Privacy
Privacy policy
Last updated 13 August 2026.
The short version
This site is static files. There are no accounts, no logins, no forms and no newsletter, so there is nothing for you to hand over. What is recorded is the ordinary technical detail of a web request, plus enough to count which pages are read. Nothing is sold, and no attempt is made to identify you across other websites.
What is recorded
- Request and analytics records. Loading a page records your IP address, browser user-agent, the page requested, the referring page if your browser sends one, and the country the request came from. Raw request logs are kept for seven days; the aggregate counts derived from them are kept indefinitely and are not linked to you.
- Cloudflare. Traffic reaches this site through Cloudflare, which acts as a content delivery network and filters malicious requests. It necessarily sees your IP address and may set a security cookie.
- Advertising. This site may in future display advertising supplied by Google AdSense. If and when it does, Google and its partners use cookies and similar identifiers to serve and measure advertising, and may personalise it based on your prior browsing. You can review or change that at Google Ads Settings, or opt out of personalised advertising from participating vendors at optout.aboutads.info.
What stays in your browser
The watchlist is held entirely in your own browser — in local storage and in the address bar. The vendors you select are never transmitted to this site, and the "new since your last visit" marker is calculated from a timestamp we never receive. That is deliberate: a site about the consequences of mishandled data should not quietly accumulate a profile of what its readers are worried about.
Cookies
The site sets no cookies of its own. Any cookie you receive comes from Cloudflare's security layer, or from advertising if it is enabled. Blocking them does not break anything here.
Legal basis and your rights
Where UK GDPR applies, the lawful basis for the technical records above is legitimate interest — operating and securing a website and understanding whether its pages are read. Advertising cookies rely on consent where local law requires it.
You may ask what is held about you, ask for it to be deleted, object to processing, or complain to the Information Commissioner's Office. Requests go to hello@black-hat.co.uk. Because nothing here identifies you by name, an IP address and an approximate time is usually needed to find the relevant records.
Organisations named on this site
Enforcement pages name organisations the ICO has already named in published notices, and vulnerability pages name vendors and products. That is public information restated, not personal data collected. If you believe a page about your organisation is inaccurate, see contact.
External links
Pages link out to CISA, the NVD, FIRST, the ICO and vendor advisories. Those sites have their own privacy practices and this policy does not cover them.
Changes
If this policy changes, the date above changes with it.