Privacy policy

The short version

This site is static. There are no accounts, no logins, no forms and no newsletter, so there is nothing for you to hand over. What is recorded is the ordinary technical detail of a web request, plus enough to count which pages are read. Nothing is sold, and no attempt is made to identify you across other websites.

What is recorded

• Request and analytics records. Loading a page records your IP address, browser user-agent, the page requested, the referring page if your browser sends one, and the country the request came from. Raw request logs are kept for seven days; the aggregate counts derived from them are kept indefinitely and are not linked to you.
• Cloudflare. Traffic reaches this site through Cloudflare, which acts as a content delivery network and filters malicious requests. It necessarily sees your IP address and may set a security cookie.
• Advertising. This site may in future display advertising supplied by Google AdSense. If it does, Google and its partners use cookies and similar identifiers to serve and measure advertising, and may personalise it based on your prior browsing.

What is not collected

No accounts, no mailing list, no contact form, no social network tracking pixels, and no cross-site profiling. The site sets no cookies of its own. The attack-path browser and the tabletop builder run entirely in your browser — the scenarios you assemble are never transmitted anywhere.

Legal basis and your rights

Where UK GDPR applies, the lawful basis for the technical records above is legitimate interest — operating and securing a website and understanding whether its pages are read. Advertising cookies rely on consent where local law requires it.

You may ask what is held about you, ask for it to be deleted, object to processing, or complain to the Information Commissioner’s Office. Requests go to the address on the contact page. Because nothing here identifies you by name, an IP address and an approximate time is usually needed to locate the relevant records.

What this site publishes about others

BreachPathdescribes attacker behaviour, techniques and vulnerabilities drawn from public sources such as MITRE ATT&CK and published advisories. It does not profile individuals. See responsible use for the limits we work within.

External links

Pages link out to MITRE, vendor advisories and published research. Those sites have their own privacy practices and this policy does not cover them.

Changes

If this policy changes, the date above changes with it.