Privacy policy

Notice version: 8 October 2026 · version 3

Brave Bison Limited operates The Hook. This notice explains how we handle information about readers, people who contact us and people involved in our journalism.

1. Who is responsible

Brave Bison Limited, company number 07634543, is the controller for The Hook at thehooknews.com. A controller decides why and how personal information is used. Other Brave Bison services have their own notices; this notice does not authorise additional sharing across the group.

For editorial enquiries or corrections, contact thehookshow@bravebison.com. You do not need an account to read our publication. This site does not offer newsletters, reader accounts, payments or competitions, or use affiliate tracking.

2. Information and purposes

Personal information includes names and correspondence as well as identifiers and activity that can be linked to a person. Removing a name or replacing it with an identifier does not necessarily make information anonymous.

Information comes from your interactions, your browser, people who correspond with us, public sources and our editorial research. We ask you to send only what is needed for an enquiry. We may need limited further information to verify a rights request or an agent's authority. Please discuss an appropriate channel with the editorial team before sending highly sensitive source material.

Where we rely on legitimate interests, you can ask about the assessment and object. Ezoic applies regional consent and opt-out rules. Visiting, scrolling or waiting is not itself a grant of consent; rejecting cookies may still allow contextual advertising.

3. Consent and privacy choices

Use Privacy settings to review advertising controls or disable ads in this browser. Your privacy choices opens Ezoic’s regional consent or sale/sharing controls when available. Ezoic/Gatekeeper manages advertising consent through TCF for GDPR regions and GPP for applicable US states.

Our ad integration waits for the consent manager to report readiness. In GDPR regions, this includes a stored decision or a completed choice, including rejection. Where GDPR does not apply, Ezoic uses the applicable regional controls; we do not impose a worldwide opt-in requirement. Gatekeeper states that its TCF preference cookie lasts at most 13 months. Choices apply to this browser; use the controls on each device or browser you use.

Google Analytics uses the same consent manager. In GDPR regions it starts only after a completed or stored decision that includes consent to store and access information on your device (TCF purpose 1) and to measure content performance (purpose 8); Reject All, or consenting to only one of those purposes, keeps it off. Where the consent manager reports that GDPR does not apply, it starts once that result is known, subject to GPC. The consent manager does not list Google Analytics as a separate vendor; this purpose mapping is how we apply your choice to it.

We recognise browser Global Privacy Control (GPC) globally and block our Ezoic ad loader and Google Analytics when the signal is active. Resuming ads or accepting a CMP choice does not override GPC. Browser “Do Not Track” is a different signal; use our controls or GPC for the choices described here.

Manage consent choices changes Ezoic’s permissions; rejecting cookies does not necessarily remove contextual ads. Disable ads in this browser sets a first-party restriction and reloads the page to stop our ad loader. It also applies to other open pages when they check the restriction. Resume ads using Ezoic settings removes this site restriction without granting consent or overriding Gatekeeper’s saved choices. Neither control automatically deletes earlier records or third-party storage; ask us or the relevant provider about deletion. Disable ads in this browser affects advertising only. Withdrawing storage or content-measurement consent after Google Analytics has started stops the tag, removes the _ga cookies our page controls and reloads the page.

If the consent service cannot report readiness, our ad loader and Google Analytics stay off. This privacy page and the notification-management page do not load ads or Google Analytics. Deleting browser storage may remove both CMP choices and the browser-level ad restriction; regional consent controls then apply again.

4. Analytics and advertising

Current availability: Ezoic advertising is enabled through its CMP-managed integration, subject to account approval, ad availability, regional privacy choices and the browser restrictions described above. Ezoic is the only configured advertising network; MGID and Unibots have been removed. Google Analytics 4 is enabled under the conditions in section 3. Ezoic’s analytics tag loads together with the ad loader and follows the consent manager’s result. First-party readership measurement and third-party embeds remain disabled. Ad delivery may include Ezoic’s advertising measurement; the browser-level ad restriction stops the ad loader and the Ezoic analytics tag together.

First-party readership events

When enabled and with validated analytics consent, our own readership endpoint can record article views, reading progress, completion and shares. Events contain the article/category, language, elapsed time and only the referring website's hostname, not its path or query. At the server we may add a broad device class and country supplied by Cloudflare. These events have no separate reader identifier and we do not add names, emails or raw IP addresses to the event record. Cloudflare must still process connection information to deliver requests. Cloudflare Analytics Engine handles these events; retained article-level aggregate reports are separate from its event retention.

