Privacy policy

Who is responsible

ThreatNoir is run by Marcus Lenngren in Sweden, who is the controller of the personal data described here. Write to contact@threatnoir.com with any question or request about your data. Organisation number and registration details are available on request.

This policy covers threatnoir.com and its emails, alerts, feeds and API. The weekly quiz and ThreatNoir Academy for organisations, at quiz.threatnoir.com, have their own privacy notice.

When you read the site

You can read articles, lessons, briefs, the IOC feeds and the podcast without an account. Pages load only from threatnoir.com, cdn.threatnoir.com (our podcast and video files) and, when you sign in, our authentication provider. We embed no third-party trackers, ads, fonts or videos.

• Visit statistics. When a page loads, your browser sends us a page-view event: the page address, the website that sent you (on the first page of a visit only), your browser's user-agent string and a keyed hash of your IP address. The hash is made with a secret key and shortened, so we can count visitors without storing the address. From page addresses we keep only campaign tags such as utm_source. No cookies are involved.
• Vercel Web Analytics. Our hosting provider also counts page views for us, without cookies. Vercel tells visits apart by a hash of the request, which it discards after 24 hours, and receives the page address with only campaign tags kept.
• Opting out. If your browser sends Global Privacy Control or Do Not Track, it sends neither kind of statistics.
• Server logs. Our hosting and database providers see your IP address when they answer a request, and keep it in their logs for a short time for security and troubleshooting.

What we store in your browser

We set no advertising or analytics cookies, which is why there is no cookie banner. The site's framework saves one display setting (dark mode) in your browser, with no identifier in it. Everything else is stored only when you use a feature that needs it:

• Signing in: cookies that keep you signed in. They are set when you sign in and removed when you sign out.
• Rating an article: a random identifier, so each article gets one rating from you and you can see your own. It is created the first time you rate.
• The weekly quiz, if you played it on this site: a random player token, your display name and which quizzes you played may still be in your browser. This site no longer reads or writes them. The quiz is now at quiz.threatnoir.com.

You can clear all of these in your browser settings at any time.

Newsletters and alerts

When you sign up for the daily brief, the weekly digest or Vendor Watch alerts, we store your email address, your name if you give one, what you subscribed to and when, and the tokens behind your confirmation and unsubscribe links. We send a confirmation email. Its link opens a page with a Confirm button, and nothing more is sent until you press it. Every email has a one-click unsubscribe link. Our emails contain no tracking pixels, and their links are not rewritten to track clicks.

• Signup protection: to stop automated signups, each attempt to sign up is recorded as a keyed hash of the IP address it came from and the time. The hash is made separately from the one in our visit statistics, so the two cannot be matched, and for an IPv6 address it covers the network, not the single address. For each confirmation email we send, we record a keyed hash of the email address it went to and the time, so that nobody can use the form to send one person confirmation emails again and again. Neither record holds the address itself, and we delete both after 7 days. The form also holds a hidden field that only automated tools fill in, and a signed timestamp from our server that is not stored anywhere.
• Your watchlist: the vendors and products you list, which we match against new stories. It stays private: it never appears in email subject lines, and we keep it out of our logs.
• Other channels: if you send alerts to Discord, Telegram or your own webhook, we store that channel's address and deliver the alerts there. Discord and Telegram then handle those messages under their own privacy policies.
• Delivery log: which stories we sent you and when, so you don't get the same alert twice.
• Vendor suggestions and domain lookups: after you confirm a Vendor Watch address, and in your watchlist settings, we look up the public DNS records of your email address's domain and the response headers of its website, and suggest the vendors they show. Common personal email domains such as gmail.com are not looked up for suggestions. Signed in, you can also look up any other domain or subdomain the same way, such as a supplier's or a sister company's. Results are kept in memory for up to 12 hours to avoid repeat lookups. To limit volume we count lookups per account for 2 days, but we never store which domains were looked up.

Accounts and signing in with Google, Microsoft or GitHub

An account is optional. It lets you manage your subscriptions and watchlist in one place and create API keys.

• Email and password: we store your email address. Our authentication provider stores your password only as a salted hash.
• Google, Microsoft or GitHub: when you choose one, that provider sends us your email address, your name or username, a link to your profile picture and an account identifier. We use them only to create your ThreatNoir account, sign you in and send the emails you ask for. We receive nothing else from those accounts: no password, contacts, files or calendar. We don't use this data for advertising, and we share it only with the service providers listed below. ThreatNoir's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Security records: the authentication service records sign-ins, including the IP address, to protect your account.
• API keys: we store only a hash of each key and its first few characters, so you can tell your keys apart.

Messages, tips and the quiz

• Contact form: your name, email address, subject and message reach us as an email. They are not stored in our database.
• Tips you submit: the tip, plus your name and email address if you give them. We store them with the tip, and use the email address only to limit how many tips one person can send.
• Corrections to a vendor page: what you tell us, the link you add, your name and email address, whether you say you work for the vendor, and whether your email address is at the vendor's own domain. We store them to review the correction and to reply to you.
• Feature requests: when you tell us you want something, such as room for more vendors, we store your email address, what you asked for and, if you give it, your company size.
• The weekly quiz: it has moved to quiz.threatnoir.com, which has its own privacy notice, and is no longer offered here. From the quiz that used to run on this site we still hold each result (display name, score and time, not the individual answers) with its player token and a keyed hash of the IP address. Ask us and we remove yours.

Why we use your data

• Newsletters and alerts you asked for: your consent (GDPR Article 6(1)(a)). You can withdraw it at any time with the unsubscribe link or in your settings.
• Your account and the features you use, such as API keys, settings, the quiz and ratings: to provide the service you asked for (Article 6(1)(b)).
• Keeping the site secure, stopping abuse and counting visits: our legitimate interest in running a safe and reliable service (Article 6(1)(f)), using hashed or shortened data wherever we can.
• Answering your messages: our legitimate interest in replying to you (Article 6(1)(f)).

We do not sell personal data, use it for advertising or make automated decisions about you.

Who helps us

The first five handle personal data for us, only to run ThreatNoir. The others come into play only when you choose them, and handle your data under their own policies.

We use AI services to summarise public news and write lessons. We don't send them your personal data.

When a provider handles personal data outside the EU/EEA, the transfer is covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.

How long we keep data

• Subscriptions and your watchlist: until you unsubscribe or delete your account. After you unsubscribe we keep your email address, marked as unsubscribed, so we don't email you again by mistake.
• Your account: until you delete it in Settings. That removes your account, subscriptions, watchlist and alert history at once.
• Unconfirmed Vendor Watch requests: the confirmation link works for 7 days, and the request is deleted within a day after that.
• Visit statistics: 24 months.
• Signup protection records: 7 days.
• Corrections to a vendor page: deleted 12 months after we have dealt with them.
• Contact messages: in our mailbox for as long as we need to deal with your request.
• Tips, feature requests and quiz entries: for as long as they serve the service. Ask us and we remove your details.
• Provider logs: for the short periods each provider sets.

Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and get it in a portable format. Write to contact@threatnoir.com and we will answer within a month. You can also unsubscribe from any email with one click, and delete your account yourself in Settings.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY) or to the data protection authority where you live.

Security

All traffic is encrypted, and every database table is protected by row-level security. Passwords and API keys are stored only as hashes, and the IP addresses in our own statistics, signup protection and quiz records only as keyed hashes.

Children

ThreatNoir is not aimed at children under 16, and we don't knowingly collect their data.

Changes to this policy

We change the date at the top whenever this policy changes. For significant changes we will also tell subscribers by email.