dr.chaos

Privacy

Privacy policy

This is a security blog run by people who dislike surveillance, so the short version is easy: no ad trackers, no third-party analytics, no cookies for visitors, and we don’t sell data. The details below describe what the site’s own code does; where a third party is involved, we say so rather than promise things we can’t control.

Cookies

Reading this site sets zero cookies. Cookies are issued only to people who sign in to the publishing dashboard, and are strictly functional: an HttpOnly session cookie, a short-lived (five-minute) cookie while a two-factor code is pending, and a short-lived cookie that shows freshly generated recovery codes once. If you don’t log in to write articles, you never get any of them. There are no consent banners because there is nothing to consent to.

Your browser’s local storage is used only for conveniences that never leave your device: your light/dark theme choice and, if you play with the hidden terminal, its settings, scores and discoveries. Clear them any time from your browser, or with the terminal’s own reset commands.

Analytics

We run minimal, first-party analytics to see which articles people read. For each page view we store:

  • the path of the page (e.g. /blog/some-article),
  • the referring site’s domain only — never the full URL, and same-site referrers are dropped,
  • a salted one-way hash derived from connection metadata that rotates every day.

Raw IP addresses and user-agent strings are never written to the database. Because the hash’s inputs include the current UTC day, it changes daily — unique-visitor counts reset every 24 hours and can’t be used to follow anyone over time. The analytics beacon also honors Do Not Track and Global Privacy Control: if your browser sends either signal, no beacon is sent at all.

Search

Site searches are logged as the exact text you typed, with the number of results and the time. No IP address, user agent, or visitor hash is stored with them. We use the list (especially searches that found nothing) to decide what to write next, and delete search records after 90 days. Please don’t type personal information into the search box.

Newsletter

The newsletter is double opt-in: subscribing stores your email address with a consent timestamp and sends a confirmation link — you receive nothing further until you click it. The link works once and expires after 48 hours; an address that never confirms is deleted after 30 days. We store the email address, its status (pending, confirmed, or unsubscribed), the timestamps of those changes, and a short note of where you signed up (for example the form or campaign you came from). No names, no profiles. Our emails ask the sending provider not to add open or click tracking; we send no tracking pixels of our own.

Every email we send includes a cryptographically signed (HMAC) unsubscribe link that works in one click, without logging in. Emails are delivered through a transactional email provider (Mailgun), which processes your address in order to deliver the message and has its own privacy policy. Because that is their service, we can request but not independently guarantee its tracking settings.

Embedded players

Podcast and video pages embed third-party players, and using them loads content from those services under their own privacy policies:

  • YouTube embeds use the privacy-enhanced youtube-nocookie.com domain and load only after you click play — until then the page shows a static thumbnail and no YouTube code runs.
  • SoundCloud players on the podcast page load as you scroll to them, and contact SoundCloud when they do; on the home page the player loads only after you press its button. Playing an episode streams it from SoundCloud.

Data deletion & contact

Want your newsletter record deleted entirely (not just unsubscribed), or have any question about this policy? Email privacy@drchaos.com from the address in question and we’ll remove it. Analytics data contains no identifiers, so there is nothing there to look up or delete for an individual.

This policy describes the site as deployed at https://www.drchaos.com and was last updated in October 2026. If the code’s behavior changes, this page changes with it.