Privacy policy

Nothing you do not send me. There is no account, no login, no comment box and no form anywhere on this site. The search behind the magnifier in the header filters a list the page already carries, so what you type into it never leaves your browser.

Vercel Analytics and Vercel Speed Insights run on every page. They record page views and the path through the site, a country-level location, the browser and device type, and how long a page took to load.

Vercel Analytics sets no cookies. What Vercel keeps, and for how long, is in their privacy policy.

Two hosts get a request from your browser while a page loads. Vercel serves the site and runs the analytics above. Supabase stores the writeups, the CVE rows and the images, and the logo in the header is fetched straight from it.

Those requests carry what any HTTP request carries: your IP address, the browser’s user agent, and the page you came from. I send neither of them anything else about you, and there is no advertising or tracking network on this site.

If you write to me, I keep the message. I use it to answer you, and for nothing else. It goes to nobody. The address is on Proton, and the PGP key on the contact page is there for anything you would rather not send in the clear.

Vercel builds and serves the site. The content and the images sit in Supabase. I run no server of my own and keep no database of visitors.

Under the GDPR you can ask for a copy of what I hold about you, ask me to delete it, object to the processing, or ask for it in a portable form.

In practice what I hold is the emails you have sent me. The analytics above are aggregated by Vercel and cannot be traced back to one reader, so there is nothing individual there to hand over or erase.

This site is not aimed at anyone under 13, and nothing on it asks for an age or any other personal detail.

If this policy changes, the date at the top of the page changes with it.

Questions about any of this go to the contact page.