Privacy Policy

Information We Collect

RuntimeRebel is a static website that does not require user accounts and does not store personal data on our own servers. The only place on this site where you can submit personal data is the optional newsletter signup, which sends your email address directly to our newsletter provider (see Email Newsletter below). Third-party services integrated into the site (described below) may collect anonymised usage data according to their own privacy policies. We do not collect data via the browser Permissions-Policy features (camera, microphone, or geolocation), which are explicitly disabled at the server level.

Server Logs

Like almost every website, our infrastructure keeps standard access logs — the requested URL, timestamp, IP address, and browser user-agent string. We use these solely for security forensics and operational troubleshooting (for example, investigating abuse or diagnosing an outage), never to build profiles of readers. Logs are retained for a limited period and then discarded.

Analytics

We use Google Analytics 4 (GA4) to understand general traffic patterns such as page views, referral sources, and device types. GA4 runs by default. You can switch analytics storage off at any time via Privacy & Ad Settings in the footer of every page.

To be exact about what that control does, because "turn analytics off" would overstate it: it sets Google Consent Mode's analytics_storage signal to denied, which stops GA4 reading or writing its cookies, so your visits are no longer linked together over time. GA4 still sends cookieless measurement pings, and those still carry the address of the page you are on, the page that referred you, and your IP address (from which Google derives an approximate location). If you want no requests to Google Analytics at all, use Google's Analytics opt-out browser add-on or a content blocker — those stop the script loading, which the on-site control cannot do. If you are in the EEA, the UK or Switzerland, analytics storage stays disabled until you consent through the privacy message shown on your first visit. Data collected by Google Analytics is governed by Google's Privacy Policy.

Beyond GA4's automatic page-view measurement, the site sends a small number of named events so we can tell whether a feature is actually used. Every one carries GA4's standard context (page address, referrer, approximate location derived from your IP, device and browser) plus the one value listed below, and nothing else:

• cve_watch — sent when you add a CVE to your watchlist on the CVE tracker. Carries the identifier you starred, e.g. CVE-2026-1234. Removing a star sends nothing.
• severity_filter — sent when you filter the article listing by severity. Carries the severity you selected.
• newsletter_submit — sent after a newsletter signup form is submitted. Carries no value; your email address is never included.
• affiliate_click — sent when you click a link marked as sponsored or affiliate. Carries the destination hostname only, never the full URL.
• sw_registered — sent once when the offline service worker registers. Carries no value.
• LCP, CLS and INP — Core Web Vitals: how quickly the main content appeared, how much the layout moved while loading, and how quickly the page responded to your interactions. Each carries a number describing the page's performance, not you. They are sent when you leave or hide the page.

Cloudflare

We use Cloudflare as our CDN and edge security provider. Cloudflare sits in front of all traffic to this site and may collect anonymised traffic analytics (such as request counts, bandwidth, and threat scores) as part of its service. The newsletter signup is submitted by your browser directly to our newsletter provider, so it never passes through Cloudflare or our servers. Data handled by Cloudflare is governed by the Cloudflare Privacy Policy.

Advertising

RuntimeRebel is free to read and funded by advertising. We use Google AdSense, which runs by default and may serve personalised ads based on your browsing activity using cookies and similar technologies.

You can opt out of personalised advertising at any time via Privacy & Ad Settings in the footer of every page, or at Google Ads Settings. Opting out does not remove ads — they continue to appear, but are no longer tailored to you.

If you are in the European Economic Area, the United Kingdom or Switzerland, we use a Google-certified Consent Management Platform. Advertising and analytics storage remain disabled for you until you make a choice in the privacy message shown on your first visit, and you will receive non-personalised ads in the meantime. You can reopen that message at any time from the same footer link.

California residents: we do not sell personal information for money. Serving personalised advertising may constitute "sharing" for cross-context behavioural advertising under the CPRA. Use the Do Not Sell or Share My Personal Information link in the footer to opt out.

Global Privacy Control: we honour the GPC opt-out preference signal. If your browser or extension sends GPC, we treat it as a request to opt out of sharing for cross-context behavioural advertising and disable ad personalisation automatically — you do not need to use the footer link as well. Ads continue to serve, but are not personalised.

Some articles on this site may be sponsored or contain paid placement. Sponsored articles are clearly labelled as such. Sponsored content does not influence our editorial standards or the accuracy of threat intelligence we report.

Web Fonts

All typefaces used on RuntimeRebel — Montserrat, JetBrains Mono and the Material Symbols icon set — are self-hosted and bundled into the site at build time. No request is made to fonts.googleapis.com, fonts.gstatic.com or any other font host, so no third party receives your IP address or browser headers as a result of loading our fonts.

Cookies, Local Storage & Session Storage

RuntimeRebel stores your advertising and analytics preferences in your browser's localStorage:

• rr-ad-personalization — on or off. When off, ads are served without personalisation.
• rr-analytics — on or off. When off, Google Analytics storage is disabled.

