Privacy Policy

What this site collects, why, who sees it, and how to get it changed or deleted. Short version: as little as possible, never sold, no ads.

Last updated 8 October 2026

Who I am

cyberuk.me is the personal website of CyberUK, an individual based in the United Kingdom. I am the data controller for personal data collected through this site. You can reach me about anything in this policy through the contact page.

The site can be visited from anywhere in the world. I follow the UK GDPR and the Data Protection Act 2018, and I give everyone the rights described below wherever they live, including visitors covered by the EU GDPR or US state privacy laws.

What I collect and why

When you send a message

The contact form asks for your name, email address, an optional Discord username and your message. Some forms also record which website sent you. I use this only to read and reply to your message.

Lawful basis: my legitimate interest in answering messages people send me, or taking steps you ask for before we agree any work together.
Where it goes: the message is delivered to a private channel on a messaging service that only I can see.
How long: I delete messages within 24 months of our last contact, unless we're working together and I need to keep them for longer.
Your IP address is used briefly to stop spam (limiting how many messages can be sent). It isn't stored with your message.

When you visit any page

Like every website, my hosting provider processes your IP address, browser details, the pages you request and when, so it can deliver pages and protect the site from abuse. These logs are short-lived and controlled by the hosting provider's own retention settings. Lawful basis: legitimate interests in running a secure website.

A simple total view counter is also kept. It stores only a number, nothing about you.

Analytics, only if you allow it

If you accept analytics, my hosting provider's privacy-friendly analytics records the page you viewed, the site that referred you, your country and your type of device, browser and operating system. It uses no cookies, stores nothing on your device and can't follow you to other sites. Visits are grouped using a code derived from your request that resets every day, so you can't be identified. Lawful basis: your consent. It's off until you turn it on, and you can withdraw consent at any time (see Your choices).

The security tools

Password tester and leaked-password check: your password is checked on your device and never sent. For the leak check, only the first 5 characters of its SHA-1 hash go to Have I Been Pwned, which can't work out your password from them.
Security header checker and phishing link checker: the address you enter is sent to my server, which contacts that site to read its response headers and redirects. I don't save the addresses or the results, but they may briefly appear in the hosting logs described above.
DNS & email checker: your browser asks a public DNS service about the domain you enter. That service sees your IP address and the domain name; nothing goes to my server.
Hash & encoding toolkit: runs entirely in your browser. Nothing is sent anywhere.

Content loaded from other services

Some pages show content hosted elsewhere, so your browser connects directly to those services and they receive your IP address and browser details:

A chat platform's image servers: profile pictures, emoji and badges.
A live-status service: my online status, on pages that show it.
The Hacker News / Google (blogger.googleusercontent.com): article images on the security news page.
Have I Been Pwned (logos.haveibeenpwned.com): company logos on the recent breaches page.
A network security provider: live service status, from my status server, which sits behind it.

These requests are needed to show the content, and I don't receive any extra data from them. Each service handles your data under its own privacy policy.

Cookies and browser storage

The site stores only what it needs to work. There are no advertising or cross-site tracking cookies.

Name	Type	Purpose	Kept for
`cookiePreferences`	Local storage	Remembers whether you allowed analytics	Until you clear it
`theme`	Local storage	Remembers light or dark mode	Until you clear it
`seasonalEffectsEnabled`	Local storage	Remembers whether holiday effects are on	Until you clear it
`project_auth`	Cookie	Keeps you unlocked after entering the password for a private project. Only set if you do.	12 hours

All of these are strictly necessary for features you use, so they don't need consent. Analytics, the only optional feature, sets no cookies.

I never sell your data, share it for advertising, or use it to make automated decisions about you. It's only handled by the services that run the site:

My hosting provider (USA): hosting, logs and, if you allow it, analytics.
A messaging service (USA): delivers contact form messages to me.
A network and DNS provider (USA): the DNS checker and my status page.
The content services listed above, for the content they serve.

I would only share data otherwise if the law required it.

International transfers

The services above are based in the USA and run servers worldwide, so your data may be processed outside the UK and the European Economic Area. Where that happens, I rely on the safeguards those providers offer, such as the UK–US Data Bridge and EU–US Data Privacy Framework (where the provider is certified) and standard contractual clauses with the UK international data transfer addendum.

Your rights

Wherever you live, you can ask me to:

tell you what personal data I hold about you and give you a copy;
correct anything that's wrong;
delete your data;
restrict how I use it, or object to my using it;
give you your data in a portable format;
withdraw consent you've given, such as for analytics, at any time.

Ask through the contact page. I'll reply within one month, and it's free. I may need to check it's really you before sharing anything.

If you're unhappy with how I've handled your data, please tell me first so I can put it right. You can also complain to the UK Information Commissioner's Office at ico.org.uk, or, if you live in the EU or EEA, to the data protection authority in your country.

US residents: I don't sell or share personal information for targeted advertising, and I don't use sensitive personal information. You can make any of the requests above whichever state you live in.

Your choices

Analytics: off by default. Change it any time with the cookie button in the bottom-left corner of every page.
Browser storage: you can clear it at any time in your browser settings; the site still works.
Contact form: optional. You can also reach me on the platforms linked in the footer, which have their own privacy policies.

Security

The site is served only over HTTPS. Contact messages go straight to a private channel only I can access, and only I have access to the accounts that run the site. No system is perfectly secure, but if a breach ever affected your data I would tell you and, where required, the ICO.

Children

This site isn't aimed at children, and I don't knowingly collect data from anyone under 13. If you think a child has sent me personal data, let me know and I'll delete it.

Changes to this policy

If I change how I handle data, I'll update this page and the date at the top. Significant changes will also be noted here.