Privacy

Who this is

The Application Security Podcast is published by Kerr Ventures, which decides what this website does and is the contact for anything on this page. Write to [email protected].

This covers this website only. The show is also distributed through Apple Podcasts, Spotify, YouTube and every app that reads the RSS feed, and what those platforms collect while you listen there is theirs to describe.

The site itself collects nothing

Every page here is a static file, built ahead of time and served as-is. There is no application server, no database, no accounts, no login, no comments and no advertising of any kind. Nothing you do on this site is written to anything we own, because there is nothing to write to.

Everything below is therefore about other companies: the analytics, the newsletter form, the audio host, the video host, and the CDN the files are served from. Two of them are contacted the moment a page loads. Two are not contacted at all until you press play.

Google Analytics — on every page, before you can decline

Every page loads Google Analytics 4 (measurement id G-WJJCV6019P) from www.googletagmanager.com, and it runs as soon as the page does. There is no cookie banner on this site and no consent step: the tag fires first, and the only way to stop it is to block it yourself.

Through it, Google receives at least:

• your IP address, which Google uses to derive an approximate location;
• the full URL of each page you view, the page that referred you, and the order and timing of your visits;
• your browser, operating system, device type and screen size;
• cookies set in your browser under this domain, identifying the browser across visits — _ga and _ga_WJJCV6019P as Google names them at the time of writing.

That data lives in Google's systems, under Google's terms, and how long it is kept is a setting inside the Analytics property rather than anything in this site's code — so no retention period is stated here.

The newsletter form — loaded site-wide, whether or not you use it

The subscribe form is beehiiv's, embedded fromsubscribe-forms.beehiiv.com. It sits in the footer, and the footer is on every page, so beehiiv's script is fetched on every page view you make — including pages you only scrolled past. That request alone tells beehiiv's servers your IP address and which page you are on. What the script does once it is running in your browser is beehiiv's to describe, not ours.

If you type an email address into the form and submit it, that address goes to beehiiv and is stored there so we can send you the newsletter. It is the only thing anyone visiting this site is ever asked to type. Nobody buys the list, because there is no arrangement under which it could be sold. To come off it, unsubscribe from any issue or email us and we will remove you.

Audio — nothing until you press play

The player on an episode page is a plain HTML audio element pointed at the MP3 on Buzzsprout, not a Buzzsprout embed, and it is set not to preload. No request reaches Buzzsprout while you are only reading the page.

Press play and your browser fetches the file directly from Buzzsprout, which sees your IP address and browser and counts it as a download — that request is how podcast listener numbers are counted everywhere, including in the apps.

Video — the thumbnail loads, the player does not

Episodes with a video show a still image rather than an embedded player, and the two halves of that behave differently:

• The thumbnail is an image fetched from i.ytimg.com, a Google domain, when the page renders. Google therefore learns your IP address and that a browser loaded a page on this site, without you clicking anything.
• The YouTube player itself is only inserted when you click play, and it is loaded from www.youtube-nocookie.com. Until that click there is no player, no YouTube JavaScript and no YouTube cookie. After it, you are watching on YouTube's terms in an iframe on our page.

This site sends strict-origin-when-cross-origin as its referrer policy, so a passive request like that thumbnail carries only the site's origin, not the address of the page you are reading. It does not limit Google Analytics, which reports the full page URL to Google in its own payload regardless.

Hosting

The site is served by Cloudflare Pages, which keeps the ordinary edge access logs any web host keeps: IP address, timestamp, requested URL, user agent. We do not run analytics on top of those logs.

Search does not leave your browser

Search is powered by Pagefind, which is a static index built at the same time as the pages and shipped alongside them. When you type a query, the browser downloads slices of that index from this same domain and does the matching locally. The query is not sent to any server — not ours, because there isn't one, and not anybody else's.

One exception, because it is the kind of thing worth knowing: a search page can be linked to with the query already in the address, as/search/?q=…. If you arrive by such a link, that URL is the page address Google Analytics reports, query included. Queries you type on the page never enter the address bar and never reach Analytics.

What is not here

No advertising network, no ad or affiliate tracking, no A/B testing, no session recording or heatmaps, no social media buttons that phone home, and no third-party fonts — the typefaces are served from this domain specifically so that loading a page does not announce it to a font host.

What you can do

• A content blocker stops Google Analytics and the beehiiv form outright. Both are third-party scripts on well-known domains, and every mainstream blocker already knows them. The site works without either.
• Google publishes a browser add-on that opts you out of Analytics everywhere, not just here.
• Clearing cookies for this domain discards the Analytics identifiers.
• Don't press play, and neither Buzzsprout nor YouTube hears from you.
• Ask us. Mail to [email protected] gets a person, and we will delete anything we can reach — realistically, your newsletter subscription. Analytics data is not held in a form that lets us find one person in it.

What this policy does not claim

It does not claim compliance with the GDPR, the CCPA, or any other data protection regime. Analytics cookies are set on arrival with no prior consent, which is squarely what the EU rules require consent for, and that has been decided knowingly rather than overlooked. If you would rather that not happen, block the tag before you browse; the preceding section explains how, and none of it costs you anything on this site.

The point of this page is to describe accurately what happens, so that anyone who cares can verify it in the page source and act accordingly.

Changes

If what the site does changes, this page changes with it and the date below moves. There is no mailing list for policy updates and no published version history — the date is the only claim this page makes about its own age.