Privacy Policy

Last Updated: September 5, 2026

The Short Version

I collect very little. The public editorial pages use no advertising or analytics cookies, advertising pixels, or user-level tracking. I use cookie-free Cloudflare Web Analytics for aggregate site-usage and page-performance reporting, browser preferences stay on your device, and contact form data is only collected when you choose to send it. Cloudflare Access can use necessary security cookies on protected routes. Browser editing and its GitHub OAuth sign-in flow are retired.

For a security blog, I think that’s how it should be.

Who I Am

Nine Lives, Zero Trust is a personal security blog operated by Jerrad Dahlager. The public site is nineliveszerotrust.com, hosted on Cloudflare Pages; the nine-lives-zero-trust.pages.dev project hostname is Access-protected.

Contact: Email: [email protected] LinkedIn: linkedin.com/in/jerraddahlager

What I Collect

Information You Provide Voluntarily

RSS & Follow.it Subscriptions

You can subscribe to blog updates via:

• RSS feed: No personal data collected by me. Your RSS reader handles everything locally.
• follow.it: If you subscribe through follow.it, your email is managed by their platform, not by me. See follow.it’s Privacy Policy.

I do not directly collect or store email addresses for subscriptions.

Blog Feedback

Blog posts include links to discuss on LinkedIn or contact via email. If you reach out through these channels, your interaction is governed by LinkedIn’s or your email provider’s privacy policies respectively.

Contact Form

If you use the contact form, I receive the information you choose to provide:

• Name
• Email address
• Topic
• Optional relevant link
• Message body

The form is processed by a Cloudflare Worker that emails your submission to me through Cloudflare Email Routing. It does not support file uploads and should not be used to submit secrets, tokens, customer data, or confidential logs. To filter spam and abuse, each submission also records the submission timestamp, Cloudflare request ID (CF-Ray), your approximate country (from Cloudflare’s CF-IPCountry header), and your browser’s User-Agent string alongside your message. Submissions are not stored in a database — they arrive in my email inbox and may appear briefly in Cloudflare logs long enough for me to respond and troubleshoot delivery.

The destination inbox is hosted by Google Gmail, so Google processes the submission and included metadata for email delivery and storage under Google’s Privacy Policy. The contact endpoint also forwards your connecting IP to Cloudflare Turnstile for verification. For submission limits, it derives a SHA-256 identifier from the IP and current ten-minute window and stores only the window and count in a Cloudflare Durable Object. The application schedules that counter’s removal when the window ends; delayed cleanup does not extend the active allowance. Neither the raw IP nor message content is stored in that counter, and the application does not include the IP in the delivered email. Cloudflare’s SQLite storage recovery system can retain recoverable database state for up to 30 days.

Content Security Policy Reports

Browsers may send a report to /csp-report when this site’s Content Security Policy is violated. A bounded report can include the document URL, violated and effective directives, blocked URL, source-file URL and line, response status, and disposition. Before logging HTTP(S) URLs, the endpoint removes usernames, passwords, query strings, and fragments, retaining the origin and path. Other URL types are reduced to their scheme, and script samples are not logged. Diagnostic labels such as inline or eval are retained. URL paths may still contain identifying information. The endpoint also logs the Cloudflare request ID (CF-Ray) and approximate country so I can distinguish site regressions from abusive traffic. Reports are sent to this site’s Cloudflare Pages Function and may appear in Cloudflare operational logs; they are used only to diagnose and protect the site.

For abuse prevention, the endpoint processes the connecting IP in a short-lived in-memory counter and stores a SHA-256 digest of it in a Cloudflare edge-cache marker for 10 seconds. It does not put the plaintext IP into the report log or a durable application database. The digest is a transient deduplication key, not an advertising identifier.

Information Stored in Your Browser Only

This site uses browser localStorage to remember your preferences. This data never leaves your device and is never transmitted to any server:

You control this data. Clear your browser’s localStorage anytime to remove it. I cannot access it.

Separately, the site’s service worker stores public pages and assets in your browser’s Cache Storage for offline use, including a fixed precache and a bounded runtime cache. Clearing localStorage does not remove that offline cache; clear the site’s browser data or Cache Storage to remove it. These cached files are not a server-side reading history.

Tracking and Data I Do NOT Use

• No advertising or analytics cookies on public editorial pages: Cloudflare Access uses necessary security cookies on protected routes. The retired OAuth endpoint expires its former CSRF cookie instead of starting a sign-in flow.
• Privacy-first aggregate analytics: I use Cloudflare Web Analytics, which is cookie-free and does not track individual users across Cloudflare customers’ properties. It reports visits, page views, page-load timing and Core Web Vitals, with aggregate dimensions such as country, host and path, referrer, device type, browser, operating system, site, and navigation type. Cloudflare says Web Analytics does not log query strings.
• No advertising trackers: No pixels, no retargeting, no ad networks.
• No advertising or cross-site tracking: No device fingerprinting for ads, no cross-site tracking, no behavioral profiles.
• No precise location: I don’t use GPS or request your precise location. (The contact form does record your approximate country, derived from Cloudflare’s edge headers, for spam and abuse filtering — see the Contact Form section above.)

