Who runs this site
The Security Checklist (thesecuritychecklist.com) is operated by Daniel Oakley in the United States. For any question or request about your data, use the contact page — a person reads it.
Last updated: August 27, 2026. If we change this policy, we change this date and describe the change here.
The short version
We collect the minimum needed to run a membership site: your email address when you create an account, aggregate visit counts that identify no one, and whatever you choose to send us through the contact form. We do not sell or rent your data to anyone, we run no advertising trackers, we build no cross-site profiles, and we will never email you marketing without your express opt-in. We teach people to get their data away from data brokers; we are not going to behave like one.
What we collect, and why
Account information. When you create a member account, our sign-in provider Clerk collects and stores your email address and, if you sign in with Google, Apple, or X, the basic identity those services share (your email and name as they provide it). We also store, with your account: which page you signed up from (so we understand what content brings members in), your consent choices, and the timestamps for both.
Aggregate analytics. We use GoatCounter, a privacy-focused analytics service that counts page views without cookies, without advertising identifiers, and without tracking you across other sites. We see totals and referrers, not individual browsing histories.
Contact messages. If you use the contact form, Formspree (the form service) transmits us what you wrote and the email address you provided. That is used to reply to you and for nothing else.
Technical data inherent to serving a website. Our hosting provider (Replit) processes standard server logs, which include IP addresses. Additionally, your browser fetches some page assets directly from third-party hosts — fonts from Google Fonts, icon and style libraries from cdnjs, and, on account pages only, sign-in components and bot protection from Clerk and Cloudflare. Those providers receive the standard data any web request carries (your IP address and browser details) when serving those files. We chose each of them deliberately and use no others.
What we never do
We do not sell, rent, or trade your personal information — to anyone, for any reason. We run no third-party advertising trackers and no social-media pixels. We do not build advertising profiles or share data with data brokers. We send no marketing email without your separate, express opt-in, and anything you opt into has a working unsubscribe. If we ever run sponsorships, sponsors get aggregate numbers at most — never your identity, never your email.
Children
This site helps parents secure their children's devices, but it is a service for adults. We do not knowingly collect personal information from children under 13, and member accounts are limited to people 16 and older (see the Terms of Service). If you believe a child has created an account or sent us personal information, contact us and we will delete it.
Who processes data on our behalf
We use a small, deliberate set of service providers: Clerk (member accounts and sign-in), GoatCounter (aggregate analytics), Formspree (contact form delivery), Replit (hosting), and — as asset hosts your browser talks to directly — Google Fonts, cdnjs, and Cloudflare (bot protection on sign-in pages). Each receives only what its function requires. Beyond these providers, we disclose personal information only if the law genuinely compels it.
Your choices and rights
Regardless of where you live, we honor these on request:
See it. Ask what we hold about you and we will tell you — it is short.
Fix it. You can change your email and sign-in methods yourself from your account page.
Delete it. You can delete your account yourself (Account → manage your account → delete account), which removes your data from our sign-in provider. Or ask via the contact page and we will do it for you.
Unsubscribe. Any email you have opted into can be stopped any time, and stopping is as easy as starting.
Retention and security
Account data is kept while your account exists and deleted when it is deleted. Contact messages are kept only as long as needed to handle them. Aggregate analytics contain no personal information and are kept for trend history. Everything is served over encrypted connections (HTTPS), we collect as little as possible in the first place — the best protection for data is not having it — and we use established providers with strong security practices for what little we do hold.
Affiliate links
Some guides may contain affiliate links, marked as such where they appear. Clicking one takes you to the vendor's site under their privacy policy; we pass along no personal information about you with the click.
Questions
If anything here is unclear, ask via the contact page. A privacy policy you can't understand isn't protecting you — that's true of the ones we teach people to read, and it's true of ours.