Privacy policy.
Version 1.0 · 8 November 2026. This policy describes the application's intended technical implementation. Review it with Privacy Needle management before production publication.
What the application processes
For domain verification, Sentinel stores the target hostname, generated proof token, proof status and a pseudonymous browser session identifier. For verified website checks, it stores observed response-header findings, a score and a timestamp. It does not store target page HTML or request your credentials.
Why this information is used
Records support ownership verification, authorised assessments, session history, rate limiting and abuse prevention. The website domain you enter is accessed over HTTPS only as necessary to verify ownership and read defensive headers.
Where information is kept
Scan results reside in Cloudflare D1 associated with a random HttpOnly browser session cookie. Stored report, session and challenge records are scheduled to expire after 30 days. The security assessment service does not request names or email addresses.
Readiness answers, training decisions and risk-register entries are kept in browser-local storage. Exports are generated on your device. Deleting browser site data clears these records. The history page allows deletion of the server-side session records.
AI explanations
When you request optional AI advice, limited findings from your verified assessment are sent to Cloudflare Workers AI to generate a plain-language summary. Do not put secrets into domain names or submitted content.
Advertising, analytics and third parties
When advertisements are enabled on the approved production hostname, Google AdSense may process browser and usage information under Google's terms and applicable consent choices. Google's Privacy & messaging configuration and any legally required certified consent management must be completed before relevant ad serving. No AdSense ads are loaded on development or preview hosts.
Other Privacy Needle websites
Links to Privacy Needle News, Privacy Needle AI and Privacy Needle Play lead to separate services with their own policies and settings.
Questions or data requests
Contact the team using Privacy Needle's official contact page. You may also delete your Sentinel session records from the assessment history page.