Privacy policy

Sign-in with Auth0

Parts of this site are access-controlled. To reach them you must sign in through Auth0 (an identity service we do not operate).

When you choose Sign in:

1. Your browser is sent to Auth0’s login page.
2. You authenticate with Auth0 (for example with email, password, or a social provider configured by the site operator).
3. Auth0 redirects you back to this site with authorization data we use to verify your identity and whether you may proceed.

While you are on Auth0’s pages, Auth0 may collect and process personal data and may use cookies or similar technologies on Auth0’s domain. That processing is governed by Auth0’s privacy policy, not this notice. We do not receive your Auth0 password.

Cookies on this site

We use essential cookies only for access control and sign-in security — not for advertising, analytics, or cross-site tracking. We do not use localStorage or sessionStorage for authentication.

• al_session — set after you sign in (including if you are authenticated but not yet granted access). Purpose: remember that you are signed in and whether you may proceed. Contents: a signed token with your Auth0 user ID (sub) and your email when Auth0 provides it in the login token. Duration: up to 7 days, or until you sign out. Attributes: HttpOnly (not readable by page scripts), Secure, SameSite=Lax, path /.
• al_oauth_state — set briefly when you start sign-in. Purpose: prevent cross-site request forgery during the Auth0 redirect. Duration: about 10 minutes; cleared when sign-in finishes or fails. Attributes: HttpOnly, Secure, SameSite=Lax.

Choosing Sign out clears our session cookie and sends you to Auth0 to end your login session there, then returns you to this site.

Account data we hold

Email addresses and user IDs. When you attempt to sign in, we receive your Auth0 user identifier (sub) and, if your Auth0 profile includes it, your email address. We store these in the al_session cookie described above. If you are not granted access and use Request access, we email the site operator your user ID and email (when available) so they can review your request. We use this information only to operate access control and respond to access requests — not for marketing or unrelated purposes.

We do not run on-page analytics on this site.

Data removal. To ask us to delete personal data we hold about you from sign-in, cookies, access requests, or related records, email privacy@cultpodcasts.com. Include enough detail for us to identify your request (for example the email address you used with Auth0).

Your rights and contact

For questions about this policy or to exercise rights relating to your personal data, contact privacy@cultpodcasts.com. Use the same address for data-removal requests (see Data removal above).

Source code

Site code, authentication, and privacy-related behaviour are published in the open repository cultpodcasts/apostate-leaks on GitHub.