Legal
Privacy
What Security Artifacts collects, what it does not, and what is visible to other people. Written to match the code rather than to cover every eventuality.
The short version
There is no analytics on this site. No Google Analytics, no Plausible, no pixel, no advertising network, and no cookie banner, because there are no cookies to consent to beyond the one that keeps you signed in.
If you never create an account, the only record of your visit is an ordinary web server log.
If you only read
Vercel hosts the site and keeps short-lived request logs that include IP addresses, in the way every web server does. They are used to keep the site running and to investigate abuse. Nothing is built from them, nothing is sold, and no profile of you is assembled.
Cloudflare sits in front of the site and inspects requests to filter attacks. That is a security function, and it processes connection metadata to do it.
If you sign in
Supabase stores:
- Your email address. Needed to identify the account and send sign-in links. It is never shown to other members and never appears on a public page.
- A session cookie. HttpOnly, so page scripts cannot read it. It exists to keep you signed in and does nothing else.
- Anything you choose to add: display name, headline, handle, team colour. All optional.
Signing in runs a Cloudflare Turnstile bot check. It is the only third-party script on the site, it loads on the sign-in page alone, and Cloudflare processes your IP address and browser characteristics to decide whether you are automated. It is not an analytics product and does not follow you between pages.
What other people can see
This is the part worth reading carefully, because it is the only place where something you enter becomes public.
Setting a handle publishes a profile. If you set one on your account page, a page appears at /members/your-handle showing your display name, your headline, your team colour, the month you joined, and your published community posts.
Your email is never on it. The public profile is served by a database view that names five columns and cannot return a sixth, so an email address cannot reach that page by accident or by a later mistake in the code.
No handle, no page. Members without one do not appear anywhere public. Clearing the field removes the profile.
Anything you post to the community is public once a moderator approves it, along with the byline you had at the time.
If you subscribe to the newsletter
Your address is stored with a confirmation status. It is double opt-in, so nothing is sent until you click the confirmation link, and every email carries a one-click unsubscribe. There is no tracking pixel, so we do not know whether you opened it.
If you pay
Card details are entered on Stripe's own hosted checkout and never reach this site or its database. What is stored here is a Stripe customer reference and your subscription status.
Who else processes your data
- Supabase, database, authentication
- Vercel, hosting and request logs
- Cloudflare, DNS, attack filtering, the sign-in bot check
- Stripe, payments
- Resend, transactional and newsletter email
Keeping or deleting it
Account data is kept while the account exists. Ask and it will be deleted, along with the profile. Published community posts are handled separately on request, because a thread with half its replies removed stops making sense to the people still reading it, and we would rather talk about anonymising the byline than silently break a conversation.
You can ask what is held about you and get a copy. Contact details are on the masthead.
Where your data physically is
Worth stating plainly, because "in the cloud" is not an answer:
- The database runs in London (AWS
eu-west-2). Your account, profile and community posts live there. - The application runs in London too, on Vercel's London region, deliberately co-located with the database.
- Cloudflare and Vercel both operate global networks, so a request from you may be handled at an edge location near you before reaching London. That is how content delivery works and it applies to every site behind either of them.
- Resend sends the email, from its Ireland region (eu-west-1), so a message and the address it went to stay inside the EU. It only ever receives an address you gave us: nothing about you reaches it unless you create an account or subscribe to the newsletter.
- Stripe is a US company and processes payment data accordingly. If you never pay, it receives nothing about you at all.
How this site is built, honestly
Security Artifacts is one person. There is no security team reviewing this, no legal department, no compliance function, and no board. It is built carefully and to the best of my ability, and that is a different claim from being audited.
What that means concretely, so you can judge for yourself rather than take a reassurance:
- The database enforces the rules, not the website. Every table has row-level security, so an error in the application cannot show you someone else's data. Public profiles are served by a view that names five columns and is incapable of returning your email address.
- Passwords are never seen by this site. Authentication is handled by Supabase. Card details are never seen either; those go directly to Stripe's own page.
- The smallest possible amount is collected. No analytics is the strongest privacy measure available, and it is free. Data that was never collected cannot leak.
- There will be mistakes. If you find one, please tell me rather than anyone else first. Contact is on the masthead, and a security issue reported in good faith will be fixed and credited if you want it to be.
Changes
If this site starts collecting something not named on this page, this page is wrong and should be corrected before the change ships. That is the standard it is held to.