Two site features also keep their state in localStorage:

• rr-cve-watchlist — the CVEs you have starred on the CVE tracker. There is no account behind this; the list exists only in your browser.
• rr-last-visit — a timestamp of your previous visit, used to show "NEW" badges on articles published since then.

One key is kept in sessionStorage instead, which your browser discards when the tab closes:

• rr-last-visit-ref — a copy of the timestamp above, frozen at the start of this visit so that moving between pages does not make the "NEW" badges disappear mid-session.

These values live on your device. The site is static and has no server-side store to upload them to, so none of them is sent to us. One value does reach Google Analytics, and it is worth stating plainly rather than leaving it implied by the section above: adding a CVE to your watchlist sends that CVE's identifier as the cve_watch event described under Analytics. The watchlist itself, the visit timestamps and your stored preferences are never transmitted anywhere. You can remove all of them at any time by clearing this site's data in your browser settings. Third-party services (Google Analytics, Google AdSense) may set their own cookies, governed by Google's privacy policies. In the EEA, the UK and Switzerland your choice is additionally recorded by our Google-certified Consent Management Platform.

We implement Google Consent Mode v2. The four consent signals — ad_storage, analytics_storage, ad_user_data and ad_personalization — default to granted worldwide and to denied for visitors in the EEA, the UK and Switzerland, where they are only updated once you make a choice in the privacy message. Your preferences above are applied to these signals on every page load.

How to Opt Out

Every page has a Privacy & Ad Settings link in the footer. It lets you switch off personalised advertising and analytics storage independently, and takes effect immediately — no need to clear anything by hand. (See Analytics above for exactly what switching analytics storage off does and does not stop.) In the EEA, the UK and Switzerland the same link reopens the consent message so you can change or withdraw your consent as easily as you gave it.

Turning off personalised advertising does not remove ads from the site; it stops them being tailored to you. Advertising is what keeps RuntimeRebel free to read.

You can also opt out at the Google level via Google Ads Settings, or install Google's Analytics opt-out browser add-on.

Content Sources

Articles on RuntimeRebel are generated by AI language models from publicly available RSS feeds published by The Hacker News, BleepingComputer, SecurityWeek, Krebs on Security, Dark Reading, Schneier on Security, CrowdStrike Blog, Google Cloud / Mandiant Threat Intelligence, Cisco Talos, Palo Alto Unit 42, SANS Internet Storm Center, Google Project Zero, Recorded Future, iTnews, Cloudflare Blog, plus structured data from the CISA Known Exploited Vulnerabilities (KEV) Catalog. Ingestion runs roughly every 8 hours. Original sources are credited via a source URL on each article where applicable. How generation, quality gates, and corrections work is documented on our editorial & AI transparency page. None of this processing involves your personal data — it operates on publishers' public feeds, not on anything about our readers.

Third-Party Links

Our articles may contain links to external websites. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any external sites you visit.

Installed App (PWA) & Offline Caching

RuntimeRebel can be installed as a standalone app on supported devices and browsers via the browser's "Add to Home Screen" or "Install" prompt. Installing the site as a PWA does not grant us any additional access to your device. No additional data is collected in standalone app mode compared to normal browser use. The app manifest declares no permissions beyond what the browser already grants to any website you visit.

The site registers a service worker that keeps small, capped caches of recently visited pages and assets on your device so the site loads faster and recently read articles remain available offline. These caches live entirely on your device, are never read by us, and can be removed at any time by clearing this site's data in your browser settings.

Email Newsletter

RuntimeRebel offers an optional email newsletter powered by Buttondown. If you choose to subscribe, your email address is submitted by your browser directly to Buttondown's servers — it never touches ours — and is governed by the Buttondown Privacy Policy. Subscription is double opt-in: nothing is sent until you confirm via the email Buttondown sends you. We use your email address solely to send you periodic threat intelligence digests. You can unsubscribe at any time via the link in each email. We do not share your email address with any other third party.

Data We Do Not Collect

The following data is never collected by RuntimeRebel:

• User accounts, usernames, or passwords — the site has no account system.
• Geolocation data — the geolocation browser API is blocked via Permissions-Policy.
• Camera or microphone data — both APIs are blocked via Permissions-Policy.
• Payment information — the site has no e-commerce or payment flows.
• Contact form submissions — there is no contact form; the contact page lists email addresses you can write to directly.

Your Rights

Depending on where you live (for example under the GDPR, UK GDPR, CPRA, or the Australian Privacy Act), you may have rights to access, correct, or delete personal data an organisation holds about you. Because we hold no personal data about readers on our own systems, most such requests are best directed at the third party that holds the data: Google for analytics and advertising data, and Buttondown for newsletter subscriptions (or simply unsubscribe). If you believe we hold something about you, or you have any question about your rights, contact us at the address below and we will help.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be reflected on this page with an updated revision date.

Contact

For questions about this privacy policy, contact us at privacy@runtimerebel.com.