Tehran Index is a research desk, not an advertising business. We measure what the market reads so we can decide what to cover next, and that is the whole purpose. We do not sell data about readers, we run no ad networks or advertising trackers, and nothing on this site profiles you across the web. This page describes what is actually collected.
One event per page view or search, holding only: what was looked at (a company, sector or group identifier, or a search query truncated to 120 characters), the path, the referring website’s hostname, a random session string, and a two-letter country code read from the CDN at the edge. That is the complete list. We do not store IP addresses, cities, or any field that identifies a person, and the country code exists for one reason: our readership is meant to be outside Iran, and it is the only number that tells us whether that is working.
Vercel Analytics and Speed Insights report aggregate page views and page performance. They set no cookies and build no cross-site profile. Microsoft Clarity provides heatmaps and session replay, so we can see whether a reader reached the evidence drawer or stopped at the fold. Clarity runs in balanced masking mode: images and everything you type are masked before the recording leaves your browser, so form fields, search boxes and account details are never captured as readable text. Clarity sets its own first-party cookies to recognise a returning session. Google Analytics reports aggregate page views; we send it the page path only, never the query string, so a search you run here never reaches Google. If you sign in, Supabase sets a session cookie to keep you signed in. Those are the only cookies this site involves; we set none of our own.
Google Analytics and Clarity set cookies, so the first time you visit we ask. Until you answer, or if you decline, Google Analytics runs in its consent-denied mode, which sets no cookie and sends only anonymous cookieless pings, and Clarity does not load at all. Declining is exactly as easy as accepting and the site works identically either way. Your answer is stored in your browser’s local storage under ti-consent and never leaves the device; clearing site data resets it and we will ask again.
No analytics of any kind load on tokened briefing pages under /digest. A tokened URL is itself a credential, and a credential must not be able to reach a log we do not control, so the protection is structural: the scripts are never placed on the page in the first place. The same applies to /admin. This is enforced in one gate in the code, which every measurement tool passes through, rather than tool by tool.
Visit tehranindex.com/?notrack=1 once and this browser is excluded from everything above: our own event log, Vercel, Google Analytics and Clarity, and the consent banner will not appear. The setting is kept in your browser’s local storage and never leaves the device. tehranindex.com/?track=1 reverses it. Standard browser Do-Not-Track and tracker-blocking extensions also work; nothing here attempts to defeat them.
If you subscribe to TI Weekly we hold your email address and the page you subscribed from, and we send the briefing through Resend. If you open an account we hold your email address and the companies on your watchlist. We use these to deliver the thing you asked for and for nothing else: no sale, no rental, no list swaps, no enrichment against third-party data brokers. Every briefing carries a one-click unsubscribe.
Write to desk@tehranindex.com and we will delete your subscription, your account and your watchlist, or send you what we hold, without asking why. Requests are handled by a person, not a ticket queue. This page is versioned in our repository like everything else on the site, so changes to it are dated and traceable rather than silently swapped in.