The Mobile TakeawayPrivacy Policy
Last updated 28 August 2026.
The Mobile Takeaway is a free email newsletter and installable web app. This policy explains what personal data we collect, why we collect it, who we share it with, and what you can do about it.
Who we are
The Mobile Takeaway is operated by one person, based in Spain, who is the data controller for the personal data described in this policy.
For privacy questions, write to [email protected]. For anything else, write to [email protected].
What we collect
When you subscribe, we collect your email address and the language you choose.
If you enable phone notifications, we store your browser’s push endpoint and encryption keys, your chosen language, and whether each notification was accepted, shown or tapped. We do not need your email address for this.
When you confirm, we record the IP address and time of your click as the record of your consent, together with a referral tag if the link you used carried one.
We keep a record of each issue we send you, including whether your mail provider accepted and delivered it, and whether its unique tracking image was loaded.
We record pseudonymous usage counts, linked to a one-way hash of your address rather than to the address itself, and aggregate subscriber counts, which we publish on our stats page and which identify nobody.
How we use it
To send you the newsletter you asked for.
To send the daily phone notification you asked for.
To keep a record of your consent.
To check that our email is being delivered, and to stop sending to addresses that bounce or report us as spam.
We do not sell, rent or share your personal data for marketing.
Legal basis
We send the newsletter on the basis of your consent under Article 6(1)(a) of the GDPR, given by clicking the confirmation link. You may withdraw it at any time by unsubscribing.
We send phone notifications on the basis of the consent you give in your browser or phone. You may withdraw it at any time by turning notifications off on the front page or in your device settings.
We keep consent records, delivery records, our suppression list and our internal notifications on the basis of our legitimate interests under Article 6(1)(f): proving that a subscription was requested, monitoring whether our email arrives, and not emailing people who have asked us to stop.
Cookies and tracking
This site sets no cookies. It loads our own script and service worker to install the web app and manage notifications, and no scripts, fonts or images from third parties.
If you enable notifications, the service worker reports when a notification is shown and when you tap it. We use those events only to measure notification delivery and opens.
Each newsletter contains a unique one-pixel image so we can estimate opens. Mail privacy services may load it automatically, and image blocking may prevent it from loading, so the count is only an estimate. We do not rewrite links to count clicks. If you sign up from a country whose regulator requires consent for this image, we ask on the confirmation page and it stays off until you say yes. Anyone can turn it off from the link on the unsubscribe page and keep the newsletter.
The signup form is protected by a hidden field that only automated submissions complete, and by a limit on how many signups one connection may make.
Service providers
We use the following providers to operate the service:
Cloudflare, Inc. — DNS, delivery of this website, sending of our email, and backup storage.
Your browser’s push provider — Apple, Google, Mozilla or Microsoft, depending on your browser — routes encrypted notifications to your device.
Hetzner Online GmbH — our server and database, located in Germany.
Backblaze, Inc. — backup storage.
Google — the Gemini API, which writes and translates each issue. It receives article text only, and never your address, language or IP address.
Our own analytics service, self-hosted on separate infrastructure, which stores the pseudonymous counts described above and never receives your address.
Telegram — we receive a private notification containing your email address and language when you confirm your subscription and when you unsubscribe.
International transfers
Our server and database are in Germany. Some of the providers above are established outside the European Economic Area. Where that is the case, transfers are made under standard contractual clauses approved by the European Commission, or under an adequacy decision.
How long we keep it
We keep your data until you unsubscribe. Unsubscribing deletes your record, and the delivery history attached to it, immediately.
A subscription that is never confirmed is deleted when its confirmation link expires, 48 hours after it is issued.
Email delivery events are kept for 90 days. Push delivery and tap records are kept for up to 400 days. A disabled or expired push endpoint is deleted after 30 days.
An active push endpoint is kept until you disable notifications or the push provider reports that it has expired.
If our email to you bounces, or you report it as spam, we keep your address on a suppression list so that we do not email you again. This is the one record that survives unsubscribing. Write to [email protected] if you want it removed as well.
Deleted data may remain in routine backups for up to three months.
Your rights
Under the GDPR you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time.
To exercise any of them, write to [email protected] from the address you subscribed with. You can also erase your data yourself at any time: the unsubscribe link at the bottom of every issue deletes your record on the spot.
If our response does not satisfy you, you have the right to complain to your national data protection authority.
Security
This site is served over HTTPS. Confirmation and unsubscribe links use randomly generated tokens. Email addresses and tokens are removed from our application logs before they are written.
Changes
If we change this policy, we will update the date at the top. We will announce any change that affects what we collect in an issue before it takes effect.