PRIVACY.001 · Policy

Privacy policy.

What we collect, what we refuse to collect, and what happens to it. On a privacy-first host, this is the shortest important document you will read.

Effective May 14, 2026 NordBastion OÜ Part of the terms of service

The best privacy policy is one with almost nothing to describe, because there is almost nothing collected. That is the one we are aiming for — and the clauses below are kept honest against it.

01

What we collect

The entire account, in full, is:

  • An email address and a password — stored only as a hash — so you can sign in.
  • Your prepaid balance and its ledger, so billing adds up.
  • The records of the servers you ordered — region, plan, OS image — so we can run them for you.
  • Minimal, short-lived operational and security logs needed to keep the platform online and abuse-free.

That is the list. There is no item five hiding below the fold.

02

What we refuse to collect

This list is longer than the one above, and that is the whole point:

  • No identity documents, no legal name, no phone number, no proof of address. We never ask, so there is nothing to lose or to surrender.
  • No payment identity. Top-ups arrive in cryptocurrency; we see an amount and a confirmation, not a bank account or a card in your name.
  • No logs of what runs inside your servers. We do not inspect your disks, your traffic content, or your workloads.
  • No advertising profiles, no behavioural tracking, no data sold or shared for marketing — not now, not ever.
03

Why we collect the little we do

Every item in the first list exists for one reason: to run the service you asked for. To authenticate you, to bill from your balance, to provision and operate your servers, and to keep the shared network healthy.

None of it exists to profile you, to advertise to you, or to be turned into a product. It is the cost of the service working — nothing more.

04

Cookies and the panel

The site sets one cookie: a session cookie that keeps you signed in to the control panel. It is not used for tracking, and it is gone when your session ends.

There are no tracking pixels, no third-party advertising tags, and no analytics service that follows you around. We do not even use a cookie to remember your language — that lives in the URL, not on your machine.

05

Logs and retention

Operational and security logs are kept minimal and short-lived — long enough to debug a fault or stop an attack, and no longer. They roll off on their own.

Account data lives for as long as the account does. Close your account from the panel and the data is exported on your terms, then destroyed — it is not parked somewhere indefinitely just in case.

06

Payments

Top-ups are made in cryptocurrency through a payment processor that converts the incoming coin into your balance. From that process we receive an invoice, an amount and a confirmation status — not your identity.

Cryptocurrency ledgers are public by their nature, but we do not link on-chain activity to a person, and we hold nothing that would let anyone else do so through us.

07

Who else touches your data

As few parties as possible, each given as little as possible: the payment processor that handles crypto top-ups, and the data-centre operators that house the four bastions. Each receives only what its job strictly requires.

There are no data brokers, no advertising networks, and no analytics platforms in that list. There never will be.

08

Legal requests

When a legal request reaches us, it is logged, reviewed by counsel, and challenged where it is overbroad. We disclose only what we are genuinely compelled to — which, by design, is almost nothing. The full process is documented in the Transparency report.

The affected customer is notified unless a valid order forbids it, and the Warrant canary covers the case where we are gagged. The single category where the privacy of the network does not hold is set out in the Acceptable Use policy.

09

Your control over your data

Because we hold so little, your data rights are mostly already in your hands. Most of what we have about you is visible to you in the panel right now — your account, your balance ledger, your servers.

You can export your data and close your account from the panel at any time. If you need help exercising a right that the panel does not cover directly, raise it from your control panel and we will handle it.

10

Changes to this policy

If this policy changes, the change is announced — through the panel and on this page — before it takes effect. Nothing here changes in silence; that is the doctrine the whole company is built on. The effective date at the top always reflects the version you are reading.

Privacy you can check, not just read.

This policy only means something because of how the network is built. The pages below are the proof, not the promise.