Privacy

Aggregate site analytics

What. When a page loads, your browser sends one counter update to this site's own API. The API adds one to a daily total for that page. The totals recorded are:

• page views, and article readers who scroll past 50% and 90% of the page;
• the referring site's hostname only (for example www.linkedin.com, never the full address), and campaign labels from utm_ parameters in the link you followed;
• clicks on links to GitHub, LinkedIn, Credly, Microsoft Learn and AdminSecOps, recorded as a destination label, and clicks on resources and downloads on this site;
• requests for the RSS feed, newsletter signups by the page they were made on, confirmed subscriptions, and article feedback submissions (these four are counted by the server when it handles the request).

Each row is a count for one day: for example, "12 views of this article on 26 September from linkedin.com". The analytics store no IP address, cookie, device or browser identifier, and nothing that links one page view to another. Events for pages that do not exist on the site are discarded.

Why. To see which articles are read and finished, what brings readers here, and whether the newsletter and resources are useful.

How long. Daily counts are kept for 13 months, then deleted. Before that, they are combined into weekly totals per article, referrer, entry page and campaign, which are kept indefinitely. Weekly totals contain the same kind of counts and nothing more.

Search and repository statistics

The site owner's private insights page also shows aggregate figures that Google Search Console and GitHub provide about the site and its repositories: search impressions, clicks, average position and the search queries Google reports, and repository stars, forks, release downloads, views and clones. They are totals supplied by those services, not information about individual visitors, and are kept indefinitely.

Newsletter

What. Your email address, the date you consented, the form you used, and the subscription status (pending, subscribed or unsubscribed). Subscriptions use double opt-in: nothing is sent to you except the confirmation email until you confirm.

Why. To send Microsoft Security in Practice editions and related ConfigReview updates, and to prove consent.

How long. While you are subscribed. When you unsubscribe, the record is marked unsubscribed and kept so that no further email is sent; email mail@palanikumar.net to have it deleted entirely. An unconfirmed request is kept until you confirm it or ask for it to be deleted.

Abuse protection. To limit repeated signup attempts, the service keeps a short-lived keyed hash derived from the requesting network address, with a count and a time. The address itself is not stored and the hash cannot be reversed without the service's secret key. These rows are deleted after 30 days.

Article feedback

What. Your rating and, if you add one, your comment and nickname. To prevent duplicate ratings, a random identifier is kept in your browser's local storage (not a cookie) and the service stores only a salted hash of it.

Why. To show average ratings and moderated comments, and to see which articles need work.

How long. Ratings and comments are kept while the article is published; a comment is shown only after it is approved, and one that is not approved stays unpublished until the site owner removes it. Daily per-article submission counters used for rate limiting are deleted after 30 days. Email mail@palanikumar.net to have a comment removed.

Preferences in your browser

Your light or dark theme choice is saved in your browser's local storage. It never leaves your device.

Private insights page

The /insights page is for the site owner only. Signing in to it uses Azure Static Web Apps authentication, which sets a sign-in cookie for that person. Ordinary visitors never sign in and receive no cookie.

Service infrastructure

The site runs on Azure Static Web Apps and Azure Storage. Microsoft, as the hosting provider, may process basic request logs for security and operation under its own terms. This site does not add analytics to those logs.

Contact

For a privacy or deletion request, email mail@palanikumar.net.