Last updated: August 11, 2026
ThrillerList is a catalog of thriller novels, operated from the United States. This page explains what happens to data when you visit the site. The short version: we count visits, we do not know who you are, and we could not tell you apart from another reader even if we wanted to.
The short version
- There are no accounts, no logins, and no way to submit personal information to this site.
- Our analytics are cookieless and store no identifier for you (not in a cookie, not in local storage, not anywhere in your browser).
- We do not sell data, share it with advertisers, or run advertising or tracking pixels.
- We do not build profiles, and we cannot follow you to other websites.
- One functional cookie is set by the software that runs the site. It contains a random string and nothing else.
What we collect
Analytics
We use PostHog to count page views, so we can see which parts of the catalog people actually use. It runs in a deliberately restricted mode:
- Cookieless. Nothing is written to cookies, local storage, or session storage. Closing the tab leaves no trace on your device.
- No identifier. Returning visitors are estimated using a one-way hash that is computed on PostHog's servers and rebuilt from scratch every day. Your IP address and browser type are inputs to that hash; the hash cannot be reversed, and it is worthless the following day. In practice this means that if you visit on Monday and again on Wednesday, we count two unrelated strangers. That is a limitation we accepted on purpose.
- No session recording and no surveys. These are switched off, and are in fact unavailable in the mode we run. We cannot watch your mouse move, replay your visit, or read what you type.
- No automatic event capture. We record page views, and nothing else unless it is described on this page.
What that leaves us with is roughly: which page was viewed, when, what referred you to it, and the general category of device and browser. It is not attached to a name, an email address, or a persistent identifier.
Server logs
Like effectively every web server, ours records each request in an access log: the IP address that made it, the page requested, the time, and the browser's user-agent string. These logs are kept by our hosting provider for a limited period and rotated automatically. We use them only to diagnose faults and to investigate abuse, and we do not combine them with analytics data.
Cookies
One cookie is set when you load a page. It is named pw446s and it is placed by the content management software that runs this site, not by us or by anyone else. It holds a randomly generated session identifier and no information about you. It is marked Secure and HttpOnly, so it is only ever sent over an encrypted connection and cannot be read by scripts in the page. It is not used for analytics, advertising, or tracking of any kind, and it is not shared with anyone.
That is the complete list. We set no other cookies, and no third party sets cookies through this site.
If you email us
The address on our contact page is a normal mailbox. If you write to us, we receive your email address, your name if you give it, and whatever you choose to put in the message, and we keep it for as long as we need it to deal with what you wrote about. We do not add correspondents to any mailing list.
What we do not do
Stated explicitly, because these are the things people reasonably assume a website does:
- We do not sell, rent, or trade any data about you.
- We run no advertising, and there is no ad network, retargeting pixel, or social media tracker on any page.
- We do not attempt to identify you, and we hold nothing that could identify you.
- We do not use your data to train machine learning models.
- We embed nothing from third parties. Fonts are the ones already on your device; every cover image is served from this domain. Apart from the analytics request described above, loading a page on this site contacts no one but us.
Who processes data on our behalf
- PostHog — our analytics provider, as described above. We name it so that you can go read its documentation and check our description against it. Data is processed on PostHog's United States infrastructure.
- Our hosting provider — operates the servers that deliver these pages and hold the access logs.
- Our email provider — handles mail you send to our contact address.
Each of these acts on our instructions and publishes its own privacy documentation. We do not share information with anyone else.
Where data goes
The site and everyone who works on it are in the United States, and our analytics provider processes data there as well. If you are visiting from outside the US, information relating to your visit is therefore handled outside your country. Given that the data in question carries no identifier for you and cannot be tied to you across days, this is a small transfer in substance as well as in volume.
How long we keep things
- Analytics events are retained by PostHog under its standard retention schedule. They contain no identifier that can be traced back to you, so there is nothing in them to delete on request.
- Server logs are rotated and discarded by our host on its own schedule, typically within weeks.
- Email is kept as long as the conversation is useful, and deleted when it is not.
Your rights
Depending on where you live, privacy law may give you the right to know what personal information a website collects about you, to ask for a copy of it, to have it corrected or deleted, or to opt out of its sale. We do not sell personal information, and we never have. Visitors outside the United States may have further rights under their own country's law.
We deliberately store no identifier for you, so in almost every case we have no way to locate "your" data, because there is no key to look it up by. This is a consequence of collecting as little as possible. Where we genuinely do hold something connected to you, such as an email you sent us, write to us and we will act on it.
Do Not Track
Some browsers can send a "Do Not Track" or Global Privacy Control signal. We do not need to respond to those signals, because the behavior they ask us to stop is behavior we never had: we do not track visitors across websites, we do not build advertising profiles, and we do not sell personal information. There is nothing for the signal to switch off.
Children
This site is a book catalog intended for a general adult audience. It is not directed at children, and we do not knowingly collect information from anyone under 13.
Links to other sites
Where we link to another website, that site's own privacy policy governs what happens once you arrive. We have no control over, and take no responsibility for, how other sites handle your data.
Changes to this policy
If what we collect changes, this page changes with it, and the date at the top is updated. We keep that date honest: it moves when the substance moves, not when we fix a typo.