Privacy
Last updated .
Who is responsible
This website, pitonsecurity.com, is operated under the Piton Security name. Questions about this policy go to contact@pitonsecurity.com.
What this site collects
This site serves prebuilt pages, optional AI-generated guides, and aggregate counters for optional questions. It has no accounts, no submitted contact forms, no comment system and no third-party analytics. It sets no cookies and loads no scripts, fonts or other resources from third parties.
What your browser remembers
The site adjusts to what you read: it puts the writing and services closest to your interests first, and remembers where you left off during the current session. To do that it keeps a small record in your browser's session storage for this tab: which pages you opened and how many times; for articles, how long you spent actively reading and how far you scrolled; the situations you chose to explore; and any answers you gave to the short questions on some pages. The record lasts for this tab’s browser session. Closing the tab ends that session, although a browser’s session-restore feature may restore it. Use “Clear what it knows” or “Turn this off” before sharing a device. Previously saved persistent reader records are removed when you visit a page with reader scripts. The full record stays in your browser; there is no account or server-side visitor profile. Ordinary page adjustments happen in your browser. The optional AI guides described below can use selected topic interests and answers when you choose to include them.
This browser-local feature is on by default unless your browser sends Global Privacy Control. GPC pauses new recording, inferred adjustments, and question reports. Items from the current session remain available to review or remove, and explicit starting-point links still work. It does not sell your reading record or send your page history or reading measurements to a provider. You can see the full record, remove any part of it, or turn the feature off from “Privacy preferences” at the bottom of every page. Turning it off clears the record and keeps it off in this browser. Only the off preference is saved persistently; answers and interests are not. Clearing your browser's site data also erases the record and resets the choice to on unless GPC is enabled.
The home-page chooser saves a deliberate starting point in this session and opens an AI guide for that situation. It also adjusts the home page’s explanations, featured engagement, example, and next step on your return. Shared starting-point links and question answers do not replace that saved starting point. Shared links work even when remembering is off.
AI-generated guides
Selecting a situation or an option in an AI guide sends its identifier and any follow-up priorities to Piton’s guide-writing service. The server combines the public wording for those choices with Piton’s published service information and sends that material through OpenRouter to the configured writer model. The model writes a new headline, explanation, practical sections and next question. It can offer narrower questions, a step back to a broader view, or a different perspective. Generated pages are labeled and are starting points for discussion, not assessments or agreed scopes.
The guide page offers a separate, initially unchecked option to include your top two topic-interest categories and up to four saved question answers from this visit. This sends only catalog identifiers, which the server maps to public wording. It does not send page history, URLs visited, timestamps, reading time or depth, contact details, scope briefs, security-snapshot answers, domains, or free text. With remembering off or Global Privacy Control enabled, this additional context is disabled; explicitly requested guides still work.
Guide requests are excluded from access logs. Generated pages and hashes of their choice combinations are cached in server memory for ten minutes, with no visitor identifiers or persistent visitor profile. Identical choices can reuse the same recent generated page. Request limiting keeps IP addresses in server memory for up to one minute. The service stores only total hourly and daily provider-call counts to enforce writing limits. Provider requests require zero-data-retention routing and disallow training/data-collection routes and silent provider fallback. These routing requirements do not replace review of the provider’s applicable terms. If writing fails, the page says so and links to authored guidance.
Optional questions and aggregate counts
Optional questions at article ends and on service pages report a question identifier and an event type: displayed, answered, dismissed, or scrolled past. An answer also includes the identifier of its option. Piton immediately combines these into cumulative counts; it does not store individual event records, visitor identifiers, paths, or event timestamps. The counts help maintain the question library. They measure interactions, not distinct visitors, and can be affected by automated traffic. They are not sent to AI providers. Counts are retained while the question remains in the library, including its archived versions.
Question reports are excluded from Nginx access logs. The server holds connecting IP addresses in memory for up to one minute to limit requests, to protect the count endpoint. Turning page adjustments off or sending Global Privacy Control stops reports. Clearing browser data removes local answers and dismissals but cannot identify or subtract contributions already combined into totals.
The question library is generated separately, using public site content, editorial rules, and hypothetical question branches. OpenRouter supplies the writer model and TypeSafe Jev screens drafts. Individual visitors' answers, records, and aggregate usage counts are not included in those model requests. Generated questions must pass validation and screening before publication.
Scope briefs and comparison tools
The deliverable viewer, engagement comparison, and scope-brief builder work in your browser. Draft fields are not saved to the reader profile or sent to Piton. Leaving or restoring the brief page clears its fields, preview and email body. Copying or downloading a brief exports it to your device, where it can remain after you leave the page. “Open email draft” passes the text you previewed to your email app; sending that email is your choice. A starting question can be carried into the brief from an explicit link, and you can remove it before sharing.
Security snapshot and public domain check
Self-check answers stay in page memory and are cleared when you leave or start over. They are not saved to your reader profile or sent to Piton. Copying or downloading a summary creates a copy you control.
The optional domain check sends only the domain you confirm to Piton. Piton asks Cloudflare’s DNS-over-HTTPS resolver for public DNS records and makes up to four requests: the HTTP and HTTPS home pages, the MTA-STS policy, and security.txt. Redirects are recorded without following them. No account, email address or self-check answers are required.
Domain results are cached in server memory for up to twelve hours. Domain and cache data are never written to disk or included in request logs. Request limits use IP addresses hashed with a daily random salt; hashes and counts remain in memory until the next daily reset, under twenty-four hours. The snapshot page does not report aggregate interactions. DNS questions reach Cloudflare, and public servers receive the requests needed for the check.
Hosting
The site is served from infrastructure operated by Piton Security. Its web server receives the technical information any web request carries: your IP address, browser type, the pages requested and timestamps. Server logs are used to operate and protect the site, not to identify visitors.
When you contact Piton
If you email contact@pitonsecurity.com, Piton receives what you send: your name, your email address and the content of your message. That correspondence is kept for as long as it takes to respond and as long as business records require, and is used only to reply and to handle any engagement that follows. You are not added to a mailing list.
Sharing
Piton does not sell personal information. It is shared only with the providers named above, which process it to deliver their service, or where the law requires.
Your choices
Write to contact@pitonsecurity.com to see, correct or delete the personal information Piton holds about you. The request will be honored unless a legal or contractual obligation requires retention.
Children
This site is not directed at children, and Piton does not knowingly collect information from anyone under 16.
Changes
Changes to this policy are posted here with a new date.