Privacy policy

Who we are

ZeroDay Times is an online news publication operated at https://zerodaytimes.com. In this policy, "we," "us," and "the desk" mean the operator of that site. We do not require an account to read briefings. The privacy contact is[email protected].

The site is built as static pages and hosted so it can be served from a content-delivery network. The host we intend to use is Cloudflare, including Cloudflare Pages. The host processes connection data in order to deliver the site and to resist abuse.

Information we collect

Information you send us

If you email the desk, or if you use the contact form, you choose what to send. The form does not post the message to a database on this website. It opens your email application with a draft addressed to the relevant mailbox. We receive the message only if you send it. A typical message includes your name, email address, a topic, and whatever you wrote.

Please do not send us exploit code, malware, credential dumps, government-issued numbers, or personal data taken from a breach victim. If you do, we may delete it rather than store it in the newsroom mailbox.

Information collected automatically

When your browser requests a page, the host and the network in front of it process technical data needed to answer the request. That can include your IP address, the date and time, the URL, the referring URL, a user-agent string, and basic device or browser characteristics. We use that information to deliver the site, to keep it available, and to diagnose outages.

We do not run a separate first-party analytics product such as Google Analytics on this site. If that changes, we will update this policy before the new tool collects data.

Your browser can store a preference for light or dark appearance in local storage under the key zd-theme. That value stays on your device. We do not receive it on a server.

Cookies and similar technologies

A cookie is a small text file a site or a service provider stores on your browser. Similar technologies include local storage, pixels, and mobile advertising identifiers.

We group them like this:

• Strictly necessary. The host may set cookies or similar tokens to defend the site, balance traffic, or remember a security challenge. The theme preference described above lives in local storage and is not sent to us.
• Advertising. When Google AdSense (or a similar provider) is enabled, Google and its partners may set or read cookies to show ads, to measure ads, and, where the law and your choices allow, to make ads more relevant. Those cookies are described in the next section.

You can control cookies in your browser. Blocking all cookies may stop ads from measuring or may affect security checks run by the host. Blocking cookies does not, by itself, delete an email you already sent us.

Google AdSense and advertising

We may display ads from Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website and to other websites. Google's use of advertising cookies enables it and its partners to serve ads based on visits to this site and other sites on the Internet.

Those cookies may include the DoubleClick cookie and other cookies used by Google advertising products. Google's explanation of how it uses information from sites that use its services is here:How Google uses information from sites or apps that use its services. TheGoogle privacy policydescribes Google's own practices. Google's advertising cookies are further described atGoogle's cookie policy.

Ads are labeled "Advertisement" on the page. An advertisement is not editorial content, and we do not control the creative a network may insert into a labeled slot. We do not give advertisers our mailbox, and we do not sell lists of readers.

If you are in the European Economic Area, the United Kingdom, or Switzerland, personalized ads generally require a consent choice. When AdSense is enabled, a Google-certified consent message may appear before personalized ads are requested. If consent is refused or is not available, ads may be non-personalized or may not be requested, depending on the product configuration at the time. Non-personalized ads can still use cookies for frequency capping, aggregated reporting, and fraud prevention.

How to opt out of personalized advertising

You can opt out of personalized advertising from Google and from many other companies:

• Google's ad settings:https://adssettings.google.com
• The Network Advertising Initiative:https://optout.networkadvertising.org
• The Digital Advertising Alliance in the United States:https://optout.aboutads.info
• Your Online Choices in Europe:https://www.youronlinechoices.com
• The Digital Advertising Alliance of Canada:https://youradchoices.ca

A browser plug-in that blocks third-party cookies, or a browser set to reject third-party cookies, will also limit many advertising cookies. Opt-out cookies are themselves cookies. If you clear your cookies, you may need to opt out again.

We do not respond to the older "Do Not Track" browser signal because there is no consistent industry interpretation of it. If you email[email protected]and ask us not to use your email for anything beyond the conversation you started, we will honor that for our own mailbox. That request does not automatically change how Google treats an advertising cookie already on your browser. Use the opt-out links above for that.

How we use information

We use information for these purposes:

• To publish the site and deliver pages you request.
• To read and reply to tips, corrections, privacy requests, security reports, and advertising mail.
• To keep a record of corrections and of legal or privacy requests.
• To protect the site against abuse, spam, and downtime.
• To show labeled advertisements and to understand, through our ad provider, whether ads are being served.
• To comply with law, regulation, and valid legal process.

We do not use reader email to train a public machine-learning model. We do not require you to create a profile.

Legal bases for people in the EEA, the UK, and Switzerland

Where the GDPR or UK GDPR applies, we rely on these bases:

• Legitimate interests. Delivering a news site, keeping basic host logs for security, and corresponding about stories you asked us to look at. You may object as described under Your rights.
• Consent. Personalized advertising cookies where consent is required. You can refuse or withdraw consent through the consent message, when it is shown, and through the opt-out tools above.
• Legal obligation. Retaining or producing information when a law requires it.
• Steps toward a contract. If you are an advertiser writing about buying space, we process your mail to answer that inquiry.

