Privacy

In one line: verdict lookups are fully anonymous and need no account. We only touch your data when you deliberately sign up, save, or buy — and then only what delivery requires. Every category is spelled out below.

1. What we collect

• Browsing verdicts: the only input is the item and destination in the URL. No identity is attached, and no email, account, or form is required.
• Account (optional): if you register we store your email and password. The password is kept only as a one-way bcrypt hash — never in plaintext.
• Session: an HttpOnly cookie sits in your browser. The server stores only a hash of the token, never the token itself; it lasts 30 days and is revoked on logout.
• Login security audit: every sign-in attempt, successful or not, records email, IP address, user-agent, and timestamp. This is part of brute-force protection (repeated failures temporarily lock the account) and is used for nothing else.
• Favorites & history: combinations you save, and ones you visit while logged in, exist only to power your account page so you can re-check their current status.
• Payment: transactions are handled by a third-party processor; we never see or store card numbers. A purchase keeps only the minimum needed for delivery: your email and the order contents.
• SMS alerts (optional, off by default): used only for lock notifications, and only if you supply a phone number and enable them.

2. What we don't do

We never sell or rent your personal data, never resell it, and run no third-party advertising or behavioral-tracking scripts. Beyond the functional data listed above, we have no other channel into your information.

3. Cookies

The site uses a single strictly-necessary session cookie (your login state). There are no advertising or cross-site tracking cookies. Your theme preference is kept in your browser's localStorage and is never uploaded.

4. How long we keep it

Session cookie & token: expire after 30 days, or are revoked the moment you log out. Favorites & history: kept until you delete an entry or close the account. Login audit: kept for a limited security window. Email: kept until the account is closed.

5. Your rights

From your account page you can view and delete favorites and history. You may also request an export of the data tied to your account, correct inaccuracies, or close the account and have its personal data erased. To exercise any of these, use the contact pageor write to us directly.

6. Security

Passwords are hashed, session tokens are stored only as hashes, repeated failures lock the account, and the whole site runs over HTTPS. No system is ever perfectly secure, so we minimize at the source: we don't collect what delivery doesn't require.

7. Processing & transfers

Account data lives in a cloud-hosted relational database. The site serves users in New Zealand, Australia, and Japan, so data may be processed across those jurisdictions. If your region has data-residency requirements, email us and we'll explain what's feasible.

8. Children

The site is not directed at anyone under 16 and we do not knowingly collect their personal data.

9. Changes

Changes take effect by updating this page and the date below; for material changes we additionally email registered users who have notifications enabled.

Last updated: 2026-11-05 · Contact: borderprep@outlook.com