Privacy Policy

1. Controller responsible for data processing

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws (in particular the TDDDG) is:

Jan Bludau
Tannenkampstraße 79
26131 Oldenburg
Germany
E-mail: [email protected]
Website: https://tsecurity.de
Imprint: https://tsecurity.de/en/impressum

2. Principles and legal bases of data processing

We process our users' personal data exclusively in accordance with the provisions of the GDPR, based on the following legal bases:

• Art. 6 (1) (a) GDPR (consent): Wherever we obtain consent for processing operations (e.g. subscription to the weekly cyber briefing, voluntary interest tags).
• Art. 6 (1) (b) GDPR (performance of a contract): For providing the user account, personalised watchlists, karma tracking and Sentinel chat.
• Art. 6 (1) (f) GDPR (legitimate interest): For fending off cyber attacks (DDoS, brute force), ensuring system stability, integrity of votes (visitor hash deduplication, see section 6a) and reach measurement.

3. Server log files and hosting

When you access our website, our servers automatically record the following data to ensure IT security:

• IP address of the requesting device (for intrusion detection)
• Date and time of the request
• Requested resource and HTTP status code
• Browser type, version and operating system

For security reasons, the server log files are retained for a maximum of 14 days and then automatically deleted or anonymised.

This service is operated on managed infrastructure of the hosting provider Host Europe GmbH (Essen, Germany; Plesk administration interface). The provider processes the above data as a processor pursuant to Art. 28 GDPR; the data processing agreement is part of the service contract. The servers are located in EU data centres.

3a. Automated aggregation of RSS sources & external redirects

On our platform, RSS and Atom feeds made publicly available by publishers and specialist media are automatically read in as part of pure server-to-server processes (cron jobs) in order to provide editorial overviews, headlines and short teaser snippets:

• No data outflow while browsing: When our visitors access the overview pages, the feed content is delivered from our own servers. There is no direct connection between the visitor's browser and the servers of the external source publishers.
• Outbound links / redirects: If you click on an external article or a "read more" link (e.g. /weiterleitung.php), you leave our platform. You will be redirected directly to the website of the respective third-party provider. From that point on, data processing is subject exclusively to the privacy policy of that third party.

4. Registration, user account & double opt-in

Extended features (e.g. 0-day CVE alerts, Sentinel radar, karma system) require a free user account. Mandatory information:

• Username / alias (pseudonyms permitted)
• E-mail address (for double opt-in activation and notifications)
• Password (stored exclusively hashed via bcrypt/Argon2)

To prevent abuse, we use a double opt-in procedure with a 48-hour confirmation token. Accounts can be deleted at any time (Art. 17 GDPR).

4a. Supporter subscription, portal licence & payment processing (Stripe)

For the paid offerings — the Supporter Pro subscription and white-label portal licences — payment processing is outsourced to Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (together with Stripe, Inc., USA; "Stripe"). The legal basis is Art. 6 (1) (b) GDPR (performance of a contract); subsequent accounting and statutory retention are based on Art. 6 (1) (c) GDPR in conjunction with commercial and tax law obligations.

• What we store ourselves: username and e-mail address of your account, subscription status and term, as well as the Stripe references (customer and subscription ID) and billing data (amount, currency, date, sequential invoice number). Card data or IBANs are never stored by us — during checkout they flow exclusively and directly to Stripe.
• What Stripe processes: To process payments, Stripe processes your name, e-mail address, chosen payment method (e.g. card data or IBAN for SEPA direct debit), amount and billing history, including fraud prevention. Privacy information: stripe.com/privacy.
• Third-country transfer: Processing may take place in the USA (Stripe, Inc.). The transfer is based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.
• Retention: For legal retention reasons (§ 147 AO, § 257 HGB — German tax and commercial code), we retain billing documents (invoices, payment receipts) for up to 8 or 10 years — regardless of account deletion, but exclusively for these purposes.
• Your rights: Information and export via the profile editor ("Export my data") and at [email protected]. Account deletion (Art. 17) automatically cancels an existing subscription at the end of the paid period; billing documents already created remain exempt from deletion (see above).

5. E-mail newsletter: "Cyber Briefing"

With the Cyber Briefing, subscribers receive weekly security analyses and 0-day CVE warnings. Subscription is via double opt-in with logging of the subscription and confirmation IP. You can unsubscribe at any time using the 1-click link at the end of each issue.

6. Sentinel live chat, topic radar & gamification

Public posts in the Sentinel live chat and submissions in the topic radar are stored in pseudonymised form. Karma points and streaks serve community motivation and have no monetary value.

6a. Guest interactions: comments, reports & submissions

You can also get involved without a user account. These forms require explicit consent before submission (Art. 6 (1) (a) GDPR), which is enforced and logged server-side — with time, consent text version, truncated IP hash (SHA-256) and browser identifier as evidence pursuant to Art. 7 (1) GDPR. Consent can be withdrawn at any time (e.g. by e-mail to [email protected]).

