Privacy Policy

This policy explains what personal data Code Agent Radar (“we”, “us”) collects when you visit codeagentradar.com or subscribe to our newsletter, why we collect it, and what choices you have. We try to collect as little as possible.

Who we are

Code Agent Radar is an independent publication about AI coding agents, operated by To be provided, To be provided. For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, the operator is the data controller for the processing described in this policy.

Privacy contact: privacy@codeagentradar.com

Summary

• We do not run advertising on this site today, and we do not sell personal data.
• We use two analytics tools: Cloudflare Web Analytics, and PostHog. Cloudflare Web Analytics does not use cookies or local storage. PostHog itself does not use cookies or local storage for analytics. The only local storage key this site writes is car_analytics_opt_out. It holds one consent or opt-out choice and nothing else.
• If you subscribe to the newsletter, we store your email address with our email provider, Resend, and use it only to send you the newsletter. You are only subscribed after you confirm by email.
• You can unsubscribe, ask for a copy of your data, or ask us to delete it at any time.

What we collect and why

Data	When	Purpose	Lawful basis (GDPR / UK GDPR)
Technical request data, such as IP address, browser type and requested URL	Every visit, processed by our hosting provider Cloudflare	Delivering the site, keeping it secure and preventing abuse	Legitimate interests (running a secure website)
Bot-check signals, such as IP address, TLS fingerprint and browser user agent	When you use the newsletter signup form, through Cloudflare Turnstile	Blocking automated and abusive signups	Legitimate interests (protecting the signup form)
Aggregated page-view and performance metrics	Every visit, through Cloudflare Web Analytics	Understanding which pages are read and how fast they load	Legitimate interests (improving the site)
Event data about how you use the site, such as the page URL, referrer, browser and device details, and an anonymous identifier that lasts only for the page view. This does not include your IP address	When PostHog is active: after you accept in the European Economic Area, in Switzerland, or when your region is unknown; by default in other regions, unless you opt out or your browser sends a Do Not Track signal. Events go first to a reverse proxy on our domain	Understanding how the site is used so that we can improve it	Consent in the EEA, in Switzerland, and when the region is unknown (GDPR Article 6(1)(a) in the EEA, and consent under applicable Swiss law). Legitimate interests in other regions (improving the site), with an opt-out at any time.
Email address, subscription status, and your consent record (signup time, signup page, policy version, confirmation time)	When you subscribe to the newsletter and confirm by email	Sending the newsletter you asked for, managing your subscription and keeping a record of your consent	Consent (you can withdraw it at any time by unsubscribing). Keeping the consent record: legitimate interests and legal obligations
Newsletter engagement data (opens and link clicks), only if we turn on tracking in Resend. Tracking is currently off	When you read the newsletter	Understanding which topics readers find useful and reporting aggregate results to sponsors	Legitimate interests (improving the newsletter), or consent where the law requires it. We will update this policy before turning tracking on
Your name, email address and message	When you email hello@codeagentradar.com, privacy@codeagentradar.com, corrections@codeagentradar.com or sponsor@codeagentradar.com	Replying to you and handling your request	Legitimate interests (responding to enquiries) or steps taken at your request before entering into a contract (sponsorship)

We do not ask for, and ask you not to send us, sensitive personal data.

Hosting and security: Cloudflare

This site is a static website hosted and delivered by Cloudflare, Inc. To deliver pages and protect the site from attacks and automated abuse, Cloudflare processes technical data such as your IP address. If Cloudflare security features are active, Cloudflare may set strictly necessary security cookies such as __cf_bm or cf_clearance. Cloudflare describes these cookies in its cookie documentation. See also the Cloudflare privacy policy.

Analytics: Cloudflare Web Analytics

We use Cloudflare Web Analytics to count page views and measure page performance. According to Cloudflare, Web Analytics “does not use any client-side state, such as cookies or localStorage, to collect usage metrics” and does not “fingerprint” individuals via their IP address, User Agent string or other data for the purpose of displaying analytics (Cloudflare Web Analytics). Cloudflare also states that Web Analytics does not collect or use the personal data of site visitors (Cloudflare documentation). We only see aggregated statistics. We cannot identify individual visitors from them.