Third-Party Services

I use a minimal set of third-party services to operate this site:

Cloudflare (Hosting & CDN)

This site is hosted on Cloudflare Pages. Cloudflare may process your IP address and standard HTTP request information (browser type, referring page, etc.) for security, performance, and operational purposes. See Cloudflare’s Privacy Policy.

Cloudflare Access remains on the retired /admin routes and protected preview surfaces, using a necessary CF_Authorization cookie for Access sessions. The retired GitHub OAuth endpoint expires its former HttpOnly, Secure, SameSite CSRF cookie when visited; it no longer starts or completes editor sign-in. These are security controls, not advertising or analytics identifiers.

Cloudflare Web Analytics

The public site loads Cloudflare’s Web Analytics performance beacon. Cloudflare documents the available high-level metrics and performance data, the aggregate dimensions, and the fact that the service does not track individual users across customer properties. The service is not limited to a page-view counter: it records client-side usage and performance signals described above. It does not set an analytics cookie on this site, and Cloudflare says it does not log query strings in Web Analytics.

Cloudflare Turnstile (Contact Form Spam Protection)

The contact form uses Cloudflare Turnstile to reduce spam and automated abuse. Turnstile runs in your browser on the contact page and the submitted token is verified server-side by Cloudflare before an email can be sent. See Cloudflare’s Privacy Policy.

Retired Browser Editor and Local Cleanup

Browser editing and its GitHub OAuth sign-in flow were retired on September 5, 2026. The site no longer loads Sveltia, Decap, or TinaCMS, an unpkg editor bundle, or a GitHub API editor integration. The former editor and authentication endpoints provide no editor login or repository-write flow.

Public pages make a local-only cleanup attempt for known session entries left by those retired editors and the old Sveltia IndexedDB database. The code removes these exact entries without reading or transmitting their values, clearing unrelated storage, or changing themes, reading lists, or bookmarks. Browser storage restrictions or an older open editor tab can delay cleanup. Provider-side credential revocation is separate from this local browser cleanup.

Follow.it (RSS Subscriptions)

If you subscribe via follow.it, your email is stored and managed by their platform. They handle email notifications when new posts are published. I do not have direct access to your email address. See follow.it’s Privacy Policy.

Google Fonts

I use Google Fonts (Outfit and JetBrains Mono) for typography. Google may log font requests. See Google’s Privacy Policy. No cookies are set by Google Fonts on this site.

Google Gmail (Contact Inbox)

Contact submissions are delivered to a Google-hosted Gmail inbox, including the message and the metadata listed above. Google processes and stores that email as the mailbox provider; see Google’s Privacy Policy.

LinkedIn (Social Engagement)

Blog posts include links to my LinkedIn profile for discussion. If you engage via LinkedIn, your interaction is governed by LinkedIn’s Privacy Policy.

Threat Feeds API

The Threat Feeds page reads durable public threat-intelligence snapshots from a Cloudflare Worker. A scheduled GitHub Actions publisher builds those snapshots from CISA KEV, NVD, FIRST EPSS, abuse.ch feeds, Exploit-DB, GitHub Security Advisories, and the security-news sources identified on the Threat Feeds page. The API uses your incoming IP address only to maintain a short-lived abuse-prevention counter: the normal Cache API counter expires after 60 seconds, and an exceptional in-memory fallback exists only within a Worker isolate. The application does not write IP addresses into the durable feed snapshot. Cloudflare may still process standard request information as described above.

Data Retention

Your Rights

Depending on your location, you may have the following rights:

For All Users

• Access: Request what data I have about you
• Deletion: Request I delete your data
• Unsubscribe: Manage your follow.it subscription directly through their platform

For California Residents (CCPA/CPRA)

• I do not sell personal information
• I do not share personal information for cross-context behavioral advertising
• You have the right to know what personal information I collect and how it’s used
• You have the right to delete your personal information
• You have the right to opt-out of sales (not applicable, I don’t sell data)
• You will not be discriminated against for exercising your privacy rights

For EU/EEA Residents (GDPR)

• Legal basis: Consent for contact form submissions and legitimate interest for site security/operations
• Right to withdraw consent: Manage your subscription through follow.it
• Right to erasure: Contact follow.it directly for subscription data, or contact me for any other data
• Right to lodge a complaint: You may file a complaint with your local data protection authority

Data Security

I implement security measures appropriate for a site that collects minimal data:

• HTTPS everywhere: All connections are encrypted via TLS
• Security headers: Strict CSP, HSTS, X-Frame-Options, and other protections
• Limited server-side data: Contact submissions are validated, size-limited, and not stored in a public database
• Third-party vetting: I only use reputable, privacy-conscious service providers

Changes to This Policy

I may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last Updated” date.

Contact Me

Questions about this Privacy Policy? Concerns about your data?

Email: [email protected] LinkedIn: linkedin.com/in/jerraddahlager

I’ll respond within 30 days.

As a security professional, I believe privacy isn’t just a policy, it’s a practice. This site is designed to minimize data collection because that’s the most effective way to protect your privacy.