Read the docs

Privacy policy

Last updated

This policy explains what personal data Threatist processes, why, and what rights you have. We collect personal data from you only when you subscribe to the newsletter or agree to analytics cookies, and we do not sell it. We also record public mentions of vulnerabilities on other websites; section 2 explains what we keep.

1. Who we are

Threatist (threatist.io) is run by Bartłomiej Nogieć, who is the controller of your personal data. You can reach him at [email protected].

2. What we collect

  • Newsletter: your email address, the record of your consent (when you subscribed and confirmed, and the version of the consent text and of this policy) and the state of your subscription.
  • Newsletter delivery: our email provider records whether each email was delivered and opened and which links in it were clicked, to keep delivery reliable and to detect abuse.
  • Technical data: like any website, our servers receive your IP address and the details of each request, such as the page, the time and your browser.
  • Analytics, only if you agree: how you use the site, such as pages viewed, your device and browser, approximate location and a cookie identifier.
  • Public mentions of vulnerabilities: to see which vulnerabilities are being discussed, we record public posts, repositories and articles that name a CVE id on Bluesky, GitHub and security news sites. For each we keep its address, when it was published, the CVE ids it names and, for news articles, the title. We do not keep the text of posts or the authors' names; to count distinct authors we keep a one-way hash of the author's account identifier. The address of a Bluesky post or a GitHub repository contains the account identifier.

3. Cookies and analytics

We use Google Analytics to understand how the site is used. Its cookies are set only after you accept them in the cookie banner; the site works the same if you refuse. You can change your choice at any time with "Cookie settings" at the bottom of every page. Your choice is kept in a necessary cookie, tt_consent, for 12 months.

Google Analytics is provided by Google Ireland Limited. Data may be transferred to Google LLC in the USA under the EU-US Data Privacy Framework. We do not use it for advertising.

4. Why we use it and on what legal basis

  • Sending the newsletter, including the delivery records described above: your consent (Article 6(1)(a) GDPR).
  • Analytics: your consent (Article 6(1)(a) GDPR).
  • Keeping the record of your consent after you unsubscribe, to show that we had it: our legitimate interest in defending legal claims (Article 6(1)(f) GDPR).
  • Delivering the site and protecting it from abuse: our legitimate interest in running a secure website (Article 6(1)(f) GDPR).
  • Recording public mentions of vulnerabilities: our legitimate interest in showing which vulnerabilities are being discussed (Article 6(1)(f) GDPR). This data comes from public sources, not from you, and you can object to it at any time.

5. Who receives data

We use service providers for hosting, content delivery and security, email delivery and web analytics. They process data only on our behalf, under data processing agreements. Where a provider processes data outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. We do not sell your data or share it for marketing.

6. How long we keep data

  • A subscription you do not confirm: deleted after 30 days.
  • An active subscription: as long as you stay subscribed. Every email has a link to unsubscribe at once.
  • After you unsubscribe or we stop sending: the record of your consent for 3 years, the period in which claims about it can be made, then deleted.
  • Technical data: only as long as needed to deliver and protect the site.
  • Analytics data: up to 14 months.
  • Public mentions: up to 60 days after the post was published.
  • Backups: encrypted copies of our database are kept for up to 30 days, so data deleted at your request leaves the backups within that time.

7. Your rights

You have the right to access your data and to get a copy of it, to have it corrected or deleted, to restrict its processing, to object to processing based on our legitimate interest, and to data portability. You can withdraw your consent at any time, by unsubscribing or in the cookie settings; this does not affect what we did before. Write to [email protected] and we will answer within a month.

You also have the right to complain to a data protection authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl), ul. Stawki 2, 00-193 Warsaw.

8. Changes and contact

When this policy changes we update the date at the top of this page. Questions about it or your data: [email protected].