Transparency
How This Site Works
A privacy site should show its own work. This page lists every third-party service that The Unhacked’s public pages load, what it is for, and what it can see. It is a snapshot taken on 6 October 2026, not a promise that nothing will ever change — when it changes, this page changes.
What loads, and why
| Service | Purpose | What it can see |
|---|---|---|
| Fonts (Space Grotesk, JetBrains Mono, Lora, served from theunhacked.com; SIL Open Font License) | Typography | Nothing beyond the normal request to our own server; no request goes to Google |
| First-party (theunhacked.com, vetted.theunhacked.com, mail.theunhacked.com, stats.theunhacked.com analytics) | Our own traffic counts | Page views, served from our own subdomain |
| Affiliate link services: VigLink (cdn.viglink.com, api.viglink.com) and Sovrn Commerce (commerce-js.sovrn.co, comparisons.sovrn.com); our affiliate-links plugin is also installed and configured to call api.autoaffiliatelinks.com, which our scan did not observe | Tag outbound links so we earn a commission when you buy; this is how the site is funded. The VigLink loader is not loaded on the home page, on our ordinary WordPress pages (such as Start Here, Toolkit and the Signal page) or on five non-commercial guides. It is still loaded on review and article pages, on category and archive pages, and on pages we generate ourselves, including this one, the Wiki, How We Test and the Scorecards | Your IP address, browser details and the page you were on; these services can set cookies (our scan observed two third-party cookies set by one of them) |
| Pexels (images.pexels.com) | On some pages, images are served from Pexels | Your IP address when the image is fetched |
| Our mail server (mail.theunhacked.com) | Newsletter signup, only if you submit the form. It uses double opt-in: we email you a confirmation link, and you are not subscribed until you click it | The email address you type |
| Cloudflare (CDN and proxy in front of the whole site) | Delivers and protects the site | Every request to the site passes through it |
| Plain outbound links: Instagram, Telegram, and on articles X, Facebook, WhatsApp, Signal share links | Footer and share links; nothing is embedded | Nothing, until you click |
To limit abuse, the newsletter form first passes through a gate on our own server, which keeps a keyed (HMAC) hash of your IP address (for IPv6, of its first 64 bits) and of the email address you submit, plus a counter, in short-lived server records that stop being used after one hour; the raw IP address and email are not stored in them.
What does not leave your browser
The Sovereignty Pulse, Today’s Switch and the Passport streak keep their data in your browser’s local storage and do not send it to us. We do count, through our own analytics, how many people start the Pulse, finish it, or mark a switch done: a bare count, never your answers or scores. The rest of the page still loads the services above, so this is a statement about those features, not about the whole site.
The Subscription Sweep and 72-Hour Freeze Planner under /tools/ are stricter: they carry a browser-enforced policy that blocks background network requests from the page (it cannot stop you navigating away).
Recently removed
Removed 8 October 2026: Google Fonts. The three typefaces we use are now served from our own server, so your browser no longer contacts Google to display them.
Removed 7 October 2026: Cloudflare Web Analytics. Cloudflare’s measurement script is no longer added to our pages. Cloudflare still delivers and protects the site (see the table), which is separate from that script.
Removed 7 October 2026: Google Analytics. The Google tag that the Site Kit plugin added to our pages is no longer sent to your browser, so your visit is not reported to Google Analytics. The Site Kit plugin may still be installed in our admin. We still use Google Search Console: its ownership-verification tag stays in our page source, but it loads nothing and does not track visitors.
What we are doing about it
The services above are under review. Anything that does not earn its place will be removed or replaced, and this page will be updated with the date.
Spot something we missed?
Open your browser’s developer tools and look at the Network tab. If you find a request that is not listed here, tell us on the contact page and we will correct this page.
The scripts above can load further resources of their own (for example ad-network endpoints), which a page scan cannot enumerate; this table lists what the page itself asks for.
Snapshot: 6 October 2026, updated 8 October 2026 (Google tag and Cloudflare Web Analytics removed; fonts now served from our own server). Scan method: the HTML of the home page, Start Here and How We Test pages, plus a Lighthouse and browser network capture of the home page and one article.