Google Analytics

Google Analytics 4 measures visits and interactions using analytics identifiers, page and device information and approximate location. We use basic consent mode: the Google tag is not requested before the consent manager permits it, after rejection or withdrawal, when the consent manager is unavailable, or with Global Privacy Control. Our tag turns off Google Signals and advertising-personalisation signals, limits its cookies to 13 months without renewal on activity, and sends the page address without query strings and only the referring site’s hostname. We do not send user identifiers, email addresses or private content to Google Analytics.

See Google's information about partner sites and Google Analytics safeguards. Google's Analytics opt-out browser add-on is an additional control.

Ezoic advertising

Ezoic and its advertising partners deliver and measure advertisements using the consent or opt-out signals managed by Gatekeeper. Personalised ads may be served where permitted; rejecting cookies can result in non-personalised or contextual ads instead. The consent manager describes the applicable purposes, vendors and available objections. We enable Ezoic’s cookie-limiting option. The account’s form-data collection is off and Identity Privacy Opt Out is on; our site does not add email or phone matching code. These settings do not establish a universal prohibition on every partner’s processing.

The following publisher disclosure is supplied by Ezoic for this domain and describes its services and partner capabilities. Read the current Ezoic domain disclosure and the vendor details in the consent manager for further information. A notice is not itself a grant of consent.

5. Embedded content

Articles may link to media hosted by services such as YouTube, Instagram, X, Twitch and Reddit. A placeholder and normal external link are shown before any permitted embed loads. Loading an embed requires consent for its provider; accepting analytics or advertising alone does not provide that permission. Embeds are currently unavailable, so use the external link to view the original.

When an embed is enabled, its provider receives connection details, the requested media and interactions, and may recognise an existing account or set its own storage. External links take you to that provider's service, whose own notice and controls apply. See Google/YouTube privacy, Instagram privacy, X privacy, Twitch privacy and Reddit privacy.

6. Browser notifications

Notification subscriptions are optional and separate from analytics and advertising consent. If you subscribe, we store a browser-generated delivery endpoint and encryption keys, your selected language, creation time and delivery/failure status. Your browser's push service, such as Google, Mozilla, Apple, Microsoft or Samsung, routes notifications to your device. This does not require your name, email address or a reader account.

Use Manage notifications to unsubscribe from this browser. Unsubscribing deletes our subscription record immediately. You can also revoke notification permission in the browser's site settings. Blocking permission there may prevent delivery before we learn that the endpoint is inactive; inactive records are subject to the deletion schedule below. Each browser or device has its own subscription.

Dismissing our notification invitation stores a timestamp locally for 14 days, after which the expired value is removed when the preference is checked. It is not consent to notifications or tracking.

7. Journalism and editorial AI

Our reporting may concern identifiable people, including public figures, contributors, interviewees and others involved in a story. Sources include public records, articles, social posts, interviews and material supplied to the newsroom. Depending on the story, the material may include sensitive information or alleged or established offences.

We consider accuracy, public interest, necessity and the effects on individuals. Any journalism exemption is assessed for the particular purpose and legal requirement; it is not a blanket exemption and does not extend automatically to reader analytics or advertising. Our continuing archive supports the public record. Requests for correction, anonymisation or removal are reviewed individually, including the continuing public interest and relevant rights.

Editors may use OpenAI and Anthropic services through Cloudflare's AI Gateway to assist with public article material, including drafting, rewriting and related editorial tasks. Public material can still contain personal information. Editors are instructed not to submit private tips, source identities, unpublished confidential material or reader correspondence to these tools. We do not claim that automated checks can guarantee that private material is never submitted. Our use of these editorial tools does not make legally or similarly significant automated decisions about readers.

8. Recipients and international processing

Cloudflare provides hosting, network delivery and security, database and object storage, caching, queues and the analytics/AI gateway services described above. Authorised editorial, technical and BB Legal personnel handle information needed for their work. Correspondence is processed in our business email service. Other recipients include enabled providers described in this notice, professional advisers where needed and authorities when disclosure is legally required. We do not include additional group sharing in this site's processing arrangements.

