Privacy policy
The short version: this site uses no cookies and no tracking. It counts visits with cookie-free, anonymous statistics. Personal data is only processed where it is needed to run the blog, send the newsletter you sign up for, show comments, and arrange calls you book with me.
Last updated: 29 October 20261. Who is responsible
Marcos Garcia Chillon, Switzerland. Email: contact@chillonsecurity.com. This policy follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).
2. What data is processed and why
Visiting the website
The site is hosted by Cloudflare, Inc. (USA). To deliver pages and protect the site against attacks, Cloudflare processes technical data such as your IP address, browser type, the page requested and the time of the request. I do not use this data to identify you. Fonts are served from this website, not from external font services.
Visitor statistics
To see which pages are read and whether the site loads quickly, I use Cloudflare Web Analytics. A small script from Cloudflare records the page you visit, the referring website, your browser, operating system and device type, your country, and page loading times. It sets no cookies, stores nothing on your device and does not build a profile of you or follow you across websites. I only see aggregated figures, such as the number of visits per page, and cannot identify individual visitors. This is based on my legitimate interest in understanding how the site is used and keeping it fast.
Newsletter
If you subscribe, your email address is used only to send you new posts. The newsletter is sent through MailerLite, an EU-based email service. You confirm your subscription by clicking a link in a confirmation email (double opt-in), and you can unsubscribe at any time with the link in every email. Newsletter emails do not contain open or click tracking. Your address is deleted when you unsubscribe.
Comments
Comments are provided by giscus and stored in GitHub Discussions (GitHub, Inc., USA). The comment section only loads when you click "Load comments"; your browser then connects to giscus and GitHub, which receive your IP address. To comment, you sign in with your GitHub account; your comment and GitHub username are then public. GitHub's own privacy statement applies to this.
Booking a call
The "Book a 30-minute call" button opens a booking page in Google Calendar, part of my Google Workspace account. If you book a call, the details you enter there (such as your name, email address and any notes) are used to schedule the meeting, create the video call and send confirmations and reminders. Google processes them on my behalf under its Google Workspace data protection terms. I use these details only to prepare for and hold the call, and to follow up on it. The booking page is hosted by Google, so Google's privacy policy also applies when you use it, including any cookies Google sets there.
If you write to me, I use your name, email address and message only to reply, and keep them only as long as needed for that.
3. Data transfers abroad
Cloudflare, GitHub, Google and MailerLite, together with their subprocessors, may process data in the USA and other countries. These transfers rely on the Swiss–U.S. and EU–U.S. Data Privacy Framework where the provider is certified, or on standard contractual clauses.
4. No cookies, no tracking
This website does not set cookies, does not use tracking or advertising tools and does not show ads. The only statistics are the cookie-free, aggregated visitor counts described above. Your personal data is never sold. External pages linked from this site, such as the Google Calendar booking page, follow their own cookie rules.
5. Your rights
You can ask what data I hold about you, and have it corrected or deleted. You can also object to processing or withdraw your consent at any time. Just email me. If you think your data is being mishandled, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you live in the EU, to your local data protection authority.
6. Changes
If the site starts using new services, this page will be updated. The date at the top shows the latest version.