Privacy policy
Who we are
MorningStar Security is published by Andrew Horton from Sydney, Australia. The about page says more. For anything in this policy, write to editor@morningstarsecurity.com. We hold ourselves to the Australian Privacy Principles and, for readers in the EU and UK, to the GDPR.
What we collect, and why
Reading needs nothing. The paper is readable without an account, and most of what's listed here only exists if you use the feature it belongs to.
- An account: your email address, a hashed password (we can't read it), whether the address is verified, and your profile (username, optional avatar). For fraud- and abuse-spotting the account also notes the IP address and browser of your latest sign-in and of invite activity; that capture is blanked after 12 months, and it's in your export, so you can see exactly what it holds.
- Things you do signed in: comments are public, under your username.
Votes, stars and emoji reactions feed the public counts but are never shown
with your name. Puzzle records, wiki flags and feed suggestions carry your
account. Your reading history and starred stories are never shown to other
readers, and the read log is purged after 12 months. From that log the paper
derives a coarse picture of the topics you read — rebuilt nightly from the
last 90 days — and puts it to two uses. It decides which polls and surveys to
invite you to. And, once you have been reading here a while, it is shown
to you: the paper offers you the picture itself, and points out which
jobs on its own board match it. Both uses stay on this site. Nobody,
staff included, sees who is in an interest group; only counts leave the
site. If a subject in that picture is wrong,
you can strike it out where it is shown, and it stays struck.
Two switches. On your profile you can stop the paper recording what you open at all: flip it and the log we already hold is deleted rather than merely hidden, the picture derived from it goes with it, and polls and survey invites stop too, because they were built from the same reading. Beside it, a narrower one lets you switch the profiling off and leave the log alone. The derived picture is deleted on the spot, and polls, survey invites and their karma stop with it. Both are free, immediate and reversible, but reversing one does not restore what was deleted. Which switch you pressed, when, and against which version of this page is recorded, so the record can say what you were objecting to. The paper also keeps a coarse note of which days your account was active. - Polls & research: if you answer a reader poll or survey, the answer is recorded against your account and earns karma. Results only ever leave the building as aggregates — counts and averages, never who said what — and free-text answers are read by staff, never published. Your answers are in your export, kept while the account exists and deleted with it; the aggregates survive as statistics. A “don't ask me this again” is kept too, so we actually stop asking.
- Pictures you put on the jobs desk: a listing can carry up to
fifteen and so can your jobs profile. They are public to
anyone who can open the page, and they are not indexed: the desk asks crawlers away from
/jobsand every picture is served with a header telling image indexes to leave it alone. Everything you upload is re-encoded from the pixels on the way in, so the location, camera and timestamp a phone writes into a photograph do not survive the upload, and neither does anything appended to the end of the file. Nothing else in the picture is removed for you: what is in the frame is what gets published, so black out anything that is not yours to publish before you upload it, in the pixels rather than in a layer.
A picture waits for the desk to look at it before it appears. They are in your export, they are deleted when you delete them, and they are deleted with your account. Pictures on a listing come down when you close your account even though the listing itself stays, and a listing's pictures are removed when the listing is deleted; an expired listing keeps its pictures, because its page stays readable. Removing a picture stops us serving it. It can't un-copy what somebody already downloaded. - Live chat: when enough readers are on a story at once it may offer
an ephemeral group chat. It is end-to-end encrypted: your browser seals
each message to the people in the room, and this server stores something it
has no key for. We cannot read your chat messages, and neither can anyone
who steals our database, restores a backup, or serves us a warrant for what
is stored. On top of that, a conversation is deleted half an hour after
the last thing anyone says in it. A room that never falls quiet is still
cleared out after 24 hours. Nobody who arrives later can be shown a room that
has ended.
One limit: we serve the JavaScript that does the encrypting. A future version of this site — or someone who has taken it over — could serve code that leaks what you type, and no amount of encryption in a web page can prevent that. The encryption protects stored data, backups and logs, and keeps your messages from staff. It does not protect you from an active, deliberate attack. It is not Signal. Everyone in the room can read what you write there, and the other readers on a news story are usually strangers.
Because we can't read them, chat messages are not in your data export any more: it lists when you spoke and on which story, and says that the content is encrypted. Reporting a message can hand us that one message's key so a moderator can act on it (your choice, one message at a time).
What the room shows about you. Everyone in a chat, signed in or not, appears under a nick that belongs to that story alone. You can change it, and it is never carried to another story, so it cannot be used to follow you around the paper. Your username is not shown: a dot marks that an account stands behind a nick, without saying whose. Beside it the room shows a two-letter country and, for accounts, a coarse karma band (“new”, “5+”, “25+”, “100+”), a band, not your exact score. That country is a guess. We run no location database, so it comes from your browser's language setting, or from a header a CDN adds if one is in front of us, and it is often blank. Say so and we won't show it. The control sits next to your nick, and it matters most for the readers a country would endanger. Know the trade either way: a country and a karma band together narrow the field, and in a small room they may be enough to guess who you are.
