Privacy Policy

Last updated: October 19, 2026
Site: https://www.btulogic.com (the “Site”)
Operator: John Carioto (“I,” “me,” “the operator”)
Contact: john.carioto@gmail.com

This Privacy Policy describes how information is handled when you use the Site. The Site is a personal workbench operated by John Carioto, an individual in New Jersey. “BTU Logic” / btulogic.com is a brand name only — there is no formed company or LLC by that name yet. This policy covers the Site as it works today: public News, Articles, Tools, and practice-question pages, optional News topic email digests (double opt-in), recreational Games, and an invite-only Backend where people I invite sign in with their own individual account to reach the sections I have opened for them.

1. Short version

Public News, Articles, Tools, practice-question, and Games pages do not require an account.
The Backend is invite-only. If I invite you, you create an account with a username and password, confirm you are 18 or older, and agree to the Terms of Use and this Privacy Policy. Account sign-up does not ask for your email address, real name, phone number, or payment details, and the Site never emails you about your account: invites and password resets are links I give you myself.
Your password is never stored as typed; only a scrypt hash is kept. Optional two-factor authentication (2FA) and single-use recovery codes are available.
Signed-in sessions are tracked with one strictly necessary cookie, backed by a session record in a Cloudflare D1 database. That cookie is needed for sign-in to work, so there is no cookie banner.
To stop password guessing, IP addresses are used briefly for login rate limiting and lockout. Security logs keep only a shortened network prefix of your IP, not the full address.
Optional News topic email digests are available if you subscribe and confirm via email (double opt-in). I do not sell email addresses or run a third-party marketing list.
The Site is hosted on Cloudflare Workers. No analytics script runs on the Site (see section 2.4).
Daily news briefings on the Site are static files, not a system that tracks individual readers for ad targeting.
I do not sell or “share” personal information for advertising.
I aim to collect as little personal information as practical.

2. Information I may process

2.1 Information you provide

Backend account — If you accept an invite, you choose a username (3–32 characters) and a password, tick a box confirming you are 18 or older, and tick a box agreeing to the Terms of Use and this Privacy Policy. Sign-up does not ask for an email address, and none is stored with your account. I store:
- your username and account role (member or owner);
- your password only as a salted scrypt hash (the password itself is not stored and I cannot read it);
- the time you confirmed you are 18 or older, and when the account was created and last changed;
- if you turn on 2FA, your authenticator secret, encrypted, plus the last code step used (to block replayed codes);
- if you have 2FA, ten single-use recovery codes, stored only as keyed hashes (I cannot read them back; you are shown them once);
- a count of recent failed sign-ins and any temporary lockout time;
- whether the account is disabled.
Invite and reset links — I create single-use invite links (and, if needed, password-reset links) and deliver the link to you myself, outside the Site. The Site never sends invites or resets by email, and there is no email-based “forgot password” option. Each link is stored only as a hash, with the sections it grants, an optional private note I add for my own reference, who created it, when it expires, and when and by which account it was used or revoked.
Section access — Which Backend sections I have granted to your account (currently: Paper trading, a simulated, paper-only portfolio for experimentation only and not investment advice; and the Crawler game beta), and when.
Tool uploads — Weather or data files you upload to Tools are processed to produce results for you. Those uploads are not used to build a marketing profile.
News digest signup — If you use the News digest form, you provide an email address, the public topics you want, and consent. I also store confirmation / unsubscribe state (pending, active, or unsubscribed), hashed tokens, consent and confirmation times, and limited provider metadata needed to send mail. See News topic email digests below.
Email you send me — If you email john.carioto@gmail.com, I receive whatever you include in that message so I can reply.

2.2 Information collected automatically

Like most websites, the hosting and network provider (Cloudflare) may automatically receive technical data such as:

IP address, approximate location derived from IP, browser type, device type
Pages requested, timestamps, and basic referral information
Security and abuse-prevention logs, and request logs used to debug the Site

When you use the Backend, the Site itself also records:

Session records — when a session started, when it was last active, when it expires or was signed out, and the browser’s user-agent string (shortened). The session token in your cookie is stored only as a hash.
Login rate limiting — your IP address is used to count failed sign-in attempts. The short-term counter is held in memory and in Cloudflare Workers KV under a hash of the IP, and expires on its own after roughly 15 minutes.
Security (audit) log — sign-ins, failed sign-ins, lockouts, invite and reset use, password and 2FA changes, recovery-code use, and changes I make to accounts and access. Each entry records the time, the account (or “anonymous”), the action, and a network prefix of the IP address (for example, the first three parts of an IPv4 address), not the full address. For a failed sign-in to an unknown username, the username that was typed is recorded. Passwords, codes, and tokens are never written to this log.

This is used for operating the Site, debugging, security, and understanding aggregate traffic — not to sell ads against your identity.

