Privacy Policy
What this site records, what happens to anything you send us, and how to get it back or have it deleted.
Last updated
The short version
We are a security company, so we will be direct about this. This site sets no cookies, runs no advertising or cross-site tracking, and does not sell, rent, or share your personal information with anyone for their own purposes.
Analytics here are aggregate and anonymous — we can see that a page was read from a particular country on a particular browser, and we cannot see that it was you. The only time we hold anything that identifies you personally is when you deliberately send it to us, by submitting a form or sending an email.
The rest of this page is the detail behind those three paragraphs.
What the site records automatically
Every page view is counted by Vercel Web Analytics, which is a privacy-focused, cookieless product. For each view it records:
- the page path, and the route pattern behind it
- the referring URL, if you arrived from a link
- an approximate location — country, region, and city — derived from your IP address
- your operating system, browser, and their versions
- your device type: mobile, tablet, or desktop
- the timestamp
⚠️ What it does not do is the part that matters. It sets no cookie and stores no persistent identifier. Instead of following a visitor, it derives a temporary hash from the incoming request and discards it after 24 hours. There is no profile, no cross-site history, and no way for us — or for Vercel — to reassemble your browsing into a session that points at a person.
Your full IP address is used to derive the approximate location and is not retained in the analytics record.
Separately, our hosting provider keeps standard server request logs for a short period for operational and security purposes — the same logs any web server writes, used to investigate errors, abuse, and attacks.
Cookies
This site sets no cookies. There is nothing to consent to, which is why you are not being asked to dismiss a banner.
Because we do not track you across sites, there is also nothing for a Do Not Track or Global Privacy Control signal to switch off. We honour those signals by not doing the thing in the first place.
We also self-host our fonts. Many sites load fonts directly from a third-party CDN, which quietly discloses your IP address and the page you are reading to that provider on every visit. Ours are served from this domain.
When you contact us
If you submit a form on this site or email us, we receive what you chose to send: typically your name, your email address, your employer, and the description of what you want tested. We use it to answer you, to scope and price the work, and to keep a record of the inquiry.
Two protections can sit in front of our forms. When enabled, both process limited technical data on our behalf:
- a bot check, which evaluates the submission to confirm a human sent it
- rate limiting, which briefly holds a value derived from your IP address to stop the same source flooding the endpoint
Neither is used to identify you or to build a profile, and neither is used for any purpose beyond keeping the form usable.
We do not use what you send us to train models, and we do not add you to a marketing list because you asked a question. Those are separate and opt-in.
Newsletter
This site does not currently offer a newsletter signup. If that is added later, subscription will use double opt-in: you will receive an email asking you to confirm, and we will send nothing until you do.
Who else processes your data
We keep the list of third parties deliberately short. Each one processes data only to provide its function to us:
- Vercel — hosting, content delivery, and the analytics described above
- Microsoft Teams and/or Discord — the operations channels that receive a contact-form inquiry (only the channels we have configured)
- Cloudflare — DNS, and the bot check in front of our forms when that check is enabled
- Upstash — the short-lived rate-limiting store when that check is enabled
- Amazon Web Services — storage and delivery of images on this site
These providers are located in, or process data in, the United States. We do not transfer your data to anyone for their own marketing, analytics, or resale.
How long we keep things
- Analytics: retained in aggregate by our analytics provider on a rolling window, currently 12 months. Individual records are anonymous from the moment they are collected, so there is nothing in them to delete.
- Rate-limiting values: minutes.
- Enquiries and correspondence: kept as long as needed to answer you and to maintain a record of the engagement or the reason we did not proceed, then deleted. If you ask us to delete it sooner, we will.
Your choices and your requests
Wherever you live, you can ask us to:
- tell you what personal information we hold about you
- send you a copy of it
- correct it if it is wrong
- delete it
- stop using it for a particular purpose
Email info@brackish.io and say what you want. We will not charge you, and we will not make you create an account to ask. We may need to confirm you control the email address in question before acting on a request about it, which is a protection for you rather than an obstacle.
Depending on where you live, you may have these rights under a specific law such as the GDPR or the CCPA. We apply the list above to everyone regardless, because maintaining two standards would mostly be a way of giving some people less.
How we protect it
Enquiries reach us over TLS and are stored in access-controlled systems. This site is statically generated, has no database, and no user accounts, which removes whole categories of risk rather than mitigating them.
⚠️ If you find a vulnerability in this site or any Brackish service, please report it to security@brackish.io. Our security.txt has the machine-readable version. We will not pursue you for a good-faith report.
Children
This site is aimed at organizations buying security testing. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe we have, email us and we will delete it.
Changes
If we change how any of this works, we will update this page and move the date at the top. If a change is significant and affects information we already hold, we will do more than quietly edit the page.
Contact
Privacy questions and requests: info@brackish.io Security reports: security@brackish.io