Our practices
No ads, no data sales
BOSLA has no advertising and we don't sell or rent your information. The site loads no ad or tracking scripts.
Counting visits without following you
Unique visitors are counted with a one-way, salted hash of your network address and browser family. No cookie is set for it, the raw address isn't stored, and the count is never linked to an account.
Only the cookies the site needs
Cookies keep you signed in, remember your language and credit a friend's invite. There are no advertising or analytics cookies.
The assistant doesn't keep your chats
Your conversation stays in your browser tab and is gone when you close it. We record only that a question was asked, not what it said.
AI only when you ask
Your questions reach our AI provider, Anthropic, only when you use the assistant. Visitors who aren't signed in send nothing about any account.
We never see your password
Member sign-in is handled by Clerk. We keep your account id, email, first name and invite points, not your password.
A human approves AI edits
When an AI tool helps write the site, its changes to live pages are saved as proposals. A person on our team reviews and approves each one.
Your data, your request
You can ask us what we hold about you, or ask us to delete it, through the contact page or the email below.
Where your data goes
Every path data can take, from your browser to the services behind the site.
Your browser
Pages you open, forms you send, questions you ask the assistant.
BOSLA servers (Netlify)
Run the website and decide what is stored or passed on.
Database and files (Supabase)
Accounts, sign-ups, messages, anonymous counts, uploaded images.
Sign-in (Clerk)
Your email and sign-in details, to keep your account safe.
Email (Resend)
Notifies our team about messages you send us, when email is configured.
AI assistant (Anthropic)
Your question and the site's content, only when you use the assistant.
Who processes data for us
Only the services the site actually uses.
Netlify
- Purpose:
- Website hosting
- Data:
- Requests to the site
- Location:
- See the provider's policy
Supabase
- Purpose:
- Database and image storage
- Data:
- Account records, sign-ups, messages, anonymous counts, images
- Location:
- See the provider's policy
Clerk
- Purpose:
- Member sign-in and account security
- Data:
- Email, name if you add it, sign-in devices
- Location:
- See the provider's policy
Anthropic
- Purpose:
- The AI assistant (Claude)
- Data:
- Your questions; for members, first name, points and invite link
- Location:
- See the provider's policy
PostHog
- Purpose:
- Anonymous usage statistics
- Data:
- Which pages and actions, under the same pseudonymous id as the visitor count — sent by our server, never by your browser
- Location:
- See the provider's policy
Resend
- Purpose:
- Email notifications to our team
- Data:
- The message you sent and your reply-to email
- Location:
- See the provider's policy
We will update this list before adding a provider that handles personal information.
Security controls
Protections that are in place in the code today.
HTTPS only, enforced with HSTS on every page.
Security headers on every page: no framing, no MIME sniffing, a strict referrer policy, and camera, microphone and location turned off.
A baseline Content Security Policy that blocks plugins, base-tag hijacking and framing.
Team passwords hashed with bcrypt; admin session tokens stored only as hashes, in httpOnly cookies.
Rate limits on team sign-in, forms, the assistant, analytics and the AI integration.
The AI provider key is sealed with AES-256-GCM before it is stored.
Uploaded images are type-checked, SVGs with scripts or links are refused, and uploads are served sandboxed.
The assistant only answers requests from the site's own pages.
Analytics without cookies, raw IP addresses or links to accounts.
AI integration tokens stored hashed; AI edits to live content wait for human approval.
Where we are
What is done, what is under way, and what is still planned.
Security headers and HTTPS
DoneApplied to every page of the site.
Cookie-free visitor counts
DoneSalted hash of network address and browser family, never linked to accounts.
Privacy and cookie policies
In progressPublished as a working draft; not yet reviewed by legal counsel.
Data retention periods
PlannedNot yet defined. The privacy policy will state them.
Full script Content Security Policy
PlannedExtending the baseline policy to control which scripts may run.
Independent security review
PlannedAn outside penetration test of the site and its APIs.
Report a problem
Found a vulnerability, or have a privacy request? Tell us. Please give us reasonable time to fix a security issue before making it public.
The details are in our Privacy policy · Cookie policy