KESTREL-9 · PRIVACY POLICY

Privacy Policy

Last updated 2026-08-09 · operated by Primoris Partners LLC

Plain English first. We store your email, your password (hashed), and your course progress. That's it. We never see your card details — Stripe handles payment. We don't sell or share your data, and we don't run advertising or third-party trackers.

1. What we collect

Your email address — to identify your account and send account emails (password resets, purchase receipts).
Your password, hashed — stored using scrypt with a random per-account salt. We cannot read it and never see the original.
Your course progress — display name, XP, streaks, mission state, code you submit to exercises, and your ship's state.
Basic operational logs — including IP address, used to run the service, apply rate limits, and investigate abuse.

We do not collect payment card details — Stripe handles that entirely. We do not use advertising trackers or third-party analytics.

2. Why we use it

To provide your account and save your progress, to process your one-time purchase, to send essential account email, to secure the service against abuse, and to fix bugs. We do not sell, rent, or trade your personal data. We do not send marketing email unless you ask us to.

3. Code you write

Code you submit is stored with your account so your progress persists, and it is executed in an isolated sandbox. We may review submitted code only when investigating abuse or a support request you've raised. Don't paste secrets, passwords, or personal data into exercises.

4. Who else is involved

Stripe — payment processing. Stripe receives your email and payment details directly and acts under its own privacy policy.
Our hosting provider — runs the servers and database that store your account.
Our email provider — delivers account email such as password resets.

5. Cookies

We set exactly one cookie: a session cookie that keeps you signed in. It is httpOnly, SameSite=Lax, and Secure over HTTPS. There are no advertising or tracking cookies, so there's no consent banner to click through.

6. How long we keep it

We keep your account and progress until you delete them. Operational logs are retained for a short period for security and debugging. Purchase records are kept as long as required for tax and accounting.

7. Your choices

Hide from the leaderboard — a toggle in your Profile.
Export your data — the Stats page exports your progress as JSON.
Reset your progress — the Profile page's danger zone.
Delete your account — email support@kestrel9.com and we'll erase your account and personal data.
Access or correct your data — just ask.

8. Security

Passwords are hashed with scrypt. Session tokens are stored only as SHA-256 hashes, so a database leak cannot be replayed as a login. Traffic is served over HTTPS. Learner code runs in a locked-down sandbox, isolated from your data and other users'.

9. Children

The Service is not directed at children under 13, and we don't knowingly collect their data. If you believe a child has created an account, contact us and we'll remove it.

10. Changes and contact

If this policy changes materially we'll update the date above and notify signed-in users. Questions or requests: support@kestrel9.com.