Privacy Policy

Effective date: [EFFECTIVE DATE] · Data controller / operator: Browns Assorted Merchandise, 211 S 13th St Apt 10, Las Vegas, NV 89101-5336 · Contact: [CONTACT EMAIL]

1. What this Service is

SelfScope — Self-Audit Lab for Security Professionals — is a web-based self-audit lab: a real browser fingerprint self-audit, connection and proxy health checks for endpoints you supply, a synthetic persona lab, and local security utilities, with audit logging, 2FA, and API keys. Simulation/training elements remain labelled as such. This policy describes what personal data the Service (as built and shipped in this project) processes, why, and who it is shared with. It covers the web app only — not any third-party site you visit from it.

2. Data we collect

Account data. When you register or are seeded an account: your username, an optional email address, your role, account creation date and last-login time, and your password stored only as a salted hash (bcrypt) — never in plain text.

Session data. When you sign in: a login token record, its expiry, your IP address, and your browser user-agent string, stored with your session so logged-out tokens stop working.

Activity logs. Actions you take in the app (sign-ins, fingerprint audits saved, connection checks, persona and tool use, authorised port checks, billing events) are written to an audit log with a timestamp, the action, its details, and your IP address. Port checks are logged with the host, port, and your authorisation confirmation.

Self-audit data you create. Fingerprint self-audit reports you save (signals measured in your own browser), proxy endpoints you supply (stored encrypted at rest; credentials are never returned or written to logs), connection-check results, and synthetic personas you save are stored under your account so the features work. Passwords submitted to the password-strength tool are not stored or logged; API keys are stored only as hashes; your 2FA secret is stored so TOTP login can be verified.

Billing data. If you pay: your Stripe customer ID, your plan, your access status, the current billing period end, and subscription identifiers/status, kept in our database so the paywall knows you have paid. Your full card number is collected and processed by Stripe, not by this Service — card details entered on Stripe Checkout are handled by Stripe under Stripe's own privacy policy. We do not receive or store full card numbers.

Browser storage. The app stores your login token in your browser's localStorage so you stay signed in. The shipped app does not set advertising or cross-site tracking cookies.

Server / hosting logs. The hosting provider and reverse proxy used to run the Service (see the operator's deployment) will typically record IP addresses, request times, and URLs for security and operations.

3. Why we process it

To create and secure your account and sessions; to run the self-audit, connection-check, persona, and utility features you request; to grant, renew, and revoke paid access in line with your subscription or lifetime purchase; to take payment via Stripe; to prevent abuse and enforce the Acceptable Use Policy; and to comply with legal, tax, and accounting obligations.

4. Who we share it with

Stripe, Inc. — payment processing, subscriptions, the customer portal, and fraud prevention, under Stripe's terms and privacy policy. Hosting / infrastructure providers used by Browns Assorted Merchandise to run the Service. Authorities, where disclosure is required by law or to establish, exercise, or defend legal claims. We do not sell your personal data as part of the shipped Service. [Operator: if you add analytics, email, support-desk, or any other processor before launch, list it here by name and purpose — or delete processors you do not use. Replace this bracketed note before charging customers.]

5. The honesty boundary

The self-audit tools measure only: the Service does not anonymise traffic, spoof fingerprints, scan targets, or collect traffic from third parties on your behalf. Labelled simulation elements use demo data. Synthetic personas are fictional lab data — do not enter real third-party personal data into the Service.

6. Retention

[Operator: complete this section before launch. State how long account data, activity logs, session records, and billing records are kept after cancellation / last activity, including any longer period required for tax or accounting records in the State of Nevada, and when backups are deleted. Suggested starting point to review with a lawyer: account and billing-access records while the account is active plus [RETENTION PERIOD] afterwards; activity logs for [RETENTION PERIOD]. Replace every bracket in this section before charging customers.]

7. Your rights and choices

Depending on where you live, you may have rights to access, correct, export, restrict, object to, or delete your personal data, and to withdraw consent where processing is based on consent. To exercise any of these, or to close your account, contact [CONTACT EMAIL]. We may need to verify your identity and may keep limited records we are legally required to retain (for example, payment / tax records held by Stripe and by us). You may also have the right to complain to your local data-protection authority.

8. Security

Passwords are hashed, login is rate-limited, and access to paid features is checked server-side. No system is completely secure; notify [CONTACT EMAIL] immediately if you believe your account has been compromised.

9. Children

The Service is a professional tool and is not directed at children. Do not register if you are below the age at which you can enter a contract for a paid service in your jurisdiction.

10. Changes and contact

We may update this policy; the version on this page with its effective date is current, and material changes will be notified to active account holders where practicable. Questions: [CONTACT EMAIL] · Browns Assorted Merchandise, 211 S 13th St Apt 10, Las Vegas, NV 89101-5336.