Skip to main content

Privacy Policy

Last updated: 18 September 2026. First published 21 June 2023.

This policy explains what personal data www.insecure.in (Insecure Lab) handles, why, who else is involved, and what you can do about it. It describes what the site actually does today, not what a website might do in general.

Who is responsible for your data

Insecure Lab is published by Pashyaa Technologies Pvt. Ltd. (CIN U72900PN2020PTC191162), registered office B-1005, Spring Woods, Marunji, Hinjawadi, Pune 411057, Maharashtra, India. Under India's Digital Personal Data Protection Act, 2023 (the DPDP Act) the company is the Data Fiduciary for personal data collected through this website.

Privacy questions, requests and grievances go to [email protected].

In short

  • You can read everything on this site without an account and without giving us any personal data.
  • We receive personal data only when you choose to send it: the contact form and the newsletter form.
  • Our own analytics are cookieless. We do not use Google Analytics.
  • The site shows advertising through Google AdSense. Google, not us, sets the advertising cookies, and you can control them.
  • We do not sell personal data.

Information you choose to send us

Contact form. Your name, email address, subject and message. We use them only to read and answer your enquiry. The message is delivered to our mailbox by email; this website keeps no database of enquiries.

Newsletter form. Your email address. We use it only to send the updates you asked for. Every email carries an unsubscribe link, and you can also ask us to remove you at any time.

Submitting either form is voluntary, and doing so is how you give consent for that specific use. You can withdraw that consent later; see Your rights.

Information collected automatically

Hosting and security. The site is served through Cloudflare. As with any website, serving a page involves processing your IP address, browser type and the page requested. Cloudflare uses this to deliver pages and to detect abusive or automated traffic, and may present a verification challenge to traffic it considers suspicious.

Analytics. We use Cloudflare Web Analytics to see aggregate figures such as page views, referrers, countries and page-load performance. According to Cloudflare, it does not use cookies, does not store anything in your browser, and does not fingerprint or track individuals across sites. We cannot identify you from it.

We no longer use Google Analytics. It was removed from this site in August 2026. Earlier versions of this policy described it; that description no longer applies.

Advertising

Most pages on this site display advertising served by Google AdSense. Advertising is what pays for the site.

  • Third-party vendors, including Google, use cookies and similar identifiers to serve ads based on your prior visits to this and other websites.
  • Google's use of advertising cookies enables it and its partners to serve ads based on those visits.
  • You can turn off personalised advertising in Google Ads Settings, or opt out of many vendors' personalised ads at aboutads.info.
  • If you visit from the European Economic Area, the United Kingdom or Switzerland, Google's consent message asks for your choice before personalised ads are shown, and lets you change it later.
  • How Google uses information from sites that use its services is described at policies.google.com/technologies/partner-sites.

The Services page carries no advertising.

Other third-party services on this site

  • Google Programmable Search powers the site search box. The search script is loaded from Google, and anything you type into the search box is sent to Google to produce results.
  • Cloudflare Turnstile protects the contact form from spam. When you submit the form, a verification token and your IP address are sent to Cloudflare to confirm the submission is not automated.
  • Brevo (Sendinblue SAS, France) delivers contact-form messages to our mailbox and stores the newsletter subscriber list.
  • Amazon. Some book links on the Hacking Books page are Amazon affiliate links. As an Amazon Associate, Insecure Lab may earn from qualifying purchases. We receive no personal data about you from Amazon; once you follow a link, Amazon's own privacy notice applies.
  • Share and social links are ordinary links. They load nothing from those networks and send them nothing unless you click.

Cookies

Insecure Lab sets no cookies of its own. Cookies and similar identifiers on this site come from Google (advertising, the consent message and site search) and, on the contact page, may come from Cloudflare Turnstile. You can block or delete cookies in your browser settings; the site's content remains fully readable if you do.

Who we share data with

Only the service providers named above, each for the purpose stated, and authorities where the law requires it. We do not sell personal data and do not share form submissions with advertisers. Some of these providers process data outside India, including in the United States and the European Union.

How long we keep it

  • Contact enquiries: for as long as needed to deal with your enquiry and keep a reasonable record of the correspondence, after which they are deleted.
  • Newsletter address: until you unsubscribe or ask us to remove it.
  • Analytics: aggregate only; there is nothing that identifies you to retain.

Your rights

Under India's DPDP Act you may:

  • ask for a summary of the personal data we hold about you and what we do with it;
  • ask us to correct, complete, update or erase it;
  • withdraw consent you previously gave, as easily as you gave it;
  • nominate another person to exercise these rights if you die or become incapacitated;
  • raise a grievance with us and, if you are not satisfied with our response, complain to the Data Protection Board of India.

If you are in the EEA or the UK, you also have rights of access, rectification, erasure, restriction, objection and data portability under the GDPR, and may complain to your local supervisory authority. If you are a California resident, you have the right to know, to delete, and not to be discriminated against for exercising your rights; we do not sell personal information.

To exercise any of these rights, email [email protected] from the address concerned. We aim to respond within 30 days. For data held by Google, such as advertising identifiers, use Google's own controls linked above, because we cannot see or delete that data.

Children

This site is not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has sent us personal data, tell us and we will delete it.

Security

The site is served over HTTPS, is a static site with no user accounts or visitor database, and form submissions are protected against automated abuse. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Links to other websites

Articles link to standards bodies, vendors, tools and references. We do not control those sites and are not responsible for their privacy practices.

Changes to this policy

When the site's data handling changes, this page changes with it and the date at the top is updated.

18 September 2026: rewritten to reflect the removal of Google Analytics and the move to cookieless analytics, to name the operating company and privacy contact, to describe advertising and other third-party services specifically, and to set out rights under the DPDP Act.

Related: Terms of Use · Disclaimer · Editorial Policy · Contact