Privacy Policy

Last updated October 29, 2026

BurnGuard ("we", "us") provides a signup-abuse detection API. This policy explains what we collect and why. Questions: hello@northlogic.co.

Two kinds of data

1. Our customers' account data. When you create a BurnGuard account we store your email, a hashed password, your projects, settings and billing status. Payments are handled by Stripe; we never see full card numbers. We use this data to run your account, send transactional emails (verification, password reset, quota warnings) and provide support. Legal basis: performance of a contract.

2. Data our customers send us about their end users. When a customer calls /v1/check, they send us an email address, IP address, an opaque device token and optionally a user agent and their own user id. We process this on our customer's behalf (we are the processor, they are the controller) and only to detect fraud and abuse in that customer's project. We don't sell it, don't use it for advertising, and don't share it across customers. Legal basis for the customer: legitimate interest in preventing fraud (GDPR Recital 47).

Device token

Our browser snippet hashes a few stable browser properties and a random first-party id into an opaque token. We never receive the raw properties. The snippet sets no cookies and does no cross-site tracking.

Retention

• Raw check records (email, IP, device token) are kept for the customer's plan history window: 7, 30 or 90 days. Then they are deleted.
• Aggregated daily totals without personal data are kept so dashboards keep working.
• Account data is kept while your account is open and deleted within 30 days of closing it, except what we must keep for tax and accounting.

Free tools

The free tools on this website (disposable email checker, signup risk test, alias checker, calculator) don't store the emails or IP addresses you enter. We keep short-lived, in-memory rate-limit counters keyed by a hash of your IP.

Website analytics

If enabled, we use Plausible Analytics, which doesn't use cookies. We don't run advertising trackers.

Subprocessors

Hosting provider (servers and database), Stripe (payments), Resend (transactional email). We'll update this list before adding a new subprocessor.

Your rights

You can access, correct, export or delete your account data at any time by emailing hello@northlogic.co. If you are an end user of one of our customers, contact that customer first; we'll help them answer your request.

Security

Passwords are hashed with scrypt, API secret keys are stored only as hashes, all traffic is encrypted in transit, and access to production data is restricted.

Changes

We'll post changes here and update the date above. Material changes are emailed to customers.