What this site collects.

Last updated: 2026-10-20

Who we are

This site is operated by Mission First Cyber, LLC. In this notice, "we" and "us" mean Mission First Cyber, LLC.

Site analytics

We measure how the site is used so we can improve it and understand which organizations are interested in which capabilities. Our own analytics code, which runs on our hosting provider (Cloudflare) rather than on an advertising or analytics vendor, records: the pages you view and their full address, including any tags in the link; the site that referred you; your browser window width; how far you scroll; how long a page is visible; which links and buttons you select and their text; which frequently asked questions you open; how far you read through the day-by-day story; whether you use the console demo's air-gap switch or the theme and motion toggles; whether you start or send the briefing form, including the operating environment you selected; which share buttons you use; the capabilities and products you pick in the mission builder; your readiness check score and tier, but not your individual answers; and when you open the quick-search menu and which page you go to from it, but not what you type.

Each record includes the network your connection comes from, not your IP address: we keep only the network block (the first three parts of an IPv4 address, or the first three groups of an IPv6 address), the organization that owns the network as reported by Cloudflare, your country and region, your browser's user-agent string, and whether that user agent looks like an automated crawler. We don't record your city. A random identifier kept in your browser's session storage groups the records from one visit. It is not a cookie, and your browser normally clears it when you close the tab.

When you download a use-case briefing or the overview PDF, we record which document, the time, and the same network, organization, region, user-agent, referring page and campaign details. This happens even if JavaScript is off.

Analytics and download records are kept for about three months and then deleted automatically. We don't sell this information or share it with advertisers, and we don't use it to build profiles of individuals.

Your privacy choices

If your browser sends a Global Privacy Control or Do Not Track signal, our analytics code doesn't run and our servers ignore any analytics events. Briefing downloads are still counted so we know how often each document is used, but only with the document, the time and your country. Security logs (see Security and hosting) are kept either way.

Briefing requests

When you submit the contact form we receive the details you enter (inquiry type, name, work email, organization, role, operating environment, timeline and message). We use them only to respond to you, arrange a briefing and screen out spam. We don't add you to a mailing list or send you marketing email. Please keep requests unclassified and do not include CUI or operationally sensitive information.

Submission checks

To tell genuine requests from automated spam, the form also sends a few technical signals with your request: how long the form took to fill in; counts of keystrokes, pastes, browser autofill events and pointer clicks; whether your browser reports that it is being controlled by automation software; whether the form was sent with JavaScript; and the page you sent it from. These are counts and timings only. We never record which keys you press or what you type, apart from the answers you submit. The form also has a hidden field that people don't see; anything entered there marks the request for review.

The form also uses Cloudflare Turnstile, a bot check that runs in your browser on the contact page. Most visitors never see it; it shows a check box only when Cloudflare can't tell that a person is using the page. To decide, Cloudflare receives your IP address and information about your browser and device, under its Turnstile privacy terms, and gives the form a one-time pass that we verify with Cloudflare when you send it. Turnstile doesn't set cookies on this site and isn't used for advertising.

None of these checks stops a request from reaching us. Requests that fail them are marked for review, and requests that are clearly automated, or that come from networks we have seen sending only spam, are kept in our intake system without notifying the team.

With each request we also record your browser's user-agent string and the approximate country and network (for example, your internet provider) that our hosting provider reports. The stored request does not include your IP address; our short-lived security logs do (see Security and hosting).

If your browser cannot reach our intake service, the form opens your email app with the request filled in instead. That email includes a short reference code for our spam checks.

Security and hosting

The site is hosted on Cloudflare. Like any web host, Cloudflare processes your IP address and request details to deliver pages and protect the site from attacks, under its own privacy policy. To investigate abuse, such as attacks on the site or spam sent through the form, our own server logs record full IP addresses with analytics events, downloads and briefing requests. These logs are kept for no more than seven days and are used only for security.

How long we keep it

• Site analytics and download records: about three months, then deleted automatically.
• Security logs with full IP addresses: up to seven days.
• Briefing requests and their submission checks in our intake system: up to 180 days.
• The notification email to our team, and requests we act on: kept in email and our customer records while we are in contact with you, and deleted within two years of our last contact unless a contract requires longer.

Service providers

We use Cloudflare to host the site, run our analytics and intake service and the Turnstile bot check, keep security logs and route email sent to our addresses, including the email that notifies our team of each new briefing request. Email reaches our corporate email system, which filters it for spam and malware. These providers process this information on our behalf, under their data processing terms.

In your browser

Your theme (light or dark) and animation preferences are saved in your browser's local storage so they persist between visits. The preferences themselves are not sent to us, but pressing the theme or animation toggle is counted in our site analytics like any other button. The random visit identifier described under Site analytics is kept in your browser's session storage. This site sets no cookies of its own. Cloudflare may set a strictly necessary security cookie if it needs to check that traffic is not automated.

Your questions and requests

To ask what we hold about you, to correct it or to have it deleted, send us a privacy request. We respond within 30 days. We can delete briefing requests and customer records. Site analytics and download records don't contain your IP address or name, so we can't reliably link them to you; they are deleted automatically after about three months.