Privacy Policy — Blue Sail Technologies

Who we are

This website and its membership are run by Blue Sail Technologies, based in New York. For any privacy question or request, use our contact page.

What we collect

Your account: your email address. Administrator accounts also have a username.
Your password, as a hash only: we store a one-way argon2id hash of your password, never the password itself, and we can't read it.
Sign-in sessions: a record of each signed-in session with a short description of the device and browser, so we can keep you signed in and sign you out everywhere when you ask.
Security data: for accounts, a pseudonymous key derived from your network address (we don't store the address itself) and your country, used to protect accounts and to limit repeated attempts.
Membership and billing: your plan, its status and dates, amounts, and the customer and subscription references from our payment processor, Stripe.
Consent records: when you accept the Terms or the automatic renewal terms, we record which text and version you agreed to (with a fingerprint of the exact wording), the time, the pseudonymous network key and a short device description.
Account emails: a record of the account and billing emails we send you and when they were sent. Because we send them from our own email account, that account also keeps a copy of each one.
Contact messages: what you send through the contact form (your name, email address, company if you give one, and your message), together with your network address, approximate country and browser description, which we use to stop abuse of the form. Each message reaches us as an email, and our server log notes the network address of each message.

What we don't collect

Card numbers: Stripe collects and holds your payment details. We never see or store your full card number.
We don't use advertising or analytics cookies, and we don't show ads.

How we use it

To provide your membership: your account, sign-in and the member pages.
To bill you, and to keep the billing and tax records the law requires.
To keep the website and accounts secure: sign-in protection, limits on repeated attempts and abuse prevention.
To send the emails your account needs: sign-up and password links, membership confirmations and notices.
To keep legal records, including proof of what you agreed to and when.
To answer the messages you send us.

Who processes it for us

We use a small number of providers, only to run this service:

Stripe, for payments and subscription billing. Stripe processes your payment details under its own privacy policy.
Google, for email delivery: our account and contact emails are sent through Gmail.
Our content delivery and security provider, which carries traffic to this website and protects it from attacks. Like any website, it processes your network address to deliver pages.
Our own servers in New York, which store the account database.

Cookies

We set two cookies, both strictly necessary, and only after you sign in:

__Host-bs_sess keeps you signed in. Your browser's scripts can't read it. It lasts up to 30 days.
__Host-bs_hint tells the menu to show "Members" or "Account" instead of "Sign in / Sign up". It holds no personal information and lasts up to 30 days.

Stripe sets its own cookies on its own checkout and billing pages. Because we use no other cookies, there is no cookie banner.

How long we keep it

Sign-in sessions: at most 30 days. A session's record is deleted within an hour after it ends or you sign out.
Sign-up and password reset links: they work once, for 24 hours and 1 hour. Each is deleted within an hour after it is used or expires.
Records of the emails we send: 30 days in our database. The copies in our email account stay until we delete them.
Security logs and billing event records: 400 days.
Database backups: 30 days, then deleted. If backups ever stop, the newest few are kept until new ones replace them.
Account, billing and consent records: while your account exists, and afterwards for as long as tax and other laws require.
Contact messages, with the network address, country and browser description they carry: as long as we need them to handle your request. Server log lines are removed as the logs rotate.

Your choices

You can ask us, through our contact page, to show you, correct or delete the personal information we hold about you. To change the email address on your account, contact us the same way.
We delete an account by anonymizing it: your email address and sign-in details are removed from our database, and only the billing and consent records that the law requires us to keep are retained. Backups that still hold them are deleted within 30 days. Copies of emails we sent you stay in our email account until we delete them.
Cancelling a membership does not delete your account. You can change your password at any time from Account.

We don't sell your information

We don't sell your personal information, and we don't share it with anyone for advertising.

Security

Passwords are stored only as argon2id hashes. Every connection to this website is encrypted. Member pages are checked against your sign-in on our servers on every request. If a security breach affects your personal information, we will notify you as the New York SHIELD Act and other applicable laws require.

Children

This website is not directed to children under 13, and we don't knowingly collect their personal information. You must be 18 or older to buy a membership.

Search engines and AI crawlers

Member pages are only served after sign-in, never to crawlers, and our robots.txt asks every crawler, including AI crawlers, to stay out of them.

Changes to this policy

When we change this policy, we update the date at the top of this page, and we email members about material changes before they take effect.