Privacy

Privacy policy

Last updated: September 2026.

PatchLeaks (pwn.az) is a self-hosted security-research site. This page describes what data we collect, what we don't, and how to contact us with privacy questions.

What we do not collect

  • No third-party analytics. We do not run Google Analytics, Meta Pixel, or any ad-network tracking script on public pages.
  • No cookies for advertising or cross-site tracking.
  • No sale of personal data. We do not sell, rent, or share personal data with third parties for marketing purposes.

What we do collect

  • Access logs. Our web tier (Cloudflare + the PatchLeaks server) records standard request metadata — IP address, user agent, request path, timestamp, response code — for abuse prevention, capacity planning, and debugging. Logs are retained for up to 30 days and are not shared with third parties.
  • Search Console / Webmaster Tools. If you are a verified operator of pwn.az, Google Search Console or Bing Webmaster Tools may collect aggregated crawl and query data about this site. See the respective providers' policies for details.
  • Cloudflare. PatchLeaks is served via Cloudflare's reverse proxy. Cloudflare may collect standard edge-traffic metadata. See Cloudflare's privacy policy.

Abuse prevention when you start an action

Reading PatchLeaks sets no cookie and runs no check. Starting an action that makes the server do work (an analysis, a scan, rule generation or a preview) is protected, so automated clients cannot use the service up.

  • A security cookie, set only when you start an action. __Host-pl_vid holds a random identifier, the time it was issued, and two short hashes: one of your browser family and operating system (such as "Chrome on Windows") and one of your network prefix (the first three parts of an IPv4 address, or the first 48 bits of an IPv6 address). It is signed so it cannot be forged, page scripts cannot read it, it is sent only to this site, and it lasts 30 days. It is strictly necessary for the security of the service and is never used for analytics or advertising.
  • A check in your browser. When you start an action, a script checks that the properties your browser reports agree with each other and with the HTTP headers it sends (for example, that the browser name, version and platform are the same in the page, in a background worker and in the request), solves a small proof-of-work puzzle, and records counts and timing of your recent clicks, pointer movement, key presses and touches. It never records which keys you pressed, what you typed or what is on your screen. The server also reads the standard HTTP headers your browser sends.
  • No persistent fingerprint. The results decide that one request and are then discarded; no profile of your device is stored.
  • What is kept, and for how long. A decision log records, for each check, the time, the action, the outcome and the names of the checks that fired, together with your IP address truncated to its network (/24 for IPv4, /48 for IPv6), a hashed session identifier, and your browser family and major version. It is kept for 14 days. To enforce per-visitor limits, the server counts started actions against keyed hashes of your session identifier and of your network address, never the address itself, and deletes those counts after 48 hours.
  • Without JavaScript you can read every public page, but you cannot start actions, because the check cannot run.
  • Legal basis. This processing is necessary for our legitimate interest in keeping the service secure and available (GDPR Article 6(1)(f)). The cookie is strictly necessary for a service you ask for, so it is set without a consent prompt.

Embedded third-party resources

Public pages fetch web fonts from fonts.googleapis.com / fonts.gstatic.com. Font requests expose standard HTTP metadata (IP, user agent) to Google. We plan to self-host fonts in a future release to remove this dependency.

Your rights

If you are in the EU / UK / California and want to request deletion of any access-log entry attributable to you, or otherwise exercise data-subject rights, email [email protected]. We will respond within 30 days.

Changes to this policy

Material changes will be noted in-line with the date above. The current version lives at /privacy.