Privacy

1. What we collect

Newsletter subscribers. If you subscribe to the daily briefing, we store your email address and the date you confirmed. The form is double opt-in: you submit an address, we send a confirmation token, and we only add you to the list after you confirm.

Server logs. Our infrastructure records standard request metadata — IP address, user agent, request path, response status, timing. These logs are kept short-term for security, abuse prevention, and basic operational analytics, then rotated.

Anonymised analytics. We use Google Analytics 4 (property ID G-QS4ZR80MBR) to measure how readers move around the site. Analytics data is aggregated; we do not attempt to re-identify individual readers from it.

What we do not collect. We do not run advertising trackers. We do not run third-party social widgets that profile you. We do not sell or rent any reader data.

2. Cookies

The public site uses a small number of cookies:

• _ga, _ga_QS4ZR80MBR and related Google Analytics cookies, used for anonymous audience measurement. You can opt out of GA via the browser-level Do-Not-Track signal, the Google Analytics opt-out add-on, or by blocking the GA domain.
• A locally-stored preference key under tcn:prefs in localStorage — used only to remember reading-density preferences. This stays in your browser; we never read it server-side.

The admin panel runs on a separate origin (admin.thecyber.news) and uses its own session cookie. That cookie is scoped to the admin domain and is not accessible from the public site.

3. Third-party processors

• Cloudflare — content delivery, WAF, bot-fight, edge caching. Receives all request metadata as part of routing traffic to our origin.
• Google Analytics 4 — anonymised audience measurement.
• Hetzner — primary hosting for our origin.
• Supabase (PostgreSQL) — managed database that stores articles and the newsletter list.
• GitHub / GHCR — source-code and container-image hosting; involved in our deploy pipeline, not in serving reader requests.

4. Retention

Newsletter email addresses are kept until you unsubscribe or email us to be removed. Server logs are kept short-term and then rotated. Google Analytics data is retained per Google's default settings (currently 14 months), and you can request deletion through Google.

5. Your rights

Subject to applicable law (GDPR, UK GDPR, CCPA and similar), you have the right to:

• Know what personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data ("right to erasure").
• Withdraw consent for the newsletter at any time.
• Object to processing and lodge a complaint with a supervisory authority.

Email [email protected] with the subject line "Privacy request" and we will respond within a reasonable timeframe.

6. Children

The Site is intended for a professional audience and is not directed at children under 13. We do not knowingly collect personal information from children.

7. Security

The Site is served over TLS with HTTP Strict Transport Security. Our admin surface is gated by IP allowlist and mutual TLS at the edge. Database access is split across least-privilege roles so that even an application compromise cannot read drafts or the subscriber list.

8. Updates

We may revise this notice as our practices evolve. The effective date at the top reflects the most recent revision. Material changes will be flagged on the front page or in the daily briefing.

9. Contact

Privacy questions and requests: [email protected].