If you read without an account, chat uses a random signed browser token instead, because we don't know who you are. The “N reading now” count shows a number and no names. - Advisor chats: if you talk to one of the AI Characters who act as advisors on a story, the conversation is kept for 30 days, private to you, then deleted.
- The jobs desk: a career profile if you make one, and CVE claims you make. A CV you drop is read once and never stored; only a 30-day cookie remembers you dropped one.
- The newsletter: your email address, which desks and cadences you chose, a record of your consent (when you subscribed and confirmed), and a suppression entry if you unsubscribe or mail to you bounces, so we don't mail you again.
- Invites and referrals: who invited whom, because invites are counted and referrals can earn Pro time.
- Tags you track: the product names you type into your tags, while you are signed in. They are used only to highlight matching stories for you. They are not shown to other readers or used for advertising, and they are deleted with your account.
- Forms: what you type into feedback and suggest, plus a reply address if you choose to leave one. Feedback works with no account and no email at all.
- Server logs, like every web server: IP address, the page requested, the time. Used for security, abuse prevention and debugging. Never for advertising.
- Analytics: first-party, cookieless counting (Plausible), served and received through our own domain — your browser never contacts an analytics host. We count page views, and we count a short list of actions: starring, reacting, voting, posting, sharing, pressing play, starting or finishing the puzzle, and which display controls get touched. Those events carry ids and labels only. They do not include your name, anything you typed, or the title of what you were reading. Plausible sets no advertising identifiers and does not track you across other sites.
Who else touches your data
We don't sell personal information, share it with data brokers, or run ad-tech. The others involved:
- Email delivery: Amazon SES and SMTP2GO carry the newsletter and account mail, so they process your email address on servers outside Australia, including in the United States, under their data-processing agreements.
- Payments: nothing on the site takes a card today. When Pro payments open they will run through Stripe: your card goes to Stripe, never to us, and we hold only your subscription status.
- Direct fetches. Your browser gets some things itself: story thumbnails from the original publishers' and YouTube's image servers, video through YouTube's privacy-enhanced (youtube-nocookie) player on watch pages, and podcast audio from each show's own host. Those servers see your IP address the way any site you visit does. (Typefaces are served from this site: no reader's IP reaches a font CDN.)
- Hosting: the paper's servers are rented, like nearly everyone's, and the hosting provider carries the traffic (including IP addresses) the way any host does.
We process account data because running your account requires it (contract), the newsletter because you asked for it (consent, which the confirm click records), and logs and the anti-abuse capture to protect the site and its readers (legitimate interests). The interest profiling above also rests on legitimate interests, so you can object with a switch on your profile, and the processing stops when you do. Where processing happens overseas, it's with providers operating under recognised data-processing agreements.
Your rights
- Export: everything your account holds, self-serve from your profile.
- Delete: also self-serve from your profile. Deletion is real: your comments, votes, reactions, reading history, stars, advisor chats and jobs profile go with the account, not just the login.
- Unsubscribe: every newsletter carries an unsubscribe link; the suppression entry it creates is kept so the opt-out sticks.
- Object: two switches on your profile, both free and immediate. Your reading stops the reading log and everything built on it, and deletes the log already held. Interest profiling leaves the log alone, deletes the derived profile, and stops the polls and survey invites. Which one you pressed, and when, is recorded.
- The rest: correction, access to anything the export misses, or any question: editor@morningstarsecurity.com. If you think we've handled your data badly, you can also complain to the OAIC in Australia or your local supervisory authority in the EU/UK.
How long we keep things: account data for as long as the account exists, then it's deleted as above. The read log is purged and the anti-abuse IP capture blanked after 12 months, even while the account lives; the picture derived from that log is rebuilt nightly from the trailing 90 days, so it is never older than that. Objecting deletes immediately; it doesn't wait for either period. If you unsubscribe from the newsletter, the suppression entry and the consent record are kept — one so the opt-out sticks, the other as the proof the law asks us to hold. If you delete your account, even those go: erasure takes the address off every list, suppression included.
Children
The paper is written for working security professionals and isn't directed at children. Accounts are for people 16 and over; tell us about an account held by someone younger and we'll delete it.
Changes
When this policy changes, the date at the top changes with it, and the section below says what changed. This page was first published on 18 August 2026. This is version 2026-08-v2, and the version is recorded against any objection you lodge.
What changed on 25 August 2026. The read log gained a switch of its own. Until this date the control on this page stopped the interest profiling but not the logging underneath it, which was less than these words promised, so a reader who had objected went on being recorded. That is fixed: the switch on your profile now stops the recording and deletes what was already held.