Who runs this site
The Security Checklist (thesecuritychecklist.com) is operated by The Security Checklist LLC in the United States. For any question or request about your data, use the contact page. A person reads it.
Last updated: September 14, 2026. If we change this policy, we change this date and describe the change here. This update makes two changes. First, member email: signing up now means you may receive guide updates and mail about our products, sponsors and partners, with a one-click unsubscribe on everything except account and security messages. We no longer ask for a separate opt-in first, so the unsubscribe is your control. Second, we have said plainly that we measure how this site is used and do not sell what we learn. This supersedes the member-email half of the September 6, 2026 note; the Microsoft Clarity cookie disclosure from that same date is unchanged, as are the September 8 naming of The Security Checklist LLC as operator and the September 5 note on Google Ads conversion counting.
The short version
We collect the minimum needed to run a membership site: your email address when you create an account, GoatCounter's cookieless aggregate visit counts, Microsoft Clarity session recordings on the parents setup landing and /sign-up (so we can see how those pages are used), and whatever you choose to send us through the contact form. We do not sell or rent your data to anyone. The one piece of advertising measurement we run is Google Ads conversion counting: if you arrive from one of our Google ads, a first-party cookie lets us count that the click became an account: a count, not a profile. We run no social-media pixels, no remarketing lists, and no Google Analytics, and Clarity is not connected to any ads product. We build no advertising profiles. Creating an account means we may email you account and security messages, plus guide updates and mail about our own products, sponsors, or partners. Everything except account and security mail carries a one-click unsubscribe, and we honour it. We do not sell or rent your email and we do not buy lists. We teach people to get their data away from data brokers; we are not going to behave like one.
What we collect, and why
Account information. When you create a member account, our sign-in provider Clerk collects and stores your email address and, if you sign in with Google, Apple, or X, the basic identity those services share (your email and name as they provide it). We use that email to run the account (verification, security, sign-in) and to send guide updates and other member mail unless you unsubscribe. We also store, with your account: which page you signed up from (so we understand what content brings members in), your email preferences, and the timestamps for those.
Aggregate analytics (GoatCounter). GoatCounter remains the sitewide scoreboard. It counts page views without cookies, without advertising identifiers, and without tracking you across other sites. Those totals and referrers identify no one.
We measure how this site is used, and we do not sell what we learn. Understanding which pages people read and where they get stuck is how the site gets better, so we do measure it. That is a different thing from what the data brokers in our opt-out guide do: they collect names, phone numbers and addresses and sell them on. We have no plan to sell, rent, or trade usage data, and we do not build advertising profiles from it. If that ever changes, it changes here first, with a dated update.
Session recordings on the parents setup landing and sign-up (Microsoft Clarity). On /advice/parents-setup.html (the Ads landing and the signed-in walkthrough at the same URL) and on /sign-up, we load Microsoft Clarity so we can diagnose how those pages are used: clicks, scrolls, mouse movement, and how the page rendered. Email and password fields on sign-up are masked. Clarity sets two first-party analytics cookies: _clck (about one year) and _clsk (about one day). Their only job is to let the pages of one visit read as a single session, so we can see, for example, that the same visit went from the landing page to sign-up, and to recognize a returning browser. They are analytics cookies only: they carry a random id, not your name or email, and we use them for nothing else. Recordings are retained about 30 days for webmaster access. We do not sell this data. We do not call Clarity's identify API with your account email or user id. We do not grant Clarity ad_Storage, and we do not connect it to Microsoft Ads or Google Analytics. We do not load Clarity on /sign-in, /user, or the account page. GoatCounter remains the cookieless aggregate scoreboard.
Ad-click conversion counting (Google Ads). We buy a small number of Google search ads. To know whether that spend works, we use Google's conversion tag: when you arrive from one of our ads, the tag sets a first-party cookie (_gcl_aw, kept about 90 days), and if you later create an account the tag sends Google a single signal that that ad click converted. That signal carries no name and no email. It is how we count which keywords earn their keep. We do not use remarketing, we do not upload your email to Google, and we do not run Google Analytics.
