Privacy Policy

Unleashed is a fan-made Monster Energy flavour tracker, run as a personal project by Jack Greenacre in the United Kingdom. For the purposes of the UK GDPR and the Data Protection Act 2018 I am the data controller for the information described here.

It is not affiliated with, endorsed by or connected to Monster Energy. Flavour names, can designs and product details are catalogue information about publicly sold drinks, and are nothing to do with you.

The easiest way to reach me about anything on this page is by email at [email protected]. If you would rather write to me, ask and I will give you a postal address.

An account is the only reason I hold anything about you at all. You can read the flavour catalogue without one, and without giving me anything.

• Your account. An email address, a username, and a password. The password itself is never stored - only an argon2 hash of it, which cannot be turned back into what you typed. I also keep the date you signed up, when you confirmed your address, and when you last signed in.
• What you track. Which flavours you have ticked off, the date you first tried each one, your star rating out of five, and how many cans you have counted.
• Who you follow. The other accounts you have added as friends, so your friends list and comparisons work.
• Sessions. Signing in creates a session in the database and puts a random token in a cookie. Only a SHA-256 of that token is stored, so the session table on its own cannot be used to sign in as you.
• Technical information. My server keeps short-lived request logs, and holds your IP address in memory for a few minutes to rate-limit sign-in, sign-up and password-reset attempts against abuse. Cloudflare, which sits in front of the site, keeps its own security logs of the same requests - see section five. Separately, cookieless analytics counts page views and keeps aggregates - which pages are read, where a visit came from, roughly which country and what sort of device, how quickly pages loaded, and counts of a few actions such as ticking off a flavour. None of it is linked to your account.

There is no advertising, no third-party tracking and no profiling. The analytics I do use is Umami, which I run on my own hardware and which puts nothing on your device. The Cookies Policy has the full picture.

A profile is public by default, at /u/your-username. Anyone with that address - signed in or not - can see your username, your stats, and which flavours you have tried, rated and counted.

Your email address is never shown to anyone, on your profile or anywhere else. It is also not searchable: the “find a friend” box matches on username only, so nobody can look you up from an address they already have.

You can make your profile private at any time in Settings. A private profile cannot be viewed, followed or compared with by anyone but you.

Whether your profile is public or private, your ticks are counted into the site-wide totals on the home page - how many flavours have been tried between everyone, which ones are most tried, which are best rated. Those are sums across all accounts and name nobody.

The UK GDPR requires a lawful basis for each use of your information. Mine are as follows.

Running your account and saving what you track

Performance of the contract between us - it is the entire service.

Confirming your email address and sending password resets

Performance of the contract, and my legitimate interest in making sure an account belongs to the person who opened it. These emails are transactional, not marketing.

Showing your public profile and comparisons

Performance of the contract, at your choice: profiles can be made private in Settings, and doing so takes yours out of view immediately.

Rate-limiting and keeping the site working

My legitimate interest in protecting accounts and keeping the site available.

Counting page views and a few actions

My legitimate interest in knowing whether anyone is actually using the thing. The analytics is cookieless, stores nothing on your device and holds nothing that identifies a visitor, so consent is not the basis for it and no banner is needed.

I do not send marketing emails, and I do not sell, rent or share your details with anyone for their own marketing. There is no advertising on this site and it makes no money.

Not many. The site, its database and its analytics all run on a machine I own and keep at home in the United Kingdom. I am not renting space on somebody else’s server, so no hosting company, cloud platform or object store holds a copy of your account or anything you have tracked.

Two suppliers are involved:

• Cloudflare - sits in front of the site. The domain is proxied through Cloudflare’s network, so your browser connects to Cloudflare rather than to me, and Cloudflare passes the request on. That means it decrypts and re-encrypts your traffic, and sees your IP address, the pages you ask for and your browser’s headers. It is there for three reasons: it keeps my home broadband address off public DNS, it absorbs the automated attacks and scanning that any public site attracts, and it handles the certificate. Cloudflare acts as my processor under its data protection addendum and does not use your traffic for its own purposes.
• My email provider - delivers confirmation and password-reset emails, and therefore handles your address in transit.

Both process your information on my instructions and for no purpose of their own. Where that involves a transfer outside the UK it is protected by the safeguards UK law requires, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Analytics is not on that list, because it is not a third party: Umami runs on my own hardware rather than an analytics company’s.

Beyond that, I will only disclose your information where I am legally required to, or where it is necessary to establish or defend a legal claim.

• Your account and everything you have tracked - for as long as the account exists. Delete it and the lot goes with it, immediately and for good.
• Sessions - expire 30 days after they were last used, and are deleted outright when you sign out, sign out everywhere, or change your password.
• Confirmation and reset links - single-use, and expire on their own shortly after being sent.
• Rate-limiting records - held in memory only and discarded within minutes.
• Backups - the database is dumped nightly and the dumps are kept for 30 days, on the same machine. So for up to a month after you delete your account, a copy can still exist in a backup file; those are only ever opened to restore the site after something has gone wrong, and they age out on their own.
• Analytics - aggregate counts only, with nothing identifying a visitor to delete. Kept while the figures are still worth comparing year to year.

The site is served over HTTPS, on both legs - your browser to Cloudflare, and Cloudflare to me. The machine it runs on is one I own and can physically get to, rather than a rented box in a data centre I have never seen. Passwords are stored as argon2 hashes rather than as text, and the database is not reachable from the internet. Sessions live in the database rather than in a signed cookie, so changing your password or signing out everywhere really does end every other login, right away. Confirmation and reset tokens are stored hashed, are single-use, and are spent by a button press rather than by the link being opened - so a mail scanner following the link cannot burn it.

No system is perfect. If a breach happens that is likely to put your rights at risk, I will tell you and the Information Commissioner’s Office as the law requires.

Under UK data protection law you can ask me to:

• give you a copy of the personal information I hold about you;
• correct anything that is wrong or incomplete;
• delete it, where I have no continuing reason to keep it;
• restrict how I use it while a concern is being sorted out;
• provide it in a portable format;
• stop using it where I have relied on legitimate interests.

Two of these you can do yourself, without asking me. Settings lets you change your username and email address, make your profile private, and delete your account outright - which removes your details, every flavour you have tracked, and your friends list. That is a real deletion, not a flag, and it cannot be undone.

For anything else, email [email protected] and I will respond within one month. There is no charge. I may ask you to confirm the request from the address the account uses, so that I am not acting for someone else.

This site is not aimed at children. Energy drinks are not recommended for under-16s, and many UK shops will not sell them to under-16s at all. Please do not open an account if you are under 13; if you are between 13 and 16, ask a parent or guardian first. If you believe a child has given me their details, email [email protected] and I will delete the account.

If you are unhappy with how I have handled your information, please tell me first so I have the chance to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

I will update this page when what I do with personal information changes, and the date at the top will change with it. If a change is significant I will say so on the site before it takes effect.