Privacy Policy

On this page

Last Updated: July 14, 2026

The Short Version

I collect very little. No cookies, no advertising pixels, and no user-level tracking. I use cookie-free Cloudflare Web Analytics for aggregate page counts, browser preferences stay on your device, and contact form data is only collected when you choose to send it.

For a security blog, I think that’s how it should be.

Who I Am

Nine Lives, Zero Trust is a personal security blog operated by Jerrad Dahlager. This site is hosted on Cloudflare Pages at nine-lives-zero-trust.pages.dev.

Contact: Email: [email protected] LinkedIn: linkedin.com/in/jerraddahlager

What I Collect

Information You Provide Voluntarily

RSS & Follow.it Subscriptions

You can subscribe to blog updates via:

RSS feed: No personal data collected by me. Your RSS reader handles everything locally.
follow.it: If you subscribe through follow.it, your email is managed by their platform, not by me. See follow.it’s Privacy Policy.

I do not directly collect or store email addresses for subscriptions.

Blog Feedback

Blog posts include links to discuss on LinkedIn or contact via email. If you reach out through these channels, your interaction is governed by LinkedIn’s or your email provider’s privacy policies respectively.

Contact Form

If you use the contact form, I receive the information you choose to provide:

Name
Email address
Topic
Optional relevant link
Message body

The form is processed by a Cloudflare Worker that emails your submission to me through Cloudflare Email Routing. It does not support file uploads and should not be used to submit secrets, tokens, customer data, or confidential logs. To filter spam and abuse, each submission also records the submission timestamp, Cloudflare request ID (CF-Ray), your approximate country (from Cloudflare’s CF-IPCountry header), and your browser’s User-Agent string alongside your message. Submissions are not stored in a database — they arrive in my email inbox and may appear briefly in Cloudflare logs long enough for me to respond and troubleshoot delivery.

Information Stored in Your Browser Only

This site uses browser localStorage to remember your preferences. This data never leaves your device and is never transmitted to any server:

Data	Purpose	Stored Where
Theme preference	Remember your chosen color theme	localStorage
Reading list	Save posts for later reading	localStorage
Post reactions	Track which posts you’ve reacted to	localStorage
Threat feed bookmarks	Save threat intelligence items	localStorage
Table of contents state	Remember if TOC is collapsed	localStorage

You control this data. Clear your browser’s localStorage anytime to remove it. I cannot access it.

Information I Do NOT Collect

No cookies: I don’t use cookies. At all.
Privacy-first analytics: I use Cloudflare Web Analytics, which is cookie-free and does not track individual users. It only provides aggregate page view counts.
No advertising trackers: No pixels, no retargeting, no ad networks.
No advertising or cross-site tracking: No device fingerprinting for ads, no cross-site tracking, no behavioral profiles.
No precise location: I don’t use GPS or request your precise location. (The contact form does record your approximate country, derived from Cloudflare’s edge headers, for spam and abuse filtering — see the Contact Form section above.)

Third-Party Services

I use a minimal set of third-party services to operate this site:

Cloudflare (Hosting & CDN)

This site is hosted on Cloudflare Pages. Cloudflare may process your IP address and standard HTTP request information (browser type, referring page, etc.) for security, performance, and operational purposes. See Cloudflare’s Privacy Policy.

Cloudflare Turnstile (Contact Form Spam Protection)

The contact form uses Cloudflare Turnstile to reduce spam and automated abuse. Turnstile runs in your browser on the contact page and the submitted token is verified server-side by Cloudflare before an email can be sent. See Cloudflare’s Privacy Policy.

Follow.it (RSS Subscriptions)

If you subscribe via follow.it, your email is stored and managed by their platform. They handle email notifications when new posts are published. I do not have direct access to your email address. See follow.it’s Privacy Policy.

Google Fonts

I use Google Fonts (Outfit and JetBrains Mono) for typography. Google may log font requests. See Google’s Privacy Policy. No cookies are set by Google Fonts on this site.

Blog posts include links to my LinkedIn profile for discussion. If you engage via LinkedIn, your interaction is governed by LinkedIn’s Privacy Policy.

Threat Feeds API

The Threat Feeds page reads durable public threat-intelligence snapshots from a Cloudflare Worker. A scheduled GitHub Actions publisher builds those snapshots from CISA KEV, NVD, FIRST EPSS, abuse.ch feeds, Exploit-DB, GitHub Security Advisories, and the security-news sources identified on the Threat Feeds page. The API uses your incoming IP address only to maintain a short-lived abuse-prevention counter: the normal Cache API counter expires after 60 seconds, and an exceptional in-memory fallback exists only within a Worker isolate. The application does not write IP addresses into the durable feed snapshot. Cloudflare may still process standard request information as described above.

Data Retention

Data Type	Retention Period
Follow.it subscriptions	Managed by follow.it - see their privacy policy
Contact form submissions	As long as needed to respond and maintain records, typically no longer than 90 days
LinkedIn discussions	Governed by LinkedIn’s data retention policies
localStorage data	Until you clear your browser storage
Threat-feed API rate-limit state	Cache counter: 60 seconds; exceptional in-memory fallback: ephemeral Worker-isolate lifetime

Your Rights

Depending on your location, you may have the following rights:

For All Users

Access: Request what data I have about you
Deletion: Request I delete your data
Unsubscribe: Manage your follow.it subscription directly through their platform

For California Residents (CCPA/CPRA)

I do not sell personal information
I do not share personal information for cross-context behavioral advertising
You have the right to know what personal information I collect and how it’s used
You have the right to delete your personal information
You have the right to opt-out of sales (not applicable, I don’t sell data)
You will not be discriminated against for exercising your privacy rights

Legal basis: Consent for contact form submissions and legitimate interest for site security/operations
Right to withdraw consent: Manage your subscription through follow.it
Right to erasure: Contact follow.it directly for subscription data, or contact me for any other data
Right to lodge a complaint: You may file a complaint with your local data protection authority

Data Security

I implement security measures appropriate for a site that collects minimal data:

HTTPS everywhere: All connections are encrypted via TLS
Security headers: Strict CSP, HSTS, X-Frame-Options, and other protections
Limited server-side data: Contact submissions are validated, size-limited, and not stored in a public database
Third-party vetting: I only use reputable, privacy-conscious service providers

Changes to This Policy

I may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last Updated” date.

Contact Me

Questions about this Privacy Policy? Concerns about your data?

Email: [email protected] LinkedIn: linkedin.com/in/jerraddahlager

I’ll respond within 30 days.

As a security professional, I believe privacy isn’t just a policy, it’s a practice. This site is designed to minimize data collection because that’s the most effective way to protect your privacy.