Privacy

Our website has one box. It asks for your email address and nothing else. It never asks who you are.

What you type in the box goes straight to Buttondown, the company that holds our newsletter list. When you press the button, you see a page from Buttondown, not from us. That page may say "You've successfully subscribed". It says so before you have confirmed. You are not on the list until you confirm.

There are two ways to join.

The box. Type your email address into the box on our website. We cannot tell whose address is typed, so Buttondown sends one checking email to that address to check that it is yours. The email comes from a Buttondown address, phishfry@buttondown.email, not from an address of ours. It has a button, "Confirm subscription". You are on the list only after you press that button. If you did not ask for the email, you can delete it. We will not send the newsletter to that address unless the link in that email is opened.

By email. Email us from the address you want it sent to. We add each address by hand. On the list we keep your email address and the date you asked. If you used the box, Buttondown also records the internet address your connection was using when you signed up (a set of numbers, not your street address) and the date. If you joined by email, we also keep the email you sent us.

Buttondown also has its own public page for our newsletter, and anyone who finds it can type an address into it. We cannot tell whose address is typed there either. An address typed there gets the same one checking email, and nothing more, unless its owner presses the button.

Each issue comes from the same Buttondown address, phishfry@buttondown.email. It is a designed email, not plain text. It has a title bar with our small icon, and a few links that Buttondown adds:

• The title of the issue is a link to a page at Buttondown.
• A line near the top, "Did someone forward you this?", links to Buttondown's public page for our newsletter, where anyone can type an address.
• A link to manage your subscription. It opens a page at Buttondown made for one reader. Anyone who is sent a forwarded copy of your issue also has that link.
• A small "Powered by Buttondown" link and picture at the foot.
• The stop link, at the foot.
• One more link that you cannot see. It carries a number that belongs to you at Buttondown. Your mail program or a mail scanner may open it on its own, and Buttondown may record that. We do not yet know what it is for, or whether it can be switched off.

The issue also loads two small pictures from outside the email: our icon from our own website, and Buttondown's "Powered by" picture. Your mail program asks you before it shows pictures, or it shows them by itself, depending on how you set it up.

To stop, use the stop link at the foot of any issue.

You can also email us and say you want to stop. You do not need to give a reason. We deal with a stop the next time we check our mail, and never later than 10 business days after it arrives. We check for stops before we send each issue.

Replying to an issue is not a way to stop. A reply goes to a Buttondown address, and we cannot promise it reaches us.

If you ask us to delete your address, we delete it from our list. Buttondown then keeps a hidden record of the address. We cannot remove that record with a button.

We do not sell our list. We give it to no one except the company that sends our emails for us, and the companies it uses.

We do not knowingly collect anything from a child. Our box asks for no age, because an age typed in would prove nothing. If we learn that an address belongs to a child, we remove it from our list.

We keep your message and our reply, so that we can help you. Our email company may keep a copy it can recover for a short time of its own.

Your passwords, PINs, login or recovery codes, or security answers; a bank account or card number; a picture of a bank page; a Social Security number; a picture of an identity document.

If one of these reaches us by mistake, we delete it as soon as we see it and tell the sender. Our email company may keep a copy it can recover for a short time of its own.

What you send us by email is kept in our own business accounts. The company that provides our email and file storage holds it. Our newsletter list is not kept there. It is held by Buttondown, below.

Buttondown, LLC, a company based in Virginia, holds our newsletter list and sends each issue and each checking email, from its own address (phishfry@buttondown.email). It holds the sign-up details described above. It uses other companies to help run its service, for example to store data and to deliver email. It publishes a list of them. The company that delivers its email sees your email address. We have not been told which of the others can.

We use software tools to help draft our replies and issues. A person reads what you send us and approves every reply and every issue before it goes out.

We do not sell your information.

• The newsletter list: until you stop. Buttondown may keep your address afterwards, and we have not been told for how long.
• The sign-up details Buttondown records: as long as your address is on its list.
• The hidden record Buttondown keeps after we delete an address: until Buttondown deletes it for good.
• The email you sent to join, and your stop: for 90 days after you stop.
• Any other email you send us, and our reply: for 90 days after the last one.

After a time ends, we delete the record. The one exception is the hidden record described above.

You can ask to see what we hold about you. You can ask us to delete your address, and the emails you sent us about the newsletter, before the times above end. To ask, email us and say so. We deal with it the same way as a stop. If the law requires us to keep something, we tell you.

Write to us at the address on our Contact us page: phishfrysecurity.com/contact

We reply by email.

Last changed: October 20, 2026.