Privacy Policy

On this page

Last Updated: August 13, 2026

The Short Version

I collect very little. The public editorial pages use no advertising or analytics cookies, advertising pixels, or user-level tracking. I use cookie-free Cloudflare Web Analytics for aggregate site-usage and page-performance reporting, browser preferences stay on your device, and contact form data is only collected when you choose to send it. Strictly necessary security cookies are limited to authentication and protected administration flows.

For a security blog, I think that’s how it should be.

Who I Am

Nine Lives, Zero Trust is a personal security blog operated by Jerrad Dahlager. This site is hosted on Cloudflare Pages at nine-lives-zero-trust.pages.dev.

Contact: Email: [email protected] LinkedIn: linkedin.com/in/jerraddahlager

What I Collect

Information You Provide Voluntarily

RSS & Follow.it Subscriptions

You can subscribe to blog updates via:

RSS feed: No personal data collected by me. Your RSS reader handles everything locally.
follow.it: If you subscribe through follow.it, your email is managed by their platform, not by me. See follow.it’s Privacy Policy.

I do not directly collect or store email addresses for subscriptions.

Blog Feedback

Blog posts include links to discuss on LinkedIn or contact via email. If you reach out through these channels, your interaction is governed by LinkedIn’s or your email provider’s privacy policies respectively.

Contact Form

If you use the contact form, I receive the information you choose to provide:

Name
Email address
Topic
Optional relevant link
Message body

The form is processed by a Cloudflare Worker that emails your submission to me through Cloudflare Email Routing. It does not support file uploads and should not be used to submit secrets, tokens, customer data, or confidential logs. To filter spam and abuse, each submission also records the submission timestamp, Cloudflare request ID (CF-Ray), your approximate country (from Cloudflare’s CF-IPCountry header), and your browser’s User-Agent string alongside your message. Submissions are not stored in a database — they arrive in my email inbox and may appear briefly in Cloudflare logs long enough for me to respond and troubleshoot delivery.

Content Security Policy Reports

Browsers may send a report to /csp-report when this site’s Content Security Policy is violated. A bounded report can include the document URL, violated and effective directives, blocked URL, source-file URL and line, response status, disposition, and a short script sample. The endpoint also logs the Cloudflare request ID (CF-Ray) and approximate country so I can distinguish site regressions from abusive traffic. Reports are sent to this site’s Cloudflare Pages Function and may appear in Cloudflare operational logs; they are used only to diagnose and protect the site.

For abuse prevention, the endpoint processes the connecting IP in a short-lived in-memory counter and stores a SHA-256 digest of it in a Cloudflare edge-cache marker for 10 seconds. It does not put the plaintext IP into the report log or a durable application database. The digest is a transient deduplication key, not an advertising identifier.

Information Stored in Your Browser Only

This site uses browser localStorage to remember your preferences. This data never leaves your device and is never transmitted to any server:

Data	Purpose	Stored Where
Theme preference	Remember your chosen color theme	localStorage
Reading list	Save posts for later reading	localStorage
Threat feed bookmarks	Save threat intelligence items	localStorage
Threat feed view settings	Remember feed filters, sorting, date range, page size, and last visit	localStorage
Table of contents state	Remember if TOC is collapsed	localStorage
Optional site features	Remember achievements, cat lives, theme history, and dismissed launch notices	localStorage

You control this data. Clear your browser’s localStorage anytime to remove it. I cannot access it.

Tracking and Data I Do NOT Use

No advertising or analytics cookies on public editorial pages: Strictly necessary HttpOnly security cookies are used only for the GitHub OAuth flow and Cloudflare Access-protected administration surfaces.
Privacy-first aggregate analytics: I use Cloudflare Web Analytics, which is cookie-free and does not track individual users across Cloudflare customers’ properties. It reports visits, page views, page-load timing and Core Web Vitals, with aggregate dimensions such as country, host and path, referrer, device type, browser, operating system, site, and navigation type. Cloudflare says Web Analytics does not log query strings.
No advertising trackers: No pixels, no retargeting, no ad networks.
No advertising or cross-site tracking: No device fingerprinting for ads, no cross-site tracking, no behavioral profiles.
No precise location: I don’t use GPS or request your precise location. (The contact form does record your approximate country, derived from Cloudflare’s edge headers, for spam and abuse filtering — see the Contact Form section above.)

Third-Party Services

I use a minimal set of third-party services to operate this site:

Cloudflare (Hosting & CDN)

This site is hosted on Cloudflare Pages. Cloudflare may process your IP address and standard HTTP request information (browser type, referring page, etc.) for security, performance, and operational purposes. See Cloudflare’s Privacy Policy.

Cloudflare Access protects administration and preview surfaces and uses a necessary CF_Authorization cookie to maintain that authenticated session. The site’s GitHub OAuth helper uses a short-lived HttpOnly, Secure, SameSite CSRF cookie during sign-in. These cookies are security controls, not advertising or analytics identifiers.

