Privacy policy
Last updated: 2026-07-30
This is the privacy policy for Saboteur (saboteur.dev), operated by Saboteur LLC.
We are deliberate about the data we collect. This site is cookieless — it sets no cookies, uses no client-side storage, and shows no consent banner. Even so, some personal data is processed — server logs, at minimum. This policy explains what, why, and how.
If anything here is unclear, or if you want to exercise any of the rights described below, email us at privacy@saboteur.dev.
Who we are
Saboteur LLC is the data controller for this site. You can reach us at privacy@saboteur.dev.
What we collect
Server logs
When you visit any page on this site, our hosting provider (Cloudflare) records technical information about the request: your IP address, the page requested, the time of the request, the referring URL (if any), and your browser’s User-Agent string. This happens automatically as part of how the web works; no script or tracker on our side is involved.
Server logs are retained for 90 days for security, abuse detection, and basic operational metrics.
This site has no contact form, no newsletter signup, and no other input field. Beyond the server logs described above, we collect nothing you type.
Lawful basis for processing
Under the EU/UK General Data Protection Regulation (GDPR), we process personal data on the following lawful bases:
- Legitimate interest (Art. 6(1)(f)) — server logs, security, and operational metrics. The interest is operating this site; the impact on you is minimal.
We do not rely on consent for any default processing on this site.
Who we share data with
We use the following processors. Each processes data on Saboteur LLC’s behalf under a Data Processing Agreement.
| Processor | What it does | Where it’s based |
|---|---|---|
| Cloudflare, Inc. | Hosting (Cloudflare Pages) and edge logs. | United States |
We do not share personal data with third parties for advertising or marketing.
We do not sell your personal data
Saboteur LLC does not sell personal data, and does not share it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) and comparable US state privacy laws. We have not done so in the preceding twelve months.
We also do not use your data for targeted advertising or for profiling that produces legal or similarly significant effects. There is no advertising network, data broker, or ad-tech vendor in this site’s stack.
Because we do not sell or share personal data, there is nothing for a “Do Not Sell or Share My Personal Information” link to opt you out of. We honour browser-level universal opt-out signals such as Global Privacy Control (GPC) by default, in the sense that the processing those signals govern does not happen here at all.
International transfers
Cloudflare is based in the United States. Where data reaches it from the EU or UK, the transfer is governed by EU Standard Contractual Clauses (SCCs) under its Data Processing Agreement. This is the standard safeguard for transfers to the US after the Schrems II ruling.
If you would like a copy of the Standard Contractual Clauses or Data Processing Agreements we have in place with these processors, write to privacy@saboteur.dev.
How long we keep data
- Server logs: 90 days.
If you ask us to delete data sooner, we will.
Your rights — EU and UK
Under GDPR, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Erase your data (“right to be forgotten”).
- Restrict processing while we resolve a dispute.
- Receive your data in a machine-readable format (“data portability”).
- Object to processing based on legitimate interest.
- Withdraw consent where consent is the basis (rare on this site).
- Lodge a complaint with your local data protection authority.
To exercise any of these, email privacy@saboteur.dev. We respond within one month, as required by GDPR.
Your rights — United States
US privacy rights are set state by state. Rather than track which of your rights depend on where you live, we extend the following to every US resident who asks, regardless of state and regardless of whether that state’s law technically applies to a business our size.
You have the right to:
- Know what categories of personal data we have collected about you, why, and who we shared it with.
- Access a copy of that data.
- Correct inaccurate personal data.
- Delete personal data we hold about you.
- Portability — receive your data in a portable, machine-readable format.
- Opt out of sale, sharing for cross-context behavioural advertising, targeted advertising, and profiling. As described above, we do none of these, so there is nothing to opt out of.
- Non-discrimination — we will not treat you differently, or degrade the site for you, because you exercised any of these rights.
We do not collect sensitive personal information as US state privacy laws define it — no government identifiers, precise geolocation, biometric or health data, racial or ethnic origin, religious beliefs, sexual orientation, or contents of your private communications with other people. There is therefore no “limit the use of my sensitive personal information” right to exercise here.
To make a request, email privacy@saboteur.dev from the address you contacted us with, or describe the request well enough that we can locate the records. We respond within 45 days, and will tell you if we need the extension that most state laws allow.
If we deny your request
You may appeal. Reply to our decision, or write to privacy@saboteur.dev with the word appeal in the subject line. We will review the decision and respond in writing within 45 days, explaining our reasoning. If we deny the appeal, we will give you a way to contact your state Attorney General to complain. This appeals process is required by several state privacy laws and we offer it to everyone.
California
If you are a California resident, the rights above are your CCPA/CPRA rights. The categories of personal data we collect are listed in What we collect; the business purposes are listed alongside them; the processors we disclose data to are named in the table above. An authorised agent may submit a request on your behalf if they provide written proof that you authorised them.
Children
This site is not directed at children. We do not knowingly collect personal data from children under 16, and we do not sell or share the personal data of anyone under 16 — a distinct requirement under California law. If you believe we have collected a child’s data, write to privacy@saboteur.dev and we will delete it promptly.
Automated decision-making
There is none. We do not make automated decisions about you that produce legal or similarly significant effects, and we do not profile you.
Cookies and tracking
This site uses no cookies and no client-side tracking. This is a deliberate posture; we audit it before every release. If we ever change this — for example, by adopting an analytics tool that requires consent — we will update this policy and add a consent banner before the change goes live.
Changes to this policy
We may update this policy as the site or its processors change. The Last updated date at the top of this document reflects the most recent change. Material changes (new processors, new categories of data, new purposes) will be flagged at the top of the policy for at least 30 days after taking effect.
Contact
For any privacy-related question, request, or concern, email privacy@saboteur.dev.
You can also reach Saboteur LLC by post at the address listed in our Terms of Service.