Privacy

No cookies, no analytics

The site sets no cookies and runs no analytics. There are no third-party scripts, fonts, trackers or embedded media — every file a page loads comes from this site. Nothing you do here is profiled, shared or sold.

If you switch between the dark and light editions, that preference is saved in your own browser's local storage so the site remembers it next time. It stays on your device, and it is never sent anywhere.

If you suggest a topic

The “Suggest a topic” form asks for a topic and, optionally, a note. It does not ask for your name or email address, and the site keeps no copy: your suggestion is emailed straight to the person who runs the site and is not stored on the server or in any database.

That email is delivered by Resend, an email provider, which handles it in transit. Because the suggestion reaches a personal inbox, it may be kept there as long as it is useful. Please don't type personal or confidential details into the note — there is no need for any, and anything you do write will come along with the suggestion.

IP addresses and security records

Like any website, this one needs a basic defense against abuse.

Your IP address is used, in memory only, to limit how many suggestions can be sent in a day. It is not written to a database for that purpose.

A record is kept only when something looks like abuse rather than ordinary reading: a suggestion rejected or blocked by the rate limit, an email that fails to send, a stream of requests for pages that don't exist (the signature of an automated scan), or a request that tries to bypass the site's security layer. Those records contain the IP address, the country, the request method and path, and the browser's user-agent string, and they are held in a private security console for up to 12 months before being deleted automatically.

Ordinary browsing and downloading are never recorded this way. Reading a page, viewing an infographic or downloading a PDF creates no security record.

Service providers

Three companies process requests on the site's behalf, each under its own agreement and privacy terms:

• Railway — hosting. Its servers handle every request and keep short-lived operational logs.
• Cloudflare — content delivery and protection against attacks. It sits in front of the site and sees requests, including IP addresses, as part of serving and filtering them.
• Resend — delivery of the suggestion emails described above.

Legal basis and your rights

Where the UK or EU General Data Protection Regulation applies, the limited processing above rests on legitimate interests: keeping the site available, preventing abuse, and reading the suggestions people choose to send. You have the right to ask what is held about you, to ask for it to be corrected or deleted, and to object to the processing or complain to your data protection authority.

In practice there is very little to find. The site holds no account, no profile and no identifier for you, so unless you have sent a suggestion or triggered one of the security records described above, a request will usually turn up nothing.

Under California law: this site does not sell or share personal information, and it does not use it for targeted advertising.

Children

The site is written for working security, risk and compliance practitioners. It is not directed at children and does not knowingly collect anything from them.

Changes and contact

If this notice changes, the date at the top changes with it. Questions, or a request about your data: [email protected].