Legal

What Mach 9 collects when you use this site, why, how long it sticks around, and how to have it deleted.

Last updated: September 2026

The short version

Mach 9 (“Mach 9,” “we,” “us”) runs an educational website about aviation, aerospace, engineering, space and technology, plus a small apparel shop. This page explains, plainly, what information the site actually collects and what happens to it.

We do not run advertising, we do not run analytics or tracking scripts of any kind, and we do not sell or rent anyone’s information to anyone. The only cookie this site sets is the one that keeps you signed in. Everything else below is either something you typed in on purpose (an account, a password reset, an order) or is handled entirely by the payment or shipping provider you interacted with directly.

A note on age, up front

Mach 9’s Academy content is written for students roughly eleven to eighteen years old, which means some visitors are under 13. Mach 9 does not currently ask for or verify a visitor’s age, and does not have a parental-consent process in place for account creation. Account sign-up only asks for a display name, an email address and a password, no birth date, school or address is collected, but that does not, on its own, satisfy children’s-privacy laws such as COPPA in the United States for a site that knowingly serves a users under 13. This is flagged here honestly rather than glossed over: a parent or guardian who wants a child’s account information reviewed or removed can contact us at the address below, and we will act on that request. Mach 9’s operator has identified this as an item that needs a proper legal review before the accounts feature should be considered compliant for younger users.

What we collect

If you just read the site

Browsing Explore, Academy, Careers, Discover or the Shop without creating an account or buying anything does not create any record tied to you on our side. We do not run Google Analytics, a Meta or TikTok pixel, session-recording, heat-mapping, or any other visitor tracker, there is none installed on this site as of the date above. Our hosting provider (Vercel) and any content-delivery layer between you and our servers may keep ordinary, short-lived technical logs (like any web server does) for operating and securing the service; Mach 9 does not use those logs to build a profile of who you are.

If you create an account

Creating an account collects a display name, an email address, and a password (which is salted and hashed, we never store or can look up your actual password). Signing in sets one cookie that identifies your session; it does nothing else and is not used for advertising or tracking. If you save a career or make progress in an Academy course, that progress is stored against your account so it is there the next time you sign in.

If you reset your password

Requesting a reset link sends a one-time, time-limited link to the email you provided, using Resend (an email-delivery service) or, on a development deployment with no email provider configured, by printing the link to the server log instead of sending it.

If you use ATLAS (the “Ask” box)

A question you type into ATLAS on the homepage is screened on our server for a short list of unsafe patterns (attempts to share personal information, arrange to meet someone, or signs of a personal crisis) before anything happens with it. If it passes that screen, the question text is sent to Anthropic’s Claude API solely to generate an answer, and is not stored by Mach 9 afterward and is not tied to your identity. See below for what a third-party AI provider receiving that text means in practice.

If you buy something from the Shop

Mach 9’s checkout is handled entirely by Shopify’s own hosted checkout, not by a payment form on this site. Your name, email, shipping address and card details are entered directly on Shopify’s own secure page; Mach 9’s servers never see or store your card number. Once an order is confirmed, the shipping name and address are passed to Printful (our print-on-demand fulfilment partner) so they can print and ship the order. Mach 9 does not keep a database of past orders, addresses or card details on its own servers.

Security-only data

When a sign-in attempt fails, we briefly record the email attempted and the IP address it came from, purely to slow down and detect automated password-guessing. These records are short-lived and are not used for anything besides that.

How we use it

  • To let you sign in and keep your saved careers and course progress.
  • To send a password-reset link when you ask for one.
  • To answer a question you ask ATLAS.
  • To fulfil and ship a Shop order, through Shopify and Printful.
  • To detect and slow down abusive sign-in attempts.

We do not use anything collected here to build an advertising profile, and we do not use it to make automated decisions that produce a legal or similarly significant effect on anyone.

Whether we sell or share it

Mach 9 does not sell personal information, and does not share it with anyone for their own advertising or marketing purposes. Information is shared only with the outside services that are necessary to provide the feature you used:

  • Shopify: to process a payment and collect a shipping address, when you place an order.
  • Printful: to print and ship an order, once paid.
  • Resend: to deliver a password-reset email, when you ask for one.
  • Anthropic: to generate an answer, only for the text of a question you send ATLAS, and only after it has passed the safety screen described above.
  • Vercel and Neon (our hosting and database providers): to run the site and store the account data described above at all.

Each of those companies handles data under its own privacy policy, which we do not control. We would also disclose information if required to by law, or to protect the safety of a user or the public, for example, in response to a lawful request from law enforcement.

How long we keep it

  • An account and its saved data are kept until you delete the account or ask us to.
  • A sign-in session lasts up to 30 days of use before it expires on its own.
  • A password-reset link expires after one hour, whether or not it was used.
  • Failed sign-in records are kept briefly for abuse detection and then purged.
  • Mach 9 does not keep Shop order, payment or shipping records on its own servers at all, those live with Shopify and Printful under their own retention rules.

Your rights, and how to use them

You can review and change your account’s name and password at any time from Account settings while signed in. You can delete your account yourself, also from Account settings, this removes your saved careers, course progress and entitlements immediately along with the account itself. If you’d rather ask us to do it for you, or if you are a parent or guardian asking about a child’s account, email mach9.co@gmail.com and we will act on it. Depending on where you live, you may have additional rights under laws like the EU/UK GDPR or U.S. state privacy laws (for example, California’s CCPA/CPRA); we have not independently verified which of those apply to Mach 9’s current operations, so treat this paragraph as “ask us and we’ll sort it out,” not as a formal jurisdiction-by- jurisdiction legal statement.

Security

Passwords are salted and hashed, never stored in plain text. Session cookies are marked HTTP-only and, in production, secure and same-site, so they cannot be read by page scripts or sent to another site. No system is unbreakable, and we cannot guarantee absolute security of any information transmitted over the internet.

Children’s privacy

See the note above. In short: Mach 9 is written for a school-age audience that includes children under 13, the account form deliberately collects the minimum needed (name, email, password, no birth date, no school, no address), and Mach 9 has not implemented age verification or a verifiable-parental- consent process. A parent or guardian can email mach9.co@gmail.com to review, correct or delete information collected from their child, or to ask that their child stop using accounts on this site.

Changes to this policy

If what this site collects or how it’s used changes, this page will be updated and the date at the top will change with it. We don’t send a separate notice for every edit, so check back occasionally if it matters to you.

Contact

Questions about this policy, or a request about your own or your child’s information: email mach9.co@gmail.com or call (585) MACH9CO.