Legal

Privacy Policy

Last updated: October 16, 2026. Draft for review. This is not legal advice.

What we collect

When you subscribe, contact us, or send a podcast guest or sponsor request, we collect what you submit. That is usually your email address, and sometimes your name, company, title, and message. We store those submissions on our server so we can reply and run the newsletter.

We also use privacy-friendly page-view analytics that do not identify you. When Google Analytics 4 and Google Ads are on, those services receive page views and the events listed below.

How we use it

We use your email address to send blog and podcast updates, the resources you asked for, and replies to your messages. We do not sell your personal information for money. Advertising measurement can still count as sharing under some state laws. You can opt out of that sharing on the privacy choices page.

Newsletter signups are stored in our database and sent to Beehiiv. Beehiiv stores your email address, sends the newsletter, and can send a confirmation message before you are added. If you check the newsletter box on a contact, guest, or sponsor form, that email address goes to Beehiiv as well. You can unsubscribe from any newsletter message.

Form email

Contact, podcast guest, media kit, and sponsor form messages are emailed through Postmark. Postmark receives the email address and the form contents so the message can be delivered to us. We also keep a copy of the submission.

Google Analytics 4

We use Google Analytics 4 to see which pages are used. Google Analytics 4 is shortened to GA4 below.

Google Ads

We use Google Ads conversion tracking to see which actions follow an ad.

What is measured

When measurement is allowed, we record these events:

Sponsor logo clicks. The event includes the sponsor name only.
Episode plays. The event includes the video id only.
Newsletter signups. The event records that a signup succeeded. It does not include the email address.
Sponsor form submits. The event records that the form was sent. It does not include the form contents.

What we do not send to Google

We do not send your name, your email address, or the contents of a form to Google.

Cookies

We set a first-party cookie named ss_subscriber for 1 year. It remembers that you unlocked the blog on this browser.

The server sets a first-party cookie named ss_consent. It remembers Accept or Reject. It is HttpOnly, so page scripts cannot read it. The value is signed. A value written by a page script is ignored. It lasts about 6 months.

When the Google tag runs, Google may set the cookies below. This site does not change their expiration. The times are Google's defaults.

_ga distinguishes users. It lasts 2 years.
_ga_ followed by the measurement id persists session state. It lasts 2 years.
_gcl_au links an ad click to a later conversion. It lasts 90 days.
_gcl_aw stores a Google Ads click id after an ad click. It lasts 90 days.
_gcl_dc stores a Campaign Manager click id after an ad click. It lasts 90 days.

When the Google tag loads

Visitors in the United States, and in other countries outside the EEA, the UK, and Switzerland, use an opt-out model. The Google tag loads when the page loads. Analytics is on. Ads measurement is on as well, unless your browser sends Global Privacy Control. You do not have to click Accept first. You can opt out at any time with Cookie settings, or on the Do Not Sell or Share My Personal Information page.

Visitors in the EEA, the UK, and Switzerland see a banner. The same is true when we cannot tell which country a visit is in. gtag.js does not load until you click Accept, or until a stored Accept is already on file. A browser timezone does not start the tag. Whatever the browser timezone is, measurement stays off until Accept. In those visits, analytics and ads start denied.

Cookie settings, in the footer and on this page, reopens the banner so you can change or withdraw consent.

Pages with no tracking

The confirm, unsubscribe, and sponsor packet pages carry no tracking. gtag.js is not loaded on those pages, and they do not record the events above.

Global Privacy Control

We honor Global Privacy Control as an opt-out of sale or sharing for ads. If your browser sends it (the Sec-GPC signal), ad_storage, ad_user_data, and ad_personalization are denied, including after you click Accept. Analytics may still run unless you opt out with Cookie settings.

How long analytics data is kept

Google Signals is off. GA4 event data is kept for 2 months.

How to opt out

You can opt out in any of these ways:

Use Cookie settings in the footer or on this page. It reopens the banner so you can change or withdraw consent. Reject turns analytics and ads off. Accept turns them on, except that Global Privacy Control still keeps ads off. gtag.js loads only after Accept when a banner was shown.
Open Do Not Sell or Share My Personal Information. That page posts a deny choice. The server stores a signed value in the HttpOnly ss_consent cookie for about 6 months and turns analytics and ads off.
Turn on Global Privacy Control in your browser. That denies ad_storage, ad_user_data, and ad_personalization. Analytics may still run unless you opt out with Cookie settings.
Use Google's ad settings.
Install the Google Analytics opt-out browser add-on.

California and other US state rights

If you live in California or another US state with a privacy law, you can ask to know what personal information we have, to delete it, to correct it, and to opt out of the sale or sharing of it. Use the privacy choices page to opt out of sale or sharing.

Contact

For privacy requests, email hello@south-security.com.