Privacy

We keep only what we need to let you in, keep your account safe, and hear what you think of your site.

Updated October 22, 2026

This website

This website sets no cookies and runs no analytics or advertising scripts.

When you sign in

Only people we invite can sign in. We invite you by your email address, and we keep it so we know who you are.

• Emailed codes. We send your six-digit code through Resend, an email service. We keep the code only in a scrambled form, and it works for five minutes.
• Google. If you choose to sign in with Google, Google tells us your email address and your Google account ID. We use them only to confirm it’s you, and we store Google’s sign-in details encrypted.
• Passkeys. If you add a passkey, we keep its public key. Your face, fingerprint, or device PIN never leaves your device.
• Sessions. Each time you sign in, we record the session with your network (IP) address and your browser’s name. A session ends after 30 days without use, and after 90 days at most.
• Security log. We log sign-ins, failed attempts, and sign-outs to spot misuse. The log replaces your email and network addresses with scrambled codes, notes the country, and is deleted after 90 days.

When you review your site

Your notes, voice notes, page sign-offs, and approvals are saved with your email address so we know who said what. Voice notes are turned into text on our own computer, never by an outside service. We keep your feedback with your project, and we may use AI tools to help us organize it.

Cookies

Signing in sets a few cookies that only our sign-in and review pages can read: one that keeps you signed in (30 days, renewed while you use it), one that remembers this device so you can end its sign-ins and so we don’t keep offering a passkey (about a year), and a short one while Google checks it’s you (15 minutes). The review pages also remember small things in your browser, like whether you’ve seen the tour. None of them track you elsewhere.

Who helps us

• Cloudflare hosts our sign-in and review pages and stores their data.
• Resend delivers your sign-in codes.
• Google confirms who you are, only if you choose to sign in with Google.

We don’t sell your information or use it for advertising.

Your choices

Write to hello@bynorthlight.com to see what we hold about you, or to have it removed. We’ll end your access and delete your sign-in details and feedback.