Who we share information with

We share information only in these cases:

• The host. Cloudflare, or a successor host, processes connection data to serve the site. Their processing is covered by their own terms and privacy policy.
• Advertising providers. When ads are enabled, Google receives the technical data its ad code is designed to collect, which can include cookie identifiers, IP address, and pages on which an ad unit loads.
• Email providers. Messages you send us are stored in the mailbox provider we use so we can read and answer them.
• Professional advisers. Lawyers or accountants, if we need them for a dispute, a request, or a tax matter, under a duty of confidence.
• Authorities. When we believe in good faith that the law requires it, or to protect the rights, safety, and integrity of readers, sources, and the publication.
• A successor. If the publication is transferred, mail and ordinary business records may transfer with it. The site's public archive is already public.

We do not sell personal information for money. We do not give journalists' inboxes to data brokers.

How long we keep information

Host logs follow the host's retention schedule for a static site. We do not build a separate warehouse of IP addresses.

Email you send us is kept while we need it to handle the tip, correction, or request, and for a reasonable editorial and legal record after that. A correction request may be kept with the story file so a later editor can see why a sentence changed. You may ask us to delete a message. We will do so unless we need to keep it for a legal claim, a security incident, or a law that requires retention.

Advertising cookies expire on the schedule Google sets for those cookies. Clearing your browser cookies removes them from your device.

Security

We serve the site over HTTPS and limit the mailboxes to the people who operate the desk. No method of transmission or storage is perfectly secure. Please do not send us highly sensitive personal information that a news tip does not require.

Children

The site is not directed at children under 16, and we do not knowingly collect personal information from children. If you believe a child has emailed us personal information, write to [email protected] and we will delete it.

International transfers

The site can be read from anywhere. Mail you send us may be processed in the United States or in another country where our email provider stores mail. Those countries may have data-protection rules that differ from the rules where you live. Where the GDPR requires a transfer tool, we rely on the provider's contractual safeguards, such as standard contractual clauses, when they are available for that service.

Your privacy rights

Depending on where you live, you may have the right to access personal information we hold about you, to correct it, to delete it, to receive a portable copy, to restrict or object to certain processing, and to withdraw consent where processing is based on consent. You may also have the right to lodge a complaint with a data-protection authority. You will not receive a worse editorial product because you asked.

Email [email protected] with the right you want to use. We may need to confirm that the address matches the person who wrote to us. We will respond within the time the applicable law requires, generally within 30 days, and we will say if we need more time.

Because most of the site is public static pages, we often do not have an account file to show you. The personal information we are likely to hold is the email conversation you started and ordinary host logs that we may not be able to tie back to a name.

California notice

This section applies to California residents and uses the categories in the California Consumer Privacy Act, as amended by the CPRA. In the last 12 months we may have collected, and we may collect now:

• Identifiers, such as name, email address, and IP address, when you write to us or request a page.
• Internet or network activity, such as the page requested, the referring URL, and interactions with an advertising cookie if ads are enabled.
• Professional information you choose to include in a tip, for example an employer or a job title.
• Inferences drawn by an advertising provider for ad selection. We do not build our own reader profiles.

We collect these categories from you, from your browser, and from advertising and hosting providers. We use them for the purposes in "How we use information."

We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising except to the extent that enabling Google AdSense causes Google to process advertising identifiers for that purpose. California law may treat that processing as "sharing." You can opt out of that sharing throughGoogle's ad settingsand the industry opt-out pages listed above, and you can email[email protected]with the subject line "Do not share my information." We will not discriminate against you for exercising a privacy right. We do not knowingly sell or share the personal information of consumers under 16.

California residents may request access to the specific pieces and categories of personal information we collected, the sources, the purposes, and the categories of third parties we disclosed it to. You may also request deletion and correction. Use the privacy email. You may use an authorized agent if you provide signed permission and we can verify your identity.

We do not use sensitive personal information, as California defines it, for purposes that require a "limit the use" link. Please do not send us sensitive information.

Changes to this policy

We will post changes on this page and update the date at the top. If a change materially expands how we use email you already sent us, we will say so in the policy and, where the law requires it, ask before using the old mail in the new way. Continued use of the site after a new date means you have the updated policy available to you. It does not waive rights that a statute says cannot be waived.

Contact

Privacy questions and requests:[email protected]. Other mail: [email protected]. The publication is ZeroDay Times, https://zerodaytimes.com. We do not publish a street address. If a regulator or a statute requires a postal address for a specific request, say so in the email and we will provide a channel that satisfies that request.