Analytics: PostHog

We also use PostHog to understand how the site is used.

• Processor. The processor is PostHog Inc., 2261 Market St., #4008, San Francisco, CA 94114, United States of America, as named in the PostHog privacy policy and in its published Data Processing Agreement text. For the event data we send to it, PostHog acts as our processor. We remain the controller. This policy does not claim that a countersigned DPA is already in place. How PostHog handles the data is described in those published terms.
• Purpose. We use PostHog only to measure how the site is used, so that we can improve it. We record the following events only: page views, page leave ($pageleave), an opt-in event when analytics is turned back on ($opt_in), outbound link clicks, filter and sort actions, clicks on terms, downloads, and newsletter subscription results (success or failure, not the email address).
• When the script loads. For visitors in the European Economic Area, in Switzerland, and when we cannot tell the region, we do not load PostHog until you accept on a consent bar. Accept and refuse are presented with equal prominence. Until you choose, the footer reads exactly: Analytics off until you choose. You can withdraw that choice at any time. In other regions, PostHog loads by default on the basis of legitimate interests, and we respect a Do Not Track signal from your browser. In every region, a free opt-out control is available at any time and does not depend on Do Not Track. The only local storage key is car_analytics_opt_out. It stores one value for that choice and nothing else. The key is strictly necessary to remember your choice. It is not used to track you.
• How requests are sent. When PostHog is active, the script runs in your browser. Events are sent first to a path on our own domain, codeagentradar.com/ingest, which is a reverse proxy on Cloudflare. Cloudflare then forwards the request to PostHog US Cloud. Because the request goes through Cloudflare first, Cloudflare sees the technical request data, including your IP address. Our reverse proxy does not forward your IP address to PostHog. It does not send X-Forwarded-For or CF-Connecting-IP. PostHog therefore sees only the address of our proxy, not your IP address. Each event is sent with $geoip_disable, so PostHog does not infer a location from the request. PostHog states that, for US Cloud, customer user data is stored and processed in the United States (PostHog privacy policy).
• No analytics cookies, and no analytics use of local storage. PostHog is configured with memory-only persistence. According to PostHog, this stores analytics state only in page memory for the duration of the page view (PostHog persistence documentation). We do not use cookies or local storage to persist a PostHog identifier. We do not build a lasting visitor profile. Anonymous events do not create a person profile, and we do not identify you to PostHog. An anonymous identifier exists only in page memory for that page view. It is not written to a cookie or to local storage, and it is not reused after a reload. We do not record sessions (session replay is off). We do not use autocapture. We do not collect form contents or email addresses through PostHog. The only local storage key this site writes is car_analytics_opt_out, and it holds nothing except the consent or opt-out choice described above.
• Data that PostHog may receive or store. When PostHog is active, it may receive event properties such as the current URL, path and host; the referrer URL and referring domain; browser, operating system, device type and versions, derived from the user agent; screen and viewport size; and a timestamp (PostHog data storage documentation). It does not receive your IP address. Any IP address it sees is the address of our proxy server. Because each event includes $geoip_disable, PostHog does not infer a location.
• Lawful basis. For visitors in the EEA, the lawful basis is consent (GDPR Article 6(1)(a)), and loading the script only after you accept is how we meet Article 5(3) of the ePrivacy Directive. For visitors in Switzerland, we also load PostHog only after you accept, and we rely on consent under applicable Swiss law. When the region is unknown, we use the same consent rule and do not load PostHog until you accept. For visitors in other regions, the lawful basis is legitimate interests: measuring and improving the site (GDPR and UK GDPR Article 6(1)(f), where they apply). In every region you can opt out at any time with the free control described above, or email privacy@codeagentradar.com.
• International transfers. Because we use PostHog US Cloud, analytics data is transferred to the United States when PostHog is active. PostHog states in its published terms that it participates in the EU-U.S. Data Privacy Framework, the UK Extension to that framework, and the Swiss-U.S. Data Privacy Framework, and that its published Data Processing Agreement text incorporates the European Commission Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914 (module 2), with the UK International Data Transfer Addendum for the UK and the adaptations required for Switzerland (PostHog DPA, PostHog privacy policy). PostHog Inc. is listed as an active participant on the Data Privacy Framework register.
• Retention. We use the PostHog Free plan. PostHog retains events for 1 year on that plan. Expired events may not be deleted at once, because PostHog deletes in batches (PostHog events data retention). We do not create person profiles.
• Shared PostHog project. The same operator also sends events from Cozy Deck, an app made by the operator of this site, to the same PostHog project. Website events carry a site property that separates them from app events. The website never calls PostHog identify and does not store any long-term identifier, so we do not link website visits to Cozy Deck app users.
• Sub-processors. PostHog uses sub-processors that depend on the data centre location chosen for the project. The current list is at posthog.com/subprocessors.

