Privacy Policy.
Last updated: 2026-04-23 · Effective immediately
The short version.We don't track you. No advertising, no third-party trackers, no fingerprinting, no data sales, no data sharing. We do count page loads anonymously via Cloudflare Web Analytics so we know which stories land — it sets no cookies and cannot identify you individually.
What this policy covers
This policy describes how TinFoilHatsMatter(“we”, “us”, “the show”) handles information when you visit this website. It applies to the website only; audio streams served by Apple, Spotify, Amazon, Pocket Casts, Player FM, Deezer, or any other platform are governed by those platforms' policies, not ours.
Information we do NOT collect
- We do not use Google Analytics, Facebook Pixel, Mixpanel, PostHog, Heap, Plausible, Fathom, or any other user-tracking analytics tool. We do use Cloudflare Web Analytics, an aggregate page counter with no cookies and no identity tracking — see the next section for details.
- We do not run advertising networks. No ads. No advertiser tracking.
- We do not fingerprint your browser or device.
- We do not embed social media pixels, share buttons, or third-party “like” widgets.
- We do not set advertising or tracking cookies.
- We do not attempt to identify you.
Aggregate analytics (Cloudflare Web Analytics)
We use Cloudflare Web Analytics to count page loads — nothing more. Unlike Google Analytics and similar tools, Cloudflare Web Analytics:
- Sets no cookies. Nothing is stored in your browser.
- Does no cross-site tracking. It can't follow you from this site to anywhere else.
- Does no fingerprinting. No canvas, font, or device-characteristic analysis.
- Collects no personal data. Only aggregate totals: page URL, country-level geography, timestamp, referring URL.
- Reports only in bulk. We can tell you “400 people loaded episode 001 yesterday,” but there is no “individual visitor” record to dig into.
We use it so we know which episodes and platforms are reaching people. It's roughly as invasive as a bookstore counting who walks through the door, minus the ability to see what you picked up. Cloudflare's own statement on this tool: cloudflare.com/web-analytics-privacy.
If you'd rather not be counted at all, a browser-level blocker (uBlock Origin, Brave, etc.) will stop the beacon from loading with no loss of functionality on your end.
The one thing your browser stores
When you click a rating button on an episode page (👍, 👍👍, 👎, 👎👎), your browser saves a single entry in localStorage:
thm_vote_<episode-slug> = "up" | "doubleUp" | "down" | "doubleDown"This exists so you don't double-vote, and so your button choice stays highlighted when you return. It contains no personal information. It never leaves your browser. We do not read it on the server. You can clear it by clearing site data for this domain in your browser settings. Once you dismiss the privacy banner, a second entry named thm_notice_ackis also stored so the banner doesn't nag you. That's the complete list.
Information the infrastructure sees
This site is hosted on Cloudflare Workers. When you load any page, Cloudflare's edge network sees your IP address and basic request metadata (browser user-agent, referring URL, request timestamp). This is how the internet works — every web request discloses this to whoever is serving the page.
We receive only aggregate, anonymous statistics from Cloudflare — page views per country, cache hit ratios, bandwidth. We cannot look up individual IP addresses or tie requests to a person. Cloudflare's own privacy policy governs how they handle this data in transit; see cloudflare.com/privacypolicy.
Rating vote counts
When you rate an episode, your vote is sent to a small API endpoint on this site which increments a counter in a Cloudflare KV store. The stored data is a pure count per episode — e.g. { up: 12, doubleUp: 3, down: 1, doubleDown: 0 }. We store no information about the voter — no IP, no user ID, no fingerprint, no timestamp.
Your rights — GDPR (EU/UK visitors)
Under the General Data Protection Regulation, you have the right to access, correct, delete, and export any personal data a controller holds about you, and to object to processing.
Because we do not collect or store personal data, none of these requests would return anything. We simply have nothing on you to deliver, correct, or delete. If you want to confirm this for yourself, email [email protected] and we'll reply within 30 days.
Your rights — CCPA / CPRA (California visitors)
Under the California Consumer Privacy Act and California Privacy Rights Act, California residents have the right to know what personal information a business collects, to delete that information, to correct it, to opt out of its sale or sharing, and to not be discriminated against for exercising those rights.
- What we collect about California residents: nothing that identifies you personally.
- What we sell: nothing. We have no data to sell.
- What we share with third parties: nothing, beyond the standard request metadata disclosed to Cloudflare as our infrastructure provider.
Because we do not sell personal information, a “Do Not Sell My Personal Information” link is not required. Nevertheless: we wouldn't even if you asked us to.
Cookies
We do not set any cookies. Not session cookies, not tracking cookies, not preference cookies. The privacy banner dismissal state and your episode rating are stored in localStorage, which is similar to cookies technically but is never sent to our server.
Children
This site is not directed at children under 13. We do not knowingly collect information from anyone; we especially do not collect information from children.
Links to other sites
Subscribe buttons on this site link out to podcast platforms (Apple, Spotify, Amazon, etc.) and to the RSS feed hosted by our podcast host, Transistor. Once you click a link, the destination site's privacy policy applies — not ours.
Changes to this policy
If this policy ever changes, the “Last updated” date at the top will reflect the new date. Material changes will be announced on the podcast and via the dead-drop newsletter.
Contact
Privacy questions, data requests, or you just want confirmation we aren't secretly selling your IP address to a defense contractor? Email [email protected].
The short version is the real version. The long version above exists because GDPR and CCPA require it to. We respect that, and we respect you more. — TinFoilHatsMatter