Privacy Policy

This is a small, independently-run site. This policy describes exactly what happens to your information when you visit — nothing more, since nothing more is collected.

What this site does not do

• No third-party requests: fonts, scripts, and images are all served from this domain, so loading a page doesn't tell Google or anyone else that you visited.
• No analytics, no tracking scripts, no third-party cookies, no ad pixels, no fingerprinting. If you create an account (below), we set exactly one first-party cookie — it identifies your session and does nothing else.
• No IP logging beyond whatever your hosting provider (Cloudflare) retains at the CDN/edge layer for standard security and abuse prevention — we do not access or process it separately.
• No advertising, no ad networks, no data sold or shared with anyone.

The contact form

The quick form on the contact page doesn't send anything to us. It only prepares an email in your own mail app; nothing leaves your device until you press send there, and what arrives is an ordinary email in our inbox.

A few older pages still carry an inquiry form that sends your name, email address, role, and message to a Cloudflare Worker running on this domain, which forwards them to us as one email. Nothing from it is stored in a database or passed to any analytics or marketing service, and it has a hidden anti-spam field: if that's filled in (only automated submissions do), the message is discarded.

Either way, we use what you send to reply to you and to have whatever conversation follows. We don't add you to a mailing list, we don't share it with anyone outside this project, and we don't keep it beyond what's useful for that conversation.

Your account

If you buy Bait-Mask, Agent Guardrails, or another Northstar product with self-serve checkout, an account is created automatically, tied to the email address you paid with — nothing more (no name, no address, no phone number). There is no password: logging in works by requesting a one-time link sent to that email, which is valid for 15 minutes and works once. We store only the SHA-256 hash of that link's token, never the token itself, so a database compromise alone could never be used to mint a valid login.

Once you log in, we set one cookie (ns_session) marked HttpOnly, Secure, and SameSite=Lax — meaning JavaScript on any page (including this one) can't read it, your browser only ever sends it to this site over HTTPS, and it can't be replayed cross-site. It identifies your logged-in session and does nothing else. It lasts 30 days, after which you'll need to request a new login link.

What we keep, and for how long:

• Login link tokens — deleted the moment you use them, or after 15 minutes, whichever comes first.
• Sessions — deleted 30 days after your last login, or immediately when you log out.
• Your account and purchase record (email, product, purchase date, and a Stripe checkout reference) — kept only for as long as your account exists, so we can issue or re-send your license. Deleted the moment you delete your account.
• Your license file — stored so you can re-download it if you lose it. Deleted along with your account.
• Support messages (a question or bug report you submit from your account) — the category, subject, and message you write, plus which account sent it. Kept only for as long as your account exists, so you can see your own submission history. Deleted along with your account.

The account page has a "Delete my account and data" button. It isn't a flag that hides your row from a report — it runs real deletes against every table your account touches (sessions, login tokens, purchase record, support messages) and removes your license file from storage, the moment you click it.

Nothing about this system requires or uses any tracking, browser fingerprinting, or third-party analytics — the login link goes to the one address on file, not wherever a request claims to come from, so it can't be used to figure out who else has an account here either.

Changes

If this policy changes in a way that matters, we'll update this page and the date above.

Questions

Use the contact form and ask — it reaches us directly.

← Back to Leviathan Platform