etminan
Privacy

We don't want your data.

This is a static site — no accounts, no forms, no cookies, nothing tracking you across visits. The one honest exception is a short-lived server log described below, kept for as little time as it's useful, used only for blocking abusive traffic and an anonymized internal traffic report — never to profile an individual visitor, never shared outward.

01 — What this site does not do

No cookies, no analytics, no trackers.

No cookies
This site sets none, of any kind — no session cookies, no preference cookies, no third-party ad or analytics cookies. There's no cookie banner because there's nothing to consent to.
No analytics or tracking scripts
No Google Analytics, no Plausible/Fathom/Umami, no pixel, no fingerprinting script of any kind. Every page here is plain HTML and CSS with no third-party JavaScript at all.
No third-party embeds
No external fonts, no CDN-hosted scripts or stylesheets, no embedded videos or widgets. Every asset this site loads is served from etminan.dev itself — nothing your browser fetches here ever reaches a third party as a side effect of visiting.
No accounts, no forms
There's nowhere to sign up and nothing to submit — the Contact section is a mailto: link that opens your own mail client, not a form that sends anything to a server here.
02 — What the server necessarily logs, and why

One log, two internal uses, deleted on a schedule.

Any web server that accepts connections generates some record of that by necessity — the honest thing to do is say exactly what it is, why it exists, and how long it lasts, rather than imply there's nothing at all. This section was updated on 2026-07-22 to add the second use below — before that date only the first existed.

What's logged
Caddy, the web server, writes a per-request access log: the requesting IP address, user-agent string, the URL requested, response status, and a timestamp. This is the same information essentially every web server on the internet logs by default.
Why it exists
Two internal uses, both read-only and never shared outward. First, continuously: feeding CrowdSec, an intrusion-detection tool that watches this log for abusive patterns (credential-stuffing attempts, known attack signatures) and blocks the source at the firewall. Second, on a timer: a GoAccess traffic report (top pages, referrers, response codes) so we can actually see how the site is used — legitimate operational interest, distinct from CrowdSec's security purpose. Neither is analytics in the sense of building a profile that follows an individual visitor, and nothing from either is ever sold, shared, or handed to a third party.
The GoAccess report, specifically
Every IP address is anonymized (last IPv4 octet / IPv6 group zeroed) before it ever reaches the report — verified directly against a real build, not just assumed from the flag's name. The report itself is fully regenerated from scratch every run (no separate, longer-running database that could quietly accumulate history past the retention window below) and is stored root:root-only, entirely outside this site's public web root — never served over the web, never reachable by anyone but whoever already has direct administrative access to the server.
How long it's kept
14 days, then permanently deleted — a logrotate policy enforces this automatically on the server, not a manual step someone might forget. 14 days is enough for CrowdSec's own abuse-pattern detection (which correlates over hours to a few days, not months) while keeping actual retention short. The GoAccess report is regenerated from whatever log data exists at the time, so it can never reflect a window longer than this same 14 days either.
Who can access it
Only whoever has direct administrative (root/sudo) access to the server itself — both the raw log and the GoAccess report. Neither is exported, dashboarded publicly, or handed to any third-party service.
03 — If you email us

That's a normal email, not something this site stores.

Clicking the Contact link opens your own mail client addressed to us — whatever you send is an ordinary email exchange with the Etminan team, handled the same way any correspondence is, and is never published or shared beyond that. This website itself has no record of it; the site is static files served by Caddy, with nothing server-side to receive or log the contents of an email you send us.

04 — Downloading packages

No telemetry, no automatic phone-home.

Downloading etminan's packages or verifying their GPG signature involves no request back to us beyond the plain HTTP(S) fetch of the file itself (subject to the same access-log handling described above). Installing or running it — normal op check/run operation, the whole attestation loop — collects nothing to send back to us and makes no automatic outbound request to anything we operate.

One explicit, operator-initiated exception, added 2026-07-22: running etminan-verifier plugins list, plugins install, or plugins update fetches a signed plugin catalog manifest (and, for install/update, the plugin file itself) from etminan.dev/downloads/ (or wherever ETMINAN_PLUGIN_CATALOG_URL points, if set) over plain HTTP(S) — the same kind of file fetch as a package download above, logged the same way. It only happens if an operator explicitly types one of those three commands; it is never triggered by op check, run, or anything scheduled.

05 — Changes to this page

This is an early-stage project — this page will evolve with it.

If that ever changes — a form gets added, a channel starts requiring an account, an analytics tool gets adopted — this page gets updated to say so honestly before it happens, not after. Last reviewed: 2026-07-23.