Cloudflare Web Analytics

The public site loads Cloudflare’s Web Analytics performance beacon. Cloudflare documents the available high-level metrics and performance data, the aggregate dimensions, and the fact that the service does not track individual users across customer properties. The service is not limited to a page-view counter: it records client-side usage and performance signals described above. It does not set an analytics cookie on this site, and Cloudflare says it does not log query strings in Web Analytics.

Cloudflare Turnstile (Contact Form Spam Protection)

The contact form uses Cloudflare Turnstile to reduce spam and automated abuse. Turnstile runs in your browser on the contact page and the submitted token is verified server-side by Cloudflare before an email can be sent. See Cloudflare’s Privacy Policy.

GitHub and Sveltia CMS (Protected Administration)

The Access-protected /admin/ editor uses a pinned Sveltia CMS browser bundle delivered by unpkg and GitHub OAuth/API access. These resources are not loaded on public editorial pages. An authorized editor who opens the administration surface is subject to GitHub’s privacy statement and the delivery providers’ practices; the resulting GitHub bearer token is stored in that editor’s browser storage because the CMS requires it. Public readers are not asked to sign in and do not enter this flow.

Follow.it (RSS Subscriptions)

If you subscribe via follow.it, your email is stored and managed by their platform. They handle email notifications when new posts are published. I do not have direct access to your email address. See follow.it’s Privacy Policy.

Google Fonts

I use Google Fonts (Outfit and JetBrains Mono) for typography. Google may log font requests. See Google’s Privacy Policy. No cookies are set by Google Fonts on this site.

Blog posts include links to my LinkedIn profile for discussion. If you engage via LinkedIn, your interaction is governed by LinkedIn’s Privacy Policy.

Threat Feeds API

The Threat Feeds page reads durable public threat-intelligence snapshots from a Cloudflare Worker. A scheduled GitHub Actions publisher builds those snapshots from CISA KEV, NVD, FIRST EPSS, abuse.ch feeds, Exploit-DB, GitHub Security Advisories, and the security-news sources identified on the Threat Feeds page. The API uses your incoming IP address only to maintain a short-lived abuse-prevention counter: the normal Cache API counter expires after 60 seconds, and an exceptional in-memory fallback exists only within a Worker isolate. The application does not write IP addresses into the durable feed snapshot. Cloudflare may still process standard request information as described above.

Data Retention

Data Type	Retention Period
Follow.it subscriptions	Managed by follow.it - see their privacy policy
Contact form submissions	As long as needed to respond and maintain records, typically no longer than 90 days
CSP violation reports	Cloudflare operational-log retention; used only for site security and troubleshooting
CSP report rate-limit state	In-memory counter for its short window; SHA-256 edge marker for 10 seconds
LinkedIn discussions	Governed by LinkedIn’s data retention policies
localStorage data	Until you clear your browser storage
Threat-feed API rate-limit state	Cache counter: 60 seconds; exceptional in-memory fallback: ephemeral Worker-isolate lifetime
Cloudflare Web Analytics beacon data	Cloudflare’s current FAQ says it retains unsampled beacon data for 7 days, then aggregates it for longer-term storage; the dashboard and GraphQL API expose the previous 6 months. The FAQ does not publish a deletion date for the longer-term aggregate.

Your Rights

Depending on your location, you may have the following rights:

For All Users

Access: Request what data I have about you
Deletion: Request I delete your data
Unsubscribe: Manage your follow.it subscription directly through their platform

For California Residents (CCPA/CPRA)

I do not sell personal information
I do not share personal information for cross-context behavioral advertising
You have the right to know what personal information I collect and how it’s used
You have the right to delete your personal information
You have the right to opt-out of sales (not applicable, I don’t sell data)
You will not be discriminated against for exercising your privacy rights

Legal basis: Consent for contact form submissions and legitimate interest for site security/operations
Right to withdraw consent: Manage your subscription through follow.it
Right to erasure: Contact follow.it directly for subscription data, or contact me for any other data
Right to lodge a complaint: You may file a complaint with your local data protection authority

Data Security

I implement security measures appropriate for a site that collects minimal data:

HTTPS everywhere: All connections are encrypted via TLS
Security headers: Strict CSP, HSTS, X-Frame-Options, and other protections
Limited server-side data: Contact submissions are validated, size-limited, and not stored in a public database
Third-party vetting: I only use reputable, privacy-conscious service providers

Changes to This Policy

I may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last Updated” date.

Contact Me

Questions about this Privacy Policy? Concerns about your data?

Email: [email protected] LinkedIn: linkedin.com/in/jerraddahlager

I’ll respond within 30 days.

As a security professional, I believe privacy isn’t just a policy, it’s a practice. This site is designed to minimize data collection because that’s the most effective way to protect your privacy.