Legal
Privacy Policy
The short version: we don't collect your data. The long version is below, written in plain language because legalese helps no one.
Last updated: March 23, 2026
What We Collect
NorthStar Compass is a static website with minimal data collection. We do not create user accounts or store personal information on any server. We use PostHog (a privacy-focused analytics tool) to collect anonymous usage events such as page views and feature interactions. PostHog receives your anonymized session data, browser type, and general region, but no names, emails, or personally identifiable information. All analytics events are tagged with an environment label (dev, stage, or prod) for debugging purposes only.
Your Data Stays Local
Any personalization data you enter (priority date, employer name, salary, etc.) is stored exclusively in your browser's localStorage under the `compass_` prefix. This data never leaves your device. We cannot see it, and we do not want to. You can clear it at any time by resetting your browser storage or using the Setup page.
Hosting & Infrastructure
Compass is hosted on AWS using S3 (static file storage) and CloudFront (CDN). Standard AWS access logs (IP address, timestamp, resource requested) are generated by CloudFront as part of normal CDN operation. These logs are not used for user tracking and are retained only as needed for infrastructure security.
Cookies & Tracking
We use PostHog for anonymous, privacy-focused product analytics. PostHog may set a cookie to distinguish unique sessions, but this cookie contains no personal data. We do not use Google Analytics, Facebook Pixel, Hotjar, or any advertising trackers. PostHog data is used solely to understand which features are used and to improve the product. The only other external resource is Google Fonts (Geist) loaded via Next.js font optimization.
Third-Party Data Sources
The immigration data displayed on Compass is sourced from publicly available U.S. government datasets (DOL, DOS, BLS, USCIS, DHS). This data is pre-processed and bundled as static JSON files. No API calls are made to government servers from your browser.
Security
All traffic is served over HTTPS with TLS 1.2+. The site implements Content-Security-Policy headers, XSS protections, and input sanitization. Since there is no backend, server, or database, the attack surface is minimal. The full source code is open for security review.