No cookies, no local storage
This site sets no cookies and doesn’t use local storage, session storage, or IndexedDB. If that ever changes, any cookie will be Secure; HttpOnly; SameSite=Strict and this page will say so first.
Privacy // Last updated 2026-09-29
Privacy, disclosure & integrity
The short version: this site sets no cookies, loads no trackers, and stores nothing about you. Here is exactly what happens when you visit.
- Cookies
- 0
- None set, no banner needed
- Trackers
- 0
- No ads, pixels, or fingerprinting
- IP addresses stored
- 0
- By this site
- Analytics
- Cookieless
- Anonymous counts only
What we collect
Cookieless, aggregate analytics
We count a few anonymous events ourselves: “play started”, “subscribe link clicked” (with the platform), newsletter sign-ups, and contact-form submissions. Each record is just the event, the page, the episode or platform, and the time: no IP address, cookie, or identifier, so events can’t be linked to you or to each other. They’re deleted after 13 months. If your browser sends Global Privacy Control or Do Not Track, we don’t count your plays or clicks at all.
Audio comes from the podcast host
When you press play, your browser streams the episode directly from our podcast host (media.example-podcast-host.com), not from this site. The host sees that request like any podcast app download; its own privacy policy applies. Nothing loads until you press play.
Kept for 180 days, then deleted
Contact and guest-pitch submissions (the type, your name, email, subject, and message) are stored in our private database so we can review and reply, and may also be forwarded to us by email. They’re deleted automatically after 180 days; ask us any time to delete yours sooner. We don’t store your IP address with them. Forms use Cloudflare Turnstile to block bots, without cookies or image puzzles. To slow abuse, we count submissions per network for one hour using a one-way hash; the counter expires and is never linked to your message.
Only the newsletter provider has your address
Sign-ups are double opt-in and passed straight to our newsletter provider. This site never stores your address. Every email has a one-click unsubscribe, and emails carry no tracking pixels.
Links to podcast apps
Links to Apple Podcasts, Spotify, YouTube, and others take you to those services, whose own policies apply. Some episodes offer a video version: nothing loads from YouTube until you press “Load video”, and it then plays from youtube-nocookie.com under YouTube’s privacy policy. No other third-party players or scripts are embedded.
Service providers that process this data for us: Netlify (hosting and the form endpoints), Cloudflare (Turnstile bot checks), Supabase (our private database for contact messages and anonymous event counts), and our email and newsletter providers. Questions or requests about your data, including deletion: hello@electriclaserlimousine.com.
Responsible disclosure
Found a security issue?
How to report
Email security@electriclaserlimousine.com with what you found, how to reproduce it, and its impact. We aim to acknowledge reports within 3 business days.
Safe harbor
We won’t pursue legal action against good-faith research that follows this policy, avoids privacy violations and service disruption, and gives us reasonable time to fix issues before disclosure.
In scope
- This website and its form endpoints
- Its HTTP security headers and TLS configuration
Out of scope
- Denial-of-service or volumetric testing
- The podcast host, podcast apps, and social accounts (report to them directly)
- Social engineering of the host or guests
We’re a small independent show, so we can’t pay bug bounties, but we’re happy to credit you. security.txt expires 2027-09-28 and is renewed yearly.
Transparency
Security headers
Every response carries these headers. They’re checked in CI on every change, so none can silently drop.
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
| X-Content-Type-Options | nosniff |
| Referrer-Policy | strict-origin-when-cross-origin |
| Permissions-Policy | camera=(), microphone=(), geolocation=(), interest-cohort=(), browsing-topics=(), payment=(), usb=() |
| Cross-Origin-Opener-Policy | same-origin |
| Cross-Origin-Resource-Policy | same-origin |
| X-Frame-Options | DENY |
| Content-Security-Policy | default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self'; img-src 'self' data:; font-src 'self'; media-src https://media.example-podcast-host.com; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'; manifest-src 'self'; upgrade-insecure-requests |