Newsletter: how signup works

Our newsletter is a weekly automated digest. Signup works like this:

1. You submit your email address in a form on codeagentradar.com and tick a box to agree to receive the newsletter. The form uses Cloudflare Turnstile to check that the signup comes from a person and not a bot (see below).
2. Our Cloudflare Worker receives it. A Cloudflare Worker is a small program that runs on the Cloudflare network. It receives your email address together with the technical data that comes with any web request, such as your IP address and browser type. It passes your email address to Resend and does not keep its own copy of your email address. The Worker does not use a database or key-value storage for signups. To limit abuse, it counts signup attempts in 60-second windows using a Cloudflare rate-limiting counter. The counter is keyed by a keyed hash (HMAC-SHA256) of your IP address, not by the IP address itself. Our Worker logs replace anything that looks like an email address with a placeholder, and the Worker does not log the content of your form submission.
3. Resend stores you as a pending contact. The Worker adds your email address to our contact list in Resend, marked as not yet subscribed.
4. You confirm (double opt-in). We send you one confirmation email. The confirmation link points to codeagentradar.com and carries your email address only in encrypted form. It expires after 48 hours. We do not use Resend link tracking for it. You are only added to the newsletter after you click the confirmation link. If you do not confirm, we do not send you the newsletter, and we delete the pending contact after 7 days.
5. We keep a record of your consent. We record the date and time of your signup, the page on which you signed up, the version of this privacy policy that applied at the time, and the date and time of your confirmation, so that we can show that you agreed to receive the newsletter. That record is stored as custom properties on your contact in Resend, not in a database of our own.

Unsubscribing. Every newsletter contains an unsubscribe link. Using it marks you as unsubscribed in our Resend contact list, and Resend then stops sending the newsletter to you. You can also email privacy@codeagentradar.com. If you ask us to delete your data, we remove your contact from Resend. We may keep a minimal record that you unsubscribed so that we do not email you again.

Our processors for the newsletter

Resend

We send the newsletter, and the confirmation email, through Resend (Plus Five Five, Inc.), a company based in the United States.