Providers may process information outside the United Kingdom or European Economic Area. A permitted transfer requires an applicable adequacy arrangement or appropriate contractual safeguards and any required assessment or additional protections. The actual arrangement depends on the recipient and processing involved; a provider link alone does not establish a safeguard. Contact BB Legal for the relevant recipient, country and safeguards information, including how to obtain an available copy.

Provider information: Cloudflare, OpenAI, Anthropic, Mozilla, Apple, Microsoft and Samsung.

9. Retention and security

We limit retention to the relevant purpose, legal requirements and justified claims handling. A specific legal hold may require a record to be kept longer. Access restrictions and technical safeguards are used to protect information, but no internet service or email channel is completely secure. See Cloudflare Analytics Engine retention.

10. Cookie and storage inventory

This inventory covers our code-controlled storage and identified consent storage, not just cookies. It distinguishes disabled providers from active technology. An entry describing a disabled provider does not mean it is allowed to load. Browser settings can inspect or remove site data; removing necessary preferences means we may need to ask again.

Cloudflare processes necessary network and security requests. Cookies or storage associated with a particular security challenge depend on the enabled protection; they must not be used to bypass optional-tracking choices. We maintain this inventory when services or identifiers change.

11. Your rights and complaints

Depending on the applicable law and circumstances, you can request access and a copy, correction, deletion, restriction or portability of your personal information; object to processing based on legitimate interests; and withdraw consent. Some rights have exceptions, including appropriately assessed journalism protections and requirements to keep particular records.

Email privacy@bravebison.com or write to the address above. Explain the right you wish to exercise and enough context to locate the information, such as the article URL, correspondence date or browser subscription involved. Do not send identity documents unless we request proportionate verification. An authorised agent can contact us with evidence of authority. You do not need to explain why you are opting out of optional tracking.

BB Legal handles requests. UK/EU requests are normally answered within one month; lawful pauses or extensions may apply, and we will explain any extension or refusal and the available challenge route. We do not ordinarily charge a fee. Changing a browser choice does not by itself identify all other information we may hold about you.

You can complain to the UK Information Commissioner's Office or the data protection authority where you live or work, where applicable. You may contact us first, but do not have to do so to use your legal remedies.

12. US privacy information

Where a US state privacy law applies, this section supplements the rest of the notice. The categories described above include identifiers and contact details; internet/network activity; broad location inferred from a connection; correspondence; and information in editorial material, which may include professional, audiovisual or sensitive information. Sources, purposes, recipients and retention criteria are set out in sections 2 and 7–10. Ezoic’s advertising partners may process identifiers, activity and other information described in the consent manager and publisher disclosure, depending on applicable choices and law. We do not add email/phone matching code or request reader age for advertising.

Under some state laws, disclosures to advertising partners may count as a “sale”, “sharing” or targeted advertising even without payment for personal information. Our Ezoic advertising integration may involve disclosures treated as sale, sharing or targeted advertising under applicable state laws. Use Ezoic’s regional controls or disable ads in this browser. This statement about current operation is not a representation about every disclosure in an earlier reporting period.

Use Your privacy choices to opt out of sale/sharing or targeted advertising. We recognise GPC on this browser everywhere and ordinary acceptance does not override it. No account or identity verification is required for these browser opt-outs. We do not offer financial incentives for personal information or discriminate against you for exercising applicable privacy rights.

Subject to the law and its exceptions, you may request access, knowledge of processing and disclosures, a portable copy, correction or deletion; opt out of sale/sharing, targeted advertising and covered profiling; and limit certain uses of sensitive information. Email or post a request using section 11. An agent may act for you with appropriate authority. Verification is proportionate to the request; a refusal explains the reason and any appeal right. Where available, appeal by replying to BB Legal with “Privacy appeal”, and we will explain how to contact the relevant state regulator if the appeal is denied. Applicable state deadlines and permitted extensions apply.

Advertising processing and available restrictions are described in Ezoic’s consent manager and disclosure. Editorial information is assessed separately under applicable law. Learn about California rights from the California Privacy Protection Agency.

13. Young readers and notice changes

Our general-audience publication can be read by younger people. We do not ask readers for their age for advertising. Ezoic’s regional consent controls apply; GPC and the browser-level ad-disable control block ads. Notifications are separately requested. A parent, guardian or young reader can contact BB Legal about information involving a child.

We revise this notice when our services, processing or legal obligations change. The version is shown at the top. We seek a renewed choice when required for changed purposes or providers; updating a notice alone does not grant new consent.