What happens to your address.

Eight newsletters, one email address, and for Blast Radius the dependency manifest you paste. This page says who holds it, who else it reaches, and how to make it stop.

Kodebeat (Fabio Cicerchia) is the controller. Write to info@kodebeat.com about anything on this page.

The short version

What is collected: Your email address. For Blast Radius, also the dependency manifest you paste, which is stored with your subscription and is the thing your advisories are matched against. If a signup link carried a referrer, that is stored too.
Why we may hold it: Consent, GDPR Art. 6(1)(a), given when you confirm the opt-in email. Nothing is sent before that confirmation.
Withdrawing it: The unsubscribe link in any issue, or an email to info@kodebeat.com. Withdrawal is for the future only; it does not make the issues already sent unsent.
How long: Until you unsubscribe. Unsubscribing removes you from the list. A record that a given subscription has already been sent a given advisory stays in our own database so the same advisory is not sent twice; ask and it goes too.
Your rights: Access, rectification, erasure, portability, restriction and objection, and a complaint to your data protection authority. The route to all of them is info@kodebeat.com.
What these pages do not do: No JavaScript, no cookies, no analytics, no tracking pixels, no advertising. Webfonts are served from this site rather than a third party, so loading a page tells nobody else that you did.
Changes: This page is in the repository that builds the newsletters; its history is the change log.

Who else sees it

api.osv.dev — the public vulnerability database. Each night a Blast Radius manifest's package names and versions are sent there to be matched against advisories. Your address is not.
leads.kodebeat.com — our own lead collector, shared across Kodebeat products. The signup form posts here, so it holds the list: your address, which newsletter, and for Blast Radius your pasted manifest.
Sentry — error reporting for the scheduled jobs. It is configured not to transmit the local variables of a failing program, which is what stops an address or a manifest travelling with a crash report.