Northstar / Leviathan Platform

Privacy Policy

Last updated: 2026

This is a small, independently-run site. This policy describes exactly what happens to your information when you visit — nothing more, since nothing more is collected.

What this site does not do

• No analytics, no tracking scripts, no third-party cookies, no ad pixels, no fingerprinting. If you create an account (below), we set exactly one first-party cookie — it identifies your session and does nothing else.
• No IP logging beyond whatever your hosting provider (Cloudflare) retains at the CDN/edge layer for standard security and abuse prevention — we do not access or process it separately.
• No advertising, no ad networks, no data sold or shared with anyone.

The contact form

When you submit the inquiry form, the name, email address, role, and message you entered are sent to a Cloudflare Worker running on this domain, which forwards them to us as a single email. Nothing is stored in a database, and nothing is passed to any analytics or marketing service.

We use what you send to reply to you and to have whatever conversation follows. We don't add you to a mailing list, we don't share it with anyone outside this project, and we don't keep it beyond what's useful for that conversation. The form includes a hidden anti-spam field; if it's filled in (which only automated submissions do), the message is discarded and never delivered.

Your account

If you buy Bait-Mask, Agent Guardrails, or another Northstar product with self-serve checkout, an account is created automatically, tied to the email address you paid with — nothing more (no name, no address, no phone number). There is no password: logging in works by requesting a one-time link sent to that email, which is valid for 15 minutes and works once. We store only the SHA-256 hash of that link's token, never the token itself, so a database compromise alone could never be used to mint a valid login.

Once you log in, we set one cookie (ns_session) marked HttpOnly, Secure, and SameSite=Lax — meaning JavaScript on any page (including this one) can't read it, your browser only ever sends it to this site over HTTPS, and it can't be replayed cross-site. It identifies your logged-in session and does nothing else. It lasts 30 days, after which you'll need to request a new login link.

What we keep, and for how long:

• Login link tokens — deleted the moment you use them, or after 15 minutes, whichever comes first.
• Sessions — deleted 30 days after your last login, or immediately when you log out.
• Your account and purchase record (email, product, purchase date, and a Stripe checkout reference) — kept only for as long as your account exists, so we can issue or re-send your license. Deleted the moment you delete your account.
• Your license file — stored so you can re-download it if you lose it. Deleted along with your account.
• Support messages (a question or bug report you submit from your account) — the category, subject, and message you write, plus which account sent it. Kept only for as long as your account exists, so you can see your own submission history. Deleted along with your account.

The account page has a "Delete my account and data" button. It isn't a flag that hides your row from a report — it runs real deletes against every table your account touches (sessions, login tokens, purchase record, support messages) and removes your license file from storage, the moment you click it.

Nothing about this system requires or uses any tracking, browser fingerprinting, or third-party analytics — the login link goes to the one address on file, not wherever a request claims to come from, so it can't be used to figure out who else has an account here either.

Changes

If this policy changes in a way that matters, we'll update this page and the date above.

Questions

Use the contact page and ask — it reaches us directly.