Privacy

Reading without an account

Public pages need no account and set no cookies. A cookie is set only when a reader switches between the site’s two page designs.

Your browser keeps some settings in its own storage: theme, density, reduced motion and the Following list. Without an account, the Following list stays on the device. To show how many new articles a followed item has, the page sends the followed names to CyberSIXT; nothing from that request is stored.

CyberSIXT runs no analytics or advertising scripts, and its own server-side event counting is switched off. IP addresses are not written to CyberSIXT’s databases. Some rate limits on account actions keep a keyed hash of the IP address until the limit window ends, at most about a day.

Services that handle requests

• Cloudflare hosts the site and its databases. It receives every request, including the IP address and browser headers, to serve and protect the site.
• Google Fonts serves the typefaces, so your browser requests the font files from Google.
• Cloudflare Turnstile checks that a person is using a form. It loads only during account setup and sign-in and on pages for signed-in features, never on public reading pages.
• OpenAI writes the summaries, headlines and the Briefing from published articles and public vulnerability records. No reader data is sent to it: no account details, searches, follows or IP addresses.

Accounts

An account is optional. It is opened with a 24-character key, with no name or email address. The key is shown once. CyberSIXT stores only a keyed hash (HMAC) of it, so a lost key cannot be recovered. An account is stored only when its first follow or saved search is saved.

An account holds:

• Follows: the CVEs, vendors, threat actors and stories you follow, with removal markers used to keep devices in step.
• Saved searches: a name and a query for each.
• Signed-in devices: a hash of each session token, a device label of browser and operating-system family only (for example “Firefox on macOS”), the sign-in method, sign-in time, the last day used and the expiry. No IP address or full browser string is stored.
• Account dates: the day it was created and the day it was last used.
• Passkeys, if added: the credential ID, public key, signature counter, the name you give it, and the days it was added and last used.
• API key, if created: a hash of the key and its creation time.
• Alerts, if created: their names, subjects, filters and schedules, and an inbox of matched articles and records.
• Delivery channels, if added: the destination (a webhook address, an ntfy.sh topic or a browser push subscription), stored encrypted. Private feed addresses are stored as hashes.

Account cookies are used only to keep you signed in. The session cookie is HttpOnly and Secure. Before an account’s first save, a signed cookie lasting 24 hours holds keyed identifiers, never the key.

Alert delivery

Alerts reach outside services only through channels you add. Slack, Discord, Microsoft Teams, ntfy.sh or your own HTTPS endpoint receive the alert name and the titles and links of matched items. Browser notifications go through your browser’s push service (Google, Mozilla, Apple or Microsoft), encrypted so that only your device can read them.

Email delivery is optional. The address is stored encrypted, with a keyed hash used to prevent duplicates. Nothing is sent to it until the link in a confirmation email is used. The link expires after 24 hours. Every alert email has a link to stop emails, and using it, or removing the email channel, deletes the address. After a stop request, bounce or complaint, a keyed hash of the address is kept, not the address itself, so that it is not emailed again by mistake. Email is sent with Cloudflare Email Sending.

Retention

A maintenance job runs every 30 minutes and applies the periods listed above. It also removes expired sessions. Signing in, and visiting the site while signed in, count as use. An account that still has alerts is not treated as empty.

Export and deletion

The account page offers a JSON download of account dates, follows, saved searches, signed-in devices, alert rules with subjects, filters and modes, channel types and display names, inbox items within the 30-day retention period, feed metadata and passkey labels and dates. It includes only webhook hosts, ntfy topics and your own email address with its confirmation status; secret URLs, tokens and passkey credentials are excluded. Large inboxes are paged: follow the next link in the JSON to download the remaining items.

Deleting the account needs the current key, or a passkey sign-in from the last five minutes. It removes the follows, saved searches, sessions, passkeys, API key, alerts, channels, alert history and email address. The Following list kept in a browser stays until it is removed in that browser.

Questions and requests

Questions about this page and requests about your data go through the contact page. CyberSIXT cannot identify an account from an email message and cannot restore a lost key.