Privacy
