privacy_
Yo. We do cyber security, so yeah, we watch. If you try something sus on this site, we'll know. By the time you're reading this, we've already recorded your IP address, device type and browser. Here's exactly what we keep, why, and what you can do about it.
// who we are
Randi
c/o Beau Crabill
365 Rue Sainte-Catherine E, Unit #418
Montréal, QC H2X 3X2
Canada
Contact: [email protected]. The person in charge of personal information (Québec Law 25) is Beau Crabill, reachable at the same address.
This policy covers randi.io. Our other sites have their own.
// what we record on every visit
This happens on every request, no matter what, because it's how we spot attacks:
- IP address
- Device type, operating system and browser (from your user agent)
- Date and time, the pages and files you requested, the referring site, and the response we gave
Our network provider, Cloudflare, sits in front of the site and handles the same request data to block attacks and bots. It may set one strictly necessary security cookie (__cf_bm) to tell humans from bots.
// what we record about what you do
We also track every event on the page:
- Page views, plus screen size, pixel density, touch vs. mouse, language and the site that sent you
- When you first interact, every fragment you decrypt, whether you find all of them
- When you leave and how long you stayed
Events are linked to a random ID that lives for one page load. It isn't a cookie and isn't stored. Combined with the server logs above, we can generally tell what a given IP and device did here.
EU, EEA and UK visitors: event tracking stays off until you hit "i'm in" on the banner. If your browser sends a Global Privacy Control signal, we treat that as a "nah" wherever you are.
// if you try something sus
Scanning, probing, injection attempts, credential stuffing, scraping at scale, flooding, or anything else aimed at breaking things: we keep the logs, we block you, and we may share the relevant records with your network provider's abuse team or with law enforcement.
// what we don't do
- No ads, no ad networks, no third-party analytics
- We don't sell or rent your data, ever
- No accounts and no profiles across other websites
// why we're allowed to
- Server logs and security: our legitimate interest in keeping the site and our systems secure (GDPR Art. 6(1)(f)), and as necessary to run the service.
- Event tracking: your consent in the EU, EEA and UK (GDPR Art. 6(1)(a)). Elsewhere, our legitimate interest in understanding how the site is used. You can opt out any time below.
// how long we keep it
Server and event logs are kept for up to 90 days, then deleted. Logs tied to a security incident are kept as long as the investigation or any legal claim needs them.
// where it lives
The site runs on Amazon Web Services and is delivered through Cloudflare's global network, so your data may be processed outside your country, including in Canada and the United States. We rely on the safeguards those providers offer, such as the EU Standard Contractual Clauses.
// your rights
Depending on where you live, you can ask to access, correct or delete your data, object to or restrict how we use it, get a copy of it, and withdraw consent. Email [email protected]. Tell us your IP address and the approximate time of your visit, since that's all we have to find you. We may keep logs we need for an active security investigation.
You can also complain to your local data protection authority. In Canada, that's the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.
// cookies & storage
We don't set cookies ourselves. We store your banner choice in your browser's local storage underrandi-consent. Cloudflare may set __cf_bm (security, about 30 minutes).
// kids
This site isn't meant for anyone under 16, and we don't knowingly collect data about children.
// changes
If this changes, we'll update this page and the date at the top.