Privacy

Your stack is the most sensitive thing you could tell a website. A list of the products and versions an organisation runs is a target list.

So it is not stored unless you sign in and save it. Passed on the query string it is used to render the page and then discarded; nothing is written down.

Page views are counted through a self-hosted Matomo, tracked from our own server rather than by a script in your browser. Your browser never contacts the analytics host, addresses are truncated before they are sent, and requests carrying Do Not Track are dropped before anything is recorded.

We do not log the stack parameters against a visitor. The URL you can bookmark contains your stack; our request log does not — and it is stripped out of the URL before any analytics call leaves this server, so the analytics host never sees it either.

Counts of page views also go to 360REV, the platform that sends our newsletters and runs our error reporting. They are sent from this server, aggregated by page, with no address and no visitor identifier — and a request carrying Do Not Track never reaches them. We do not serve their browser tag, because every page here works with JavaScript switched off and we are not going to put a third-party script on the page to count you.

Alerts are the one exception to "nothing is stored". If you turn them on, we store the products you asked to be told about — not their versions, and not your address. What we hold is on the alerts page, and you can switch it off from the same control.