2.3 Cookies and similar technology

Account session cookie (strictly necessary) — When you sign in, a cookie holding a random session token is set so you stay signed in. It is HTTP-only (page scripts cannot read it), sent only over HTTPS, and limited to this Site. Member sessions end after 7 days of inactivity or 30 days at most; signing out ends the session sooner. Without this cookie, sign-in cannot work.
Crawler pass cookie (strictly necessary) — If you have Crawler access, a short signed pass (about 1 hour) lets the game files load. It is scoped to the game’s path.
Owner access cookie — A separate owner-only sign-in method sets its own strictly necessary cookie on my devices. It does not apply to invited members.
Game saves in your browser — The Crawler game saves progress in your browser’s own storage on your device. That data stays on your device; it is not sent to the Site unless you choose to copy the in-game bug report and send it to me.
Hosting / CDN / security cookies — Cloudflare may set strictly necessary cookies for performance, routing, or protection (for example, bot or abuse checks).
Page analytics — None. No analytics script runs and no analytics cookie is set (see section 2.4).

All cookies the Site sets are strictly necessary for features you ask for (signing in, loading a game you have access to). I do not use analytics, third-party advertising cookies, or a marketing pixel stack. If that changes, I will update this policy first.

2.4 Page analytics

No analytics script runs on the Site. I do not use page analytics, so no page-view data about you is collected for that purpose. Cloudflare still receives the ordinary technical data described in section 2.2 in order to host and protect the Site. If I add analytics later, I will update this policy before turning it on.

3. How information is used

Information described above is used to:

Run and secure the Site, including Backend accounts, sign-in, 2FA, and per-section access control
Detect and slow down password guessing, lock accounts after repeated failures, and investigate suspicious activity
Process Tool inputs and show results
Send optional News topic digest confirmation, welcome, and (when enabled) daily digest mail you asked for
Respond to emails you send
Understand overall traffic, load, and errors from the hosting provider’s standard request data
Fix bugs, prevent abuse, and improve reliability

I do not sell your personal information, and I do not use it for advertising.

4. News content and “generated / sample” briefings

News pages may show topical rollups. Some briefings may be labeled sample, placeholder, or generated until live editorial pipelines write production files. Those pages are content for you to read; they are not a reader-tracking product. They do not prove who read what story.

5. News topic email digests

You may optionally ask for a daily email digest of selected public News topics. This is separate from Backend accounts; subscribing does not create an account, and having an account does not subscribe you.

Purpose — Send a digest of the topics you chose, after the morning briefing (about 5 AM Eastern), only if you confirmed the address.
Double opt-in — I send a confirmation link first. No digest is sent until you click it. Confirmation links expire within 24–48 hours. If you did not request the email, ignore it.
Email provider — Transactional mail is sent with Resend. Resend processes the recipient address and message content in order to deliver the mail under its terms.
Storage — Subscriber records live in private Cloudflare Workers KV storage (not publicly readable). Fields include the normalized email, selected public topic ids, status (pending, active, or unsubscribed), hashed confirmation and unsubscribe tokens, consent / confirmed / unsubscribed times, and an optional hashed IP. Records are keyed by an email hash, not the raw address. Storage locations are not returned to the browser.
No sale — I do not sell email addresses or share this list for third-party marketing.
Retention / suppression — Active subscriptions are kept while you remain subscribed. If you unsubscribe, I keep a suppression record so that address is not emailed again unless you subscribe and confirm again. Pending confirmations that expire can be replaced if you sign up later.
Unsubscribe — Use the unsubscribe link in confirmation, welcome, or digest emails (one-click unsubscribe is supported for mail clients that send it). You can subscribe again from the News page.
Not for children under 13. Do not subscribe a child. See Children’s privacy below.

When daily sending is enabled, digest footers will include contact information (the email on the Contact page). I do not publish a street address in this policy.

Information may be shared only when needed to operate the Site or when the law requires it, for example:

Service providers — Cloudflare (hosting on Cloudflare Workers, CDN and security, the D1 database that holds accounts and sessions, Workers KV storage, and request logs) and Resend (News digest email only). They process data on my behalf under their terms. The Site does not send account information to Resend; Backend accounts send no email.
Legal — If required by valid legal process, or to protect rights, safety, or security
Transfer of the project — If operation of the Site later moves to an LLC I form (or another successor), data needed to keep the Site running may move with it; this policy will be updated to name the new operator

I do not sell personal information to data brokers, and I do not share it with other members. Other invited members cannot see your account, your access, or your activity; only I (as operator) can.

7. Backend accounts (important)

The Backend is invite-only, with individual accounts. There is no public sign-up.

Who sees what — I can see each account’s username, role, which sections are granted, whether 2FA is on, active sessions (with start time, last activity, and browser user-agent), and the security log. I cannot see your password or recovery codes.
Sections — A new account starts with no sections. I grant and remove access one section at a time. Today the grantable sections are Paper trading (members can view only; it is a simulated, paper-only portfolio for experimentation only, uses no real money, and is not investment advice) and the Crawler game beta. The Backend also contains an unofficial All Saints events concept demo I built to present to a school; it is not affiliated with or endorsed by the school, uses simulated checkout only, takes no live payments, collects no payment details, and is not available to members unless the school approves it.
No member uploads today — Members cannot currently upload notes or files to the Backend. If that changes, I will update this policy first.
Keep it boring — Do not put highly sensitive personal data (SSNs, payment card numbers, medical records, secrets that would harm others if leaked) anywhere in the Backend.
Owner-only area — The Backend also has an owner-only console and an owner-only emergency sign-in. Members cannot reach them.

