Privacy

Privacy policy

This is a security blog run by people who dislike surveillance, so the short version is easy: no ad trackers, no third-party analytics, no cookies for visitors, and we can’t sell what we don’t collect. The details below describe what the site’s code actually does.

Cookies

Reading this site sets zero cookies. The only cookie the site ever issues is an HttpOnly session cookie for administrators signing in to the publishing dashboard — if you don’t log in to write articles, you never get one. There are no consent banners because there is nothing to consent to.

Analytics

We run minimal, first-party analytics to see which articles people read. For each page view we store:

• the path of the page (e.g. /blog/some-article),
• the referring site’s domain only — never the full URL, and same-site referrers are dropped,
• a salted one-way hash derived from connection metadata that rotates every day.

Raw IP addresses and user-agent strings are never written to the database. Because the hash’s inputs include the current UTC day, it changes daily — unique-visitor counts reset every 24 hours and can’t be used to follow anyone over time. The analytics beacon also honors Do Not Track and Global Privacy Control: if your browser sends either signal, no beacon is sent at all.

Newsletter

The newsletter is double opt-in: subscribing stores your email address with a consent timestamp and sends a confirmation link — you receive nothing further until you click it. We store the email address, its status (pending, confirmed, or unsubscribed), and the timestamps of those changes. Nothing else — no names, no profiles, no open or click tracking pixels.

Every email we send includes a cryptographically signed (HMAC) unsubscribe link that works in one click, without logging in. Emails are delivered through a transactional email provider, which processes your address solely to deliver the message.

Embedded players

Podcast and video pages embed third-party players, and using them loads content from those services under their own privacy policies:

• YouTube embeds use the privacy-enhanced youtube-nocookie.com domain and load only after you click play — until then the page shows a static thumbnail and no YouTube code runs.
• SoundCloud players load lazily on the podcast pages; playing an episode streams it from SoundCloud.

Data deletion & contact

Want your newsletter record deleted entirely (not just unsubscribed), or have any question about this policy? Email privacy@packet.zip from the address in question and we’ll remove it. Analytics data contains no identifiers, so there is nothing there to look up or delete for an individual.

This policy describes the site as deployed at https://www.packet.zip and was last updated in July 2026. If the code’s behavior changes, this page changes with it.