• Role. For the subscriber data we send to it, Resend acts as our processor within the meaning of Article 28 of the GDPR, under its Data Processing Addendum, which applies to every Resend account from signup. We remain the controller. For California law purposes, Resend states that it is a service provider and does not sell the personal information it receives from customers. Resend states that it is an independent controller only for its own account, billing and usage data (Resend GDPR page).
• Where data is stored. Resend states that it stores customer data in the United States, including message content, delivery logs and account records. The sending region we choose controls only where emails are sent from, not where data is stored (Resend GDPR page, Resend regions).
• Retention at Resend. Resend states that, while an account is active, email and log data is kept for 30 days on its standard plans (Resend GDPR page). Your contact record stays in our list until you unsubscribe and ask for deletion, or until we delete it.
• Sub-processors. Resend uses sub-processors for hosting and sending (Amazon Web Services), databases, monitoring, support, payments and other services, all listed as located in the United States. The current list is at resend.com/legal/subprocessors.
• Transfers. Resend states that transfers to the United States are covered by the EU Standard Contractual Clauses in its DPA (with the UK Addendum for the UK and modifications for Switzerland), and by its participation in the EU-U.S. Data Privacy Framework, including the UK Extension (Resend GDPR page).
• Sending domain. We send the newsletter and the confirmation email through Resend, from the domain mail.codeagentradar.com.
• Open and click tracking. Resend offers open tracking and click tracking as a per-domain setting. Both are disabled by default (Resend tracking documentation). We currently keep both turned off. If we turn either one on, we will update this policy first.
• More information. See the Resend privacy policy.

Cloudflare (Worker)

Cloudflare, Inc. runs the Worker that receives your signup and acts as our processor for that step. Cloudflare may keep request logs for the Worker for a short period, up to 7 days, for troubleshooting (Workers Logs).

Cloudflare Turnstile

The signup form uses Cloudflare Turnstile to block automated signups. Turnstile processes signals such as your IP address, TLS fingerprint and browser user agent. Our Worker sends the Turnstile token and your IP address to Cloudflare to verify the check. Cloudflare acts as our processor when it uses these signals to protect our form, and as an independent controller when it uses them to improve its bot detection. See the Cloudflare Turnstile Privacy Addendum.

Incoming email

If you write to privacy@codeagentradar.com, hello@codeagentradar.com, corrections@codeagentradar.com or sponsor@codeagentradar.com, Cloudflare Email Routing forwards the message to the Gmail inbox of the operator. Cloudflare and Google therefore process the message content and the sender address.

• Cloudflare Email Routing. Cloudflare states that Email Routing is “free and private by design” and that “Cloudflare will not store or access the emails routed to your inbox” (Cloudflare Email Routing documentation). The product page also states that the service stores and accesses no email content (Cloudflare Email Routing). We do not state a retention period for message content at Cloudflare, because the official pages we checked say the content is not stored.
• Google (Gmail). The forwarded message is delivered to the Gmail inbox of the operator. Google states that it collects “the content you create, upload, or receive from others when using our services,” including “email you write and receive” (Google Privacy Policy). Google also states that Gmail content is stored in its data centres and is used to provide the service, including features such as spam detection (How Gmail protects your privacy). We do not state a specific retention period for this inbox, because we did not find a single official figure that applies in all cases.

Cookies and similar technologies

Today, codeagentradar.com does not set advertising cookies or analytics cookies of its own. PostHog does not use cookies, and it does not use local storage to persist an analytics identifier. It keeps a temporary identifier only in page memory for the duration of the page view (see the PostHog section above). When the script is active, it does read technical information in your browser, such as the page URL and browser details, and sends it through our reverse proxy.

The only local storage key this site writes is car_analytics_opt_out. It holds one consent or opt-out choice and nothing else. The key is strictly necessary to honour your choice. It is not used to track you, and it is not sent to PostHog as an identifier.

The only cookies you may encounter are:

• strictly necessary security cookies set by Cloudflare (see above);
• cookies set by a merchant or affiliate network after you click an affiliate link (see below).

If we ever add cookies that are not strictly necessary, we will first extend the consent tool and update this policy.

Affiliate links

Some pages may contain affiliate links. We list the programmes we take part in on our Disclosure page. When you click an affiliate link, you leave our site. The merchant or its affiliate network (for example PartnerStack, Impact or CJ) may then set a cookie or use a tracking parameter so that a later purchase can be credited to us. That processing is carried out by the merchant or network under its own privacy policy. We receive commission reports from them. These reports do not include your payment details and usually do not identify you.

Advertising

There is no advertising on Code Agent Radar today.

