Privacy Notice & Zero-PII Edge Telemetry Specification
At ColdEmailOutreach.org, we engineer our web properties with the same strict data hygiene we recommend for B2B outbound infrastructure. We operate a Zero-Cookie, Zero-PII static architecture hosted on Cloudflare Pages. We do not load Google Analytics, Meta Pixel, third-party ad networks, or cross-site behavioral fingerprinting scripts.
1. Data Processing & Edge Telemetry Audit Table (November 2026)
ColdEmailOutreach.org collects 0 personally identifiable information (PII) records, sets 0 browser tracking cookies, and processes 100% of aggregate pageview telemetry at the Cloudflare edge using irreversible 24-hour salted SHA-256 hashes.
| Data Category | Collection Status | Technical Handling & Retention | Legal Basis (GDPR Art. 6) |
|---|---|---|---|
| Browser Tracking Cookies | 0 Cookies Set | No `Set-Cookie` headers or `localStorage` tracking IDs are created | Exempt under ePrivacy Directive |
| Visitor IP Address | Never Stored Raw | Hashed at Cloudflare Edge via `SHA-256(UTC_Date + Domain + IP + UA)` truncated to 24 hex chars; raw IP discarded immediately | Art. 6(1)(f) Legitimate Interest (Anonymous traffic counting) |
| Calculator Slider Inputs | 100% Local Client-Side | Processed strictly in browser RAM (`assets/app.js`); 0 bytes sent to server | No server processing occurs |
| Outbound `/go/` Redirects | Aggregate Event Counter | Logs anonymous `reditus_redirect` or `cta_click` path + 2-letter ISO country code | Art. 6(1)(f) Legitimate Interest |
2. How Our Ephemeral SHA-256 Edge Hashing Works
When your browser loads a page on ColdEmailOutreach.org, our same-origin `/api/event` Cloudflare Pages Function computes a 24-character hexadecimal digest combining the current UTC calendar date (`YYYY-MM-DD`), site hostname, request IP, and User-Agent string in under 2 milliseconds.
Because the daily salt rotates automatically every 24 hours at `00:00:00 UTC` and the SHA-256 output is truncated to 96 bits (24 hex characters), it is mathematically impossible to reverse-engineer an IP address or track a visitor across different days or across external websites.
3. External Vendor Redirects (`/go/emaillistverify/`, `/go/warmupinbox/`, `/go/woodpecker/`)
When you click a `/go/` action button to inspect or purchase Layer 1 (EmailListVerify), Layer 2 (WarmupInbox), or Layer 3 (Woodpecker), your browser is redirected via HTTP 302 to that vendor's official domain.
Once you arrive on `emaillistverify.com`, `warmupinbox.com`, or `woodpecker.co`, any account registration, billing, or cookie placement is governed by that respective provider's privacy notice and GDPR Data Processing Addendum (DPA).
4. Security Headers, Content-Security-Policy (CSP) & Zero-XSS Guarantee
ColdEmailOutreach.org enforces 7 HTTP security headers—including Strict-Transport-Security (`max-age=63072000; includeSubDomains; preload`), `X-Frame-Options: DENY`, `X-Content-Type-Options: nosniff`, and a strict `Content-Security-Policy`—across 100% of static and edge routes.
In addition, our client-side calculator script (`/assets/app.js`) is engineered with zero unsafe HTML injection sinks and zero dynamic code execution calls, relying exclusively on DOM `textContent` updates and strict numeric range clamping (`Math.min`/`Math.max`) to eliminate Cross-Site Scripting (XSS) vectors. Our edge telemetry endpoint (`/api/event`) validates the request `Origin` and `Referer` against an explicit URL hostname allowlist (`coldemailoutreach.org`), rejects payloads larger than 2,048 bytes with HTTP 413, and never logs personal identifiers. Whether you are using our Interactive Stack Calculator or evaluating EmailListVerify, WarmupInbox, and Woodpecker, your browsing session remains private and isolated.
Honest Trade-Offs: Why We Use Cookieless Edge Telemetry Instead of Google Analytics
Engineering Rationale: Using cookieless daily-salted SHA-256 edge telemetry means we cannot measure 30-day multi-session user cohorts or run retargeting ads. We gladly accept that analytical limitation so our visitors enjoy instant page loads, zero annoying cookie-consent popups, and strict Content-Security-Policy (`CSP`) protection.
Frequently Asked Questions: Privacy & Security
1. Does ColdEmailOutreach.org store personal IP addresses or third-party tracking cookies?
ColdEmailOutreach.org sets 0 tracking cookies and stores 0 raw IP addresses; our Cloudflare Edge Function hashes visitor IP and User-Agent with a 24-hour rotating UTC date salt via SHA-256 truncation before discarding the raw IP.
2. Are inputs entered into the Cold Email Stack Calculator transmitted to any server?
100% of calculations inside our Stack Builder Calculator execute locally in your browser's JavaScript memory (`app.js`) with 0 network transmission of your monthly email volume or ACV inputs.
3. What happens when I click an outbound /go/ link to EmailListVerify, WarmupInbox, or Woodpecker?
Clicking a /go/ route logs an anonymous aggregate click counter at the edge and issues an HTTP 302 redirect to the vendor's official website, where that vendor's own privacy policy governs any subsequent account signup.