8. Retention

Hosting / security logs — Cloudflare request logs are kept according to Cloudflare’s defaults and the need for security and debugging, then deleted or rotated.
Backend accounts — Kept while the account exists. If an account is deleted (by me, or at your request), the account record, its password hash, 2FA secret, recovery codes, section grants, sessions, and any open reset links are deleted.
Session records — Ended or expired sessions (signed out, timed out, or revoked) are deleted 30 days after they end. All of an account’s sessions are deleted when the account is deleted.
Login rate-limit counters — Expire automatically after about 15 minutes.
Security (audit) log — Kept for 12 months so I can investigate abuse, then deleted. Entries may be kept after an account is deleted, until they reach 12 months old. Those entries contain the username, actions, times, and IP network prefixes described above — not passwords or full IP addresses.
Used or expired invite links — Kept as hashes with their use/expiry details for 12 months, then deleted.
Used, revoked, or expired password-reset links, and used recovery codes — Deleted 30 days after they end or are used.
News digest subscribers — Kept while pending or active. Unsubscribed addresses are kept as a suppression record so I do not email them again unless they subscribe and confirm again. Resend (and hosting logs) may retain delivery metadata according to those providers’ defaults.
Email correspondence — Kept as long as needed to handle your request and ordinary inbox practice.
Tool uploads — Processed to return results; upload copies are not intentionally retained as a permanent archive unless a Tool feature clearly says otherwise.
Backups — Cloudflare may keep short-term database backups under its own retention; deleted data can persist there until those backups roll off.

9. Security

Reasonable technical measures for a small personal site are used, including: HTTPS; passwords stored only as salted scrypt hashes; optional authenticator-app 2FA (required for the owner account) with single-use recovery codes stored as keyed hashes; 2FA secrets encrypted at rest; session tokens stored only as hashes; HTTP-only, secure session cookies; cross-site request protections; per-IP rate limiting and temporary account lockout after repeated failed sign-ins; single-use, expiring invite and reset links; deny-by-default section access; and an audit log. No method of transmission or storage is 100% secure, and I do not promise that the Site cannot be breached.

You are responsible for using a strong, unique password, keeping your authenticator device and recovery codes safe, and telling me promptly at john.carioto@gmail.com if you think your account has been compromised. If I learn of a security incident that affects your account information, I will tell affected account holders as required by applicable law and as practical.

10. Children’s privacy

Backend accounts are for people 18 and older only. Every account holder must confirm they are 18 or older when accepting an invite. If I learn that an account belongs to someone under 18, I will disable and delete it.

The rest of the Site is not directed at children under 13 (or under 16 where that is the relevant standard). News topic email digests are not for children under 13. I do not knowingly collect personal information from children. If you believe a child provided personal information (including a digest signup or an account), contact me and I will delete it where feasible.

11. Your choices

Browse public pages without creating an account.
Decline an invite, or ask me to delete your account at any time.
Change your password, turn 2FA on or off (members), replace your authenticator, regenerate recovery codes, and sign out other sessions from your account page.
Subscribe to optional News topic digests, or ignore a confirmation email so nothing is sent.
Unsubscribe from News digests at any time via the link in those emails (or the unsubscribe page that link opens).
Clear cookies / site data to sign out on that browser.
Stop using the Site at any time.

Access, correction, and deletion requests — Email john.carioto@gmail.com and tell me your username. To protect your account, I may ask you to confirm the request while signed in to your account before I act (because accounts have no email address, that is how I check a request really comes from you). You can ask what I hold about your account, ask me to correct it, or ask me to delete it. There is no self-service “delete my account” button yet, so I will handle deletion requests by hand within a reasonable time. Usernames cannot currently be changed; I can delete an account and send a new invite instead.

If you are in a jurisdiction with additional rights (for example, access, correction, deletion, or portability), email me. I will respond in a reasonable time consistent with applicable law and the limited data held.

12. International visitors

The Site is operated from the United States (New Jersey). If you access it from elsewhere, you understand information may be processed in the U.S. and other locations where Cloudflare and other providers operate.

13. Changes

I may update this Privacy Policy by posting a new version here with a revised “Last updated” date. Material changes (for example, collecting new kinds of account information, analytics that identify you, an email list, member uploads, or naming a newly formed LLC as operator) will be reflected in this document before or when those features ship. If you have a Backend account, I will also tell you about material changes by a notice in the Backend (or another reasonable way) before they take effect.

14. Contact

Privacy questions or requests: john.carioto@gmail.com

This policy matches the Site’s current personal-workbench footprint, including invite-only member accounts. It is not a substitute for counsel if you add paid plans, form an LLC and transfer operations, cross-border HR/customer data, HIPAA/PCI data, or advertising SDKs.