Contact messages. If you use the contact form, Formspree (the form service) transmits us what you wrote and the email address you provided. That is used to reply to you and for nothing else.
Technical data inherent to serving a website. Our hosting provider (Replit) processes standard server logs, which include IP addresses. Additionally, your browser fetches some page assets directly from third-party hosts: fonts from Google Fonts, icon and style libraries from cdnjs, the Google tag for the ad-conversion counting described above (googletagmanager.com and Google's ad-measurement hosts), and, on account pages only, sign-in components and bot protection from Clerk and Cloudflare. On the parents setup landing and /sign-up, the browser also talks to Microsoft Clarity (clarity.ms and c.bing.com) for the session recording described above. Those providers receive the standard data any web request carries (your IP address and browser details) when serving those files.
Email we send
Creating an account is the relationship. We may email you in two buckets:
Account and security. Verify your email, sign-in alerts, “you’re in,” password resets. These stay on. They are how the account works.
Everything else. Guide tips, what’s new, onboarding, and mail about our own products, sponsors, or partners. On by default when you create an account, disclosed here and at signup. Every one of these carries a one-click unsubscribe, and we honour it. That unsubscribe is your control: we do not ask you to opt in first, so if you would rather not hear from us, use it and we stop.
We do not buy lists. We do not rent or sell your address. We do not hand your email to a sponsor or a broker.
What we never do
We do not sell, rent, or trade your personal information to anyone, for any reason. We do not run social-media pixels, remarketing, or Google Analytics; the only advertising measurement is the Google Ads conversion count described above, and we do not connect Microsoft Clarity to ads. We do not build advertising profiles or share data with data brokers. We do not sell or rent your email, and we do not buy mailing lists. Creating an account means we may send account messages plus guide updates and mail about our own products, sponsors, or partners; everything except account and security mail carries a one-click unsubscribe. If we ever run sponsorships, sponsors get aggregate numbers at most: never your identity, never your email.
Children
This site helps parents secure their children's devices, but it is a service for adults. We do not knowingly collect personal information from children under 13, and member accounts are limited to people 16 and older (see the Terms of Service). If you believe a child has created an account or sent us personal information, contact us and we will delete it.
Who processes data on our behalf
We use a small, deliberate set of service providers: Clerk (member accounts and sign-in), GoatCounter (aggregate analytics), Microsoft Clarity (session recordings on the parents setup landing and /sign-up), Google Ads (ad-click conversion counting), Formspree (contact form delivery), Replit (hosting), and, as asset hosts your browser talks to directly, Google Fonts, cdnjs, and Cloudflare (bot protection on sign-in pages). Each receives only what its function requires. Beyond these providers, we disclose personal information only if the law genuinely compels it.
Your choices and rights
Regardless of where you live, we honor these on request:
See it. Ask what we hold about you and we will tell you. It is short.
Fix it. You can change your email and sign-in methods yourself from your account page.
Delete it. You can delete your account yourself (Account → manage your account → delete account), which removes your data from our sign-in provider. Or ask via the contact page and we will do it for you.
Unsubscribe. Everything except account and security mail can be stopped any time. One click in the email, or ask via the contact page and we will do it. Every commercial message we send carries a working unsubscribe and our postal address. Account and security messages stay on while the account exists.
Retention and security
Account data is kept while your account exists and deleted when it is deleted. Contact messages are kept only as long as needed to handle them. GoatCounter's aggregate counts contain no personal information and are kept for trend history. Microsoft Clarity recordings on the parents setup landing and /sign-up are retained about 30 days. The Google Ads conversion cookie (_gcl_aw) expires after about 90 days; Clarity's analytics cookies expire after about one year (_clck) and one day (_clsk). Everything is served over encrypted connections (HTTPS), we collect as little as possible in the first place, since the best protection for data is not having it, and we use established providers with strong security practices for what little we do hold.
Affiliate links
Some guides may contain affiliate links, marked as such where they appear. Clicking one takes you to the vendor's site under their privacy policy; we pass along no personal information about you with the click.
Questions
If anything here is unclear, ask via the contact page. A privacy policy you can't understand isn't protecting you. That's true of the ones we teach people to read, and it's true of ours.