Short version: reading this site is anonymous. If you later subscribe or declare a stack, we store the minimum needed and never sell or share it. This policy describes both today's behavior and what changes when those features go live.
boxscore/security is a personal project operated by Ron Diver. For any privacy question or request, email rondiver@gmail.com.
The pages are static. We set no tracking cookies and run no analytics or advertising trackers that identify you. As with any website, the hosting provider (Vercel) processes standard technical request data such as IP address and user-agent to serve pages and protect the service; we do not use it to build profiles of readers.
When email is enabled: subscribing is double opt-in — we email you a confirmation link and send nothing until you confirm. We store your email address and a random token used to sign your unsubscribe and preference links; there are no passwords. Every email carries a one-click unsubscribe. You can delete your subscription at any time, which hard-deletes your row.
If you tell us which software you run, we store package, vendor, and product names only — never version numbers, because versions would make a breach materially more dangerous and are not needed to match disclosures. Uploaded lockfiles or SBOMs are parsed in memory and discarded immediately; the files themselves are never written to disk or retained. Your stack is never shared, sold, or exposed to anyone. One click deletes your entire stack and account.
Hosting is provided by Vercel; email delivery, when enabled, by Postmark. The public data sources this site reports on (NIST/NVD, CISA, FIRST, the CVE Program, OSV) are sources we read from — we never send your personal data to them or to anyone else.
You can ask what we hold about you, correct it, or have it deleted by emailing rondiver@gmail.com. The site is not directed at children. If this policy changes, the updated version is posted here.