Privacy

This page describes what the site actually does. It is short because the site does very little.

Metatron Mind is the trading name of Clifton Morris, an individual, of PO Box 73, New Plymouth, Idaho 83655, United States. Clifton Morris is the data controller for this site. Contact: [email protected].

What is stored about you

If you create an account:

• your email address and a password hash (scrypt, salted; the password itself is never stored and cannot be recovered);
• your Stripe customer id and, if you are a member, the subscription record that Stripe returns: status, plan, period end, cancellation flag. No card details are ever received or stored by this server; Stripe’s hosted Checkout handles them on Stripe’s domain;
• timestamps: when the account was created, when it last changed;
• audit records of account and admin actions (sign-in, membership changes). These record the account id, not the email address.

Cookies

Two, both HttpOnly, Secure, SameSite=Lax, and neither is a tracking cookie:

• __Host-st_session — keeps a member signed in. A random session token signed by the server.
• __Host-st_admin — only exists for the operator’s desk.

There are no analytics cookies, no advertising cookies, no third-party cookies set by this site. Stripe’s Checkout page sets its own cookies on stripe.com while you pay; those are covered by Stripe’s privacy notice.

Logs

The server writes short-lived operational logs: request method, path, status, duration and the client IP address, plus security events (rate limiting, failed sign-ins, webhook rejections). They exist to keep the site up and to detect abuse. They are not used to build profiles, not sold, and are rotated away by the host’s journal.

Cloudflare sits in front of the site as a proxy and sees requests; Stripe processes payments. Those are the only third parties involved, and neither is used for advertising or tracking.

What is not collected

No name, no address, no phone number, no location, no device fingerprint, no behavioural analytics, no heatmaps, no A/B tests, no third-party scripts, no fonts or images loaded from another domain. The pages are plain HTML, CSS and self-hosted fonts.

Who processes data

• Stripe — payments, subscriptions, receipts. Stripe is the payment processor and a data controller for payment data.
• Cloudflare — DNS and the reverse proxy in front of the site.
• The hosting provider — the virtual server that runs the application and the database.

These are US-based providers. The site is operated from the United States.

Retention

Account data is kept while the account exists. If you ask for your account to be deleted, the account, its grants and its subscription records are removed, except records that must be kept for tax, accounting, or fraud-prevention purposes (payment records are held by Stripe under their own retention).

Your choices

• Access: your email address, membership status and renewal date are shown on your account page.
• Deletion: reply to any Stripe receipt and ask for the account to be deleted. You will get a confirmation when it is done.
• Correction: reply to the same address if anything is wrong.
• No tracking means no opt-out needed; there is nothing to opt out of.

Children

The site is not directed at children under 16, and memberships are not knowingly accepted from them.

Changes

If what is stored or who processes it changes, this page is updated and the date at the top changes. Material changes are announced to members before they take effect.