If we enable Google AdSense in the future

If we decide to show ads through Google AdSense, we will do the following before any ad appears:

1. put a consent management platform in place that is certified by Google and integrated with the IAB Transparency and Consent Framework, so that visitors in the European Economic Area, the United Kingdom and Switzerland can give or refuse consent before advertising cookies are used;
2. update this policy, and the “Last updated” date above, to describe the change.

Once AdSense is active, the following will apply:

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
• Google uses advertising cookies so that it and its partners can serve ads to you based on your visits to this site and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of the use of cookies for personalised advertising by some third-party vendors at www.aboutads.info.
• If other ad networks or vendors serve ads on this site, we will name them here, link to their websites and explain how to opt out where they offer that option.

Who we share data with

We share personal data only with the service providers needed to run the site and the newsletter:

• Cloudflare, Inc. (hosting, security, analytics, the Worker that handles newsletter signups, the reverse proxy that forwards PostHog events, Turnstile bot checks, and Email Routing for incoming mail)
• PostHog Inc. (product analytics)
• Resend (Plus Five Five, Inc.) (newsletter and confirmation email delivery, and contact list storage) and its listed sub-processors
• Google LLC, which processes messages forwarded to the Gmail inbox of the operator (see Incoming email above)

We may also disclose data if the law requires it, or to protect our rights or the safety of others. We do not sell personal data, and we do not share it for cross-context behavioural advertising.

International transfers

Cloudflare, Resend, PostHog and Google are based in the United States, and our operator is based in To be provided. Your data may therefore be processed outside your country, including outside the EEA and the UK. Where the GDPR or the UK GDPR requires it, we rely on safeguards offered by our providers. For newsletter data, the Resend Data Processing Addendum incorporates the European Commission Standard Contractual Clauses, with the UK Addendum for transfers from the UK and modifications for transfers from Switzerland, and Resend also participates in the EU-U.S. Data Privacy Framework, including the UK Extension. For PostHog analytics data, we rely on the Standard Contractual Clauses and Data Privacy Framework participation described in the PostHog section above.

How long we keep data

• Emails and correction reports: up to 24 months after the conversation ends, unless we need them longer for a legal reason.
• Sponsorship correspondence and invoices: as long as tax and accounting law requires.
• Cloudflare request data: according to the retention settings of Cloudflare.
• Newsletter contact and consent records in Resend: while you are subscribed. After you unsubscribe, we keep a minimal record that you unsubscribed so that we do not email you again. If you ask us to delete your data, we delete your contact.
• Unconfirmed signups: deleted after 7 days.
• Email and delivery logs at Resend: 30 days, according to Resend.
• Cloudflare Worker logs: up to 7 days, according to Cloudflare.
• PostHog event data: 1 year, according to the PostHog Free plan. See the PostHog section above.

Your rights under the GDPR and the UK GDPR

If you are in the EEA or the UK, you have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data;
• have your data deleted;
• restrict or object to processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, without affecting earlier processing;
• complain to your local data protection authority. In the UK this is the ICO (ico.org.uk).

To exercise any of these rights, email privacy@codeagentradar.com. We will reply within one month. We may ask you to confirm your identity first.

California privacy rights

If you live in California, you can ask us to tell you what personal information we have collected about you, to delete it, or to correct it. We will not treat you differently for making such a request. We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not knowingly sell or share the personal information of consumers under 16. To make a request, email privacy@codeagentradar.com. If you use an authorised agent, we may need proof of authorisation. If we start advertising in future, we will update this section and, where the law requires it, add a “Do Not Sell or Share My Personal Information” link.

Children

Code Agent Radar is written for software developers and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact privacy@codeagentradar.com and we will delete it.

Security

We keep the data we collect to a minimum. We rely on providers that encrypt data in transit and that offer two-factor authentication on our accounts. No method of transmission or storage is completely secure.

Changes to this policy

When this policy changes, we will update the date at the top of this page. If a change is significant, for example before we enable advertising, we will also mention it in the newsletter.

Contact

To be provided To be provided Email: privacy@codeagentradar.com