain there until removed. Contact [email protected] to request deletion of these separate copies; we may retain records needed to honour an opt-out or meet legal requirements.
Deleted data may remain in routine backups for up to three months.
Your rights
Under the GDPR you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time.
To exercise your rights, write to [email protected] from the address you subscribed with. The unsubscribe link deletes your subscriber record immediately, subject to the separate retention exceptions above.
You may complain to the Agencia Española de Protección de Datos (aepd.es) or the supervisory authority in your country.
Security
We use encrypted connections and access controls to protect personal data. Confirmation and unsubscribe links provide access to your subscription choices; keep them private.
Changes
If we change this policy, we will update the date at the top. We will announce any change that affects what we collect in an issue before it takes effect.