DATA HANDLING // PLAIN LANGUAGE

Security & privacy

What happens to your data in STAR Log, including the limits.

The short version

Your entries live on a private, self-hosted server, in a dedicated encrypted folder. They are not on a public cloud or with a third-party service.
Other users cannot see your data. Every query is scoped to your account.
You can purge your data or delete your account yourself, any time. The server then overwrites the deleted content instead of just unlinking it.
It is not end-to-end encrypted. The server operator has administrative access and could technically read stored entries. See "Who can see your data" below for what that means.
This is a personal server, not an authorized government information system. Keep entries unclassified and releasable. No CUI, no classified, no one else's personal data.

At a glance, with the limits

Private, self-hosted server

STAR Log runs in a container on a server owned and run by the operator. There is no cloud database, no SaaS backend and no third-party processor holding your entries.

LimitOne machine in one place. There is no uptime guarantee and no redundancy beyond the operator's backups.

Encrypted at rest

The database sits in its own encrypted shared folder on the NAS (folder encryption in UGOS Pro). If the drives are pulled or the NAS is taken while that folder is locked, the database is not readable. The app is also built to refuse to start unless that folder is unlocked, so it cannot quietly fall back to unencrypted storage after a reboot.

LimitThis protects against physical theft and locked storage. It does not protect against someone with access to the running, unlocked system. The NAS vendor has not published the implementation details of its folder encryption.

Isolated accounts

Every read, edit, delete and export is restricted to the signed-in account in the server code. Other users cannot list, open or change your entries or records.

LimitEntries are stored as readable text in the database. Isolation is enforced by the application, not by per-user encryption keys.

Passwords

Passwords (10 characters minimum) are hashed with bcrypt at cost 12 and a unique salt. The operator never sees or stores your plaintext password. Session tokens are random 256-bit values stored only as SHA-256 hashes. Sessions last 30 days. Signing out ends that session, and changing your password ends your other sessions.

LimitThere is no email and no password reset. If you forget your password, ask the operator to delete the account, then register again.

In transit

You should reach the site over HTTPS. The app sets HSTS on secure connections and issues session cookies as HttpOnly, SameSite=Lax and Secure. It rejects cross-origin writes and rate-limits sign-in and sign-up attempts.

LimitTLS ends at the operator's reverse proxy, which runs on the same server.

Purge and deletion are real

Purge removes your entries, your awards/certs/degrees, or both, and keeps your account. Delete account removes everything. In both cases the server runs SQLite with secure_delete on, flushes the write-ahead log and rewrites the database file, so the removed text does not linger in the database or its journal.

LimitBackup copies the operator made earlier can still contain your data until they age out or are cleared. Ask the operator to clear them if you want that gone too (see below).

No third-party tracking

There are no analytics, ads or tracking scripts. Your entries are never sent to any third party, and the server does not call any AI service.

LimitPages load fonts from Google Fonts, so Google sees your IP address when they load. The "Copy prompt for Claude" button only copies text to your clipboard. If you paste it into an AI tool, that tool's own terms apply, so keep it to material you are cleared to share.

Who can see your data

You: everything in your account.
Other users: nothing. There is no sharing feature and no shared views.
The server operator: has administrative access to the server. While the encrypted folder is unlocked, the operator could technically read the database, the same as with almost any self-hosted app.
Operator commitment: the operator does not browse or read individual users' entries. The database is only touched for maintenance, backups, security fixes, or at your request.

If that level of trust is not enough for what you want to store, do not store it here. Use the "Create and copy backup" option and keep your own copy, or keep entries more general.

What is stored

Your username, your password hash, your category list, and the date you acknowledged this notice.
Your entries (title, date, category, summary, result, optional situation/task/action) and your awards, certifications and degrees.
Hashed session tokens for signed-in devices.
Not stored: your name, email, phone number, or IP address in the database. IP addresses are used in memory only for rate limiting and are not written to disk by the app.

Purging, deleting and backups

Open Account, then Purge my data or Delete account. Both ask for your password and a second tap.
Before purging, use Create and copy backup if you may want your data back. A backup is plain text that you hold, so store it carefully.
The operator takes server-side backups into the same encrypted folder and keeps the newest 14. To remove your data from those as well, ask the operator to clear them. They can do it with one command, and a fresh backup is then taken without your data.

Logs

The app logs start-up messages and errors. It does not log request bodies or the content of your entries.
The reverse proxy may keep standard access logs (time, IP address, request path). These never contain entry content.

Ground rules

Unclassified and releasable only. No classified information, no CUI, no operational details that would be an OPSEC concern, and no personal data about other people.
This is not a government system and has not been assessed or authorized as one. Check with your own security or legal office if you are unsure whether your wording is appropriate to keep outside official systems.
Write accomplishments the way you would put them on a public resume: results, numbers and scope, without sensitive specifics.

If you use the Enlisted (EPB) or Officer (OPB) appraisal types

Personal tracking only. The official brief is written by your rater in myEval. Nothing here is an official record, and nothing is sent to any Air Force or Space Force system.
Write it like a public award citation. No classified information, no CUI, and no operational, unit-capability, deployment or personnel details that would be an OPSEC concern.
Do not store anyone else's evaluation content: no ratings, stratification, or personnel information about other people.
This tool does not know your command's policies. If you are unsure whether keeping performance inputs outside government systems is allowed for you, ask your supervisor or unit security manager first.
The performance area names and the per-area character limit reflect published guidance at the time this was written and can change. Always check current DAFI 36-2406 and your myEval screens. The limit in this tool is editable.

Questions, concerns, vulnerabilities

Contact the operator: your server operator. If you find a security problem, please tell the operator privately before sharing it with anyone else.

BACK TO STAR LOG