What this site collects
There are no accounts, no advertising trackers and no cookies set by this site. Fonts and the site’s own scripts are self-hosted, and so are the analytics, described next; no third-party analytics or tracking service is used. The only third-party script is Google reCAPTCHA, and only on the pages that contain a form.
Like any web server, the hosting provider may keep routine request logs (IP address, user agent, time, page requested) for security and abuse prevention. Requests for the RSS feed appear in those logs in the same way.
Analytics (Umami, self-hosted)
This site uses Umami, an open-source, privacy-focused analytics tool, to see which pages are read and where visitors come from. I run Umami myself on infrastructure I control. It is not Umami Cloud, and your visit is not sent to Umami or to any other third-party analytics provider. When a page loads, your browser requests the analytics script from, and sends the page-view data to, my own instance.
Umami sets no cookies, does not track you across other sites and does not store IP addresses. It records the page viewed, referrer, browser, operating system, device type, screen size, language and an approximate country. Visitors are counted using an anonymous identifier derived from a one-way hash, not from anything stored in your browser. Data stays on my server, is used only in aggregate to improve the site, and is never sold or shared for advertising.
To opt out, enable Do Not Track in your browser (the script respects it), or run localStorage.setItem('umami.disabled', 1) in your browser console on this site. Content blockers also work.
Stored in your browser
Your light/dark theme choice is saved in your browser's local storage under the key theme. It never leaves your device.
Contact and newsletter forms (Formspree)
The contact and newsletter forms are handled by Formspree, a form-processing service. When you submit a form, the details you enter (for example your name, email address, organisation and message) are sent over HTTPS to Formspree, which forwards them to my mailbox. Formspree processes the submission on its own infrastructure under its privacy policy. This site has no database and stores nothing you submit itself.
Bot protection (Google reCAPTCHA)
The forms use reCAPTCHA to keep automated submissions out. To do this, your browser loads a script from Google and your interaction with the form is shared with Google, which may set cookies for the visible reCAPTCHA widget. Google’s Privacy Policy and Terms of Service apply to that processing. reCAPTCHA runs only on the pages that contain a form.
If you contact me or subscribe
I use the details you send only to reply, to handle a report or to send you updates if you subscribe by email. Vulnerability reports are kept confidential and shared with affected vendors only as needed to fix the issue. Email goes through Proton Mail; encrypt sensitive messages with my PGP key. Anything sensitive should be encrypted before it is submitted, because the form passes through Formspree and reCAPTCHA.
The email list is kept by hand, is never shared and is not used for anything but notifying you of new publications. Reply unsubscribe and I will delete your address.
Published case studies
Lab write-ups and incident response case studies are anonymised before publication under the sanitization policy. If you believe something identifies you or your organisation, contact me and I will review it promptly.
External links
Links to other sites (for example GitHub, GitLab, Codeberg, LinkedIn and X) are covered by those sites' own policies.
Your choices
To ask what I hold about you, or to have it deleted, contact me. Changes to this policy will be posted here with a new date.