• Article submission ("Add content" / "Submit an article for publication"): chosen news category, headline, submitter/author name, optional author website, your e-mail address and the message text. The details go to the admin mailbox for editorial review (reply to your address is possible); e-mail, author and website are not stored in the database but deleted after processing. The text is created as an unpublished draft and only published after explicit editorial approval under the specified name/alias (cf. Terms of Use, section 4a).
• Guest blog posts ("Add blog entry" / blog writing): title, content, categories and tags. Guest posts appear under your chosen name/alias and are also automatically flagged for moderation review; the visitor hash (spam protection) serves as the technical identity. Deleted posts are removed together with their associations (comments, reactions).
• Guest comments (articles, blog, quick reply): your specified name/alias and — for the comment module — your e-mail address (only for approval and queries, never published), as well as a technical visitor hash (SHA-256 from IP and session, for spam protection and duplicate prevention). Stored in pseudonymised form until deletion on request; e-mail addresses are deleted together with the comment.
• Tags & change suggestions as a guest (article tags, correction/supplement suggestions): chosen/specified content plus visitor hash; suggestions are published only after editorial review, rejected suggestions are deleted (at the latest 30 days after the decision, never-edited ones at the latest 90 days after submission).
• Reports to moderation (⚑ "Report" on chat messages, comments, blog posts and direct messages): chosen reason and optional free text; as reporter identity your user identifier or — as a guest — the visitor hash. The sole purpose is moderation and abuse prevention; reports are deleted after completion of the review, at the latest 30 days thereafter.
• RSS source suggestion ("Submit feed source"): title, feed URL and your e-mail address. The details go to the admin mailbox for editorial review (reply to your address is possible) and are deleted after processing.
• Contact form: name, e-mail and message exclusively for processing your enquiry; deleted after completion of the conversation.

Votes & reactions as a guest (voting, star ratings, emoji reactions): we do not need consent for these. Only a visitor hash (SHA-256 from IP parts and session) is stored so that each identity can vote only once (abuse protection, Art. 6 (1) (f) GDPR). No profiling, no sharing; objection or deletion at any time via the address above or by deleting your account yourself.

6b. Direct messages, bookmarks & sharing statistics

The following applies additionally to registered users:

• Direct messages (DMs): recipient, sender, timestamp and message content are stored for delivery and conversation management. Direct messages are visible only to the participants; in the case of ⚑ reports, moderation may view the reported content. When the participants delete the conversation, the content is removed.
• Server-side bookmarks: saved articles are assigned to your account (Art. 6 (1) (b) GDPR — performance of a contract) and removed with account deletion; guests save articles exclusively locally in the browser (local storage, see section 9).
• Sharing statistics: when sharing an article, an event (time, target network, visitor hash) is stored for reach purposes — only with prior statistics consent (consent banner) and with automatic deletion after 90 days.

7. Web analytics with Matomo

We use the open source solution Matomo on our own infrastructure in two variants:

• Consent-based analytics script: The Matomo JavaScript is loaded and executed only after you have consented to web analytics ("tracking") in the consent banner. It records page views and link clicks; a heartbeat timer reports dwell time while the tab is open.
• Optional, cookie-less server-side tracking: This mode is currently not activated; web analytics operates exclusively via the consent-based script described above.

No data is passed on to third parties; the Matomo instance runs on our own infrastructure.

8. AI features & transparency (EU AI Act)

Automated AI models support the semantic summarisation of CVE reports. There is no automated decision-making or profiling with legal effect pursuant to Art. 22 GDPR.

9. Cookies and local storage

We use only technically necessary storage technologies: session cookies for login and your browser's local storage. The local storage remains entirely on your device — it is not accessible to third parties and is not transmitted to us or other servers. To manage your cookie settings, the consent manager additionally stores the consent state in a cookie (mydraft_consent) and in local storage (mydraft_consent_state). We also use local storage for the following convenience features:

• Theme setting: your preferred appearance (light / dark / system)
• Bookmarks/reading list: articles you have saved (mydraft_bookmarks, bm_art_*)
• Reactions & votes: votes and "likes" already given (mydraft_user_votes, mydraft_pulse_votes, liked_art_*)
• Chat identity & chat settings: chosen display name, badge, mutes and subscribed categories (mydraft_chat_*)
• Recently searched terms for faster follow-up searches (mydraft_omnisearch_recent)
• Personal topic clusters for a topic selection tailored to you (mydraft_user_cluster_cats)
• Visit and streak statistics — purely locally in your browser (mydraft_streak_data, isharestuff_*)
• Session resume: recently opened content can be restored for up to 24 hours (mydraft_session_resume_v1)
• Breaking news settings (sound, automatic opening) and one-time usage hints (realtime_*, ts_shortcut_hint_seen)
• Cookie settings: your consent state for the consent manager (mydraft_consent_state)

You can view and delete this data at any time via your browser settings.

In the consent banner you can consent to optional categories. The "functionality" category activates third-party tools such as language translation (GTranslate) — your IP address and, if applicable, cookie information are transmitted to this provider. "Statistics" starts web analytics with Matomo (see section 7). External media and marketing are currently disabled; no embedded third-party content or partner tags are loaded.

10. Your rights as a data subject

You have the right at any time to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

For registered users, access and data portability (Art. 15/20) are available as a machine-readable JSON download directly in the profile editor ("Export my data"); account deletion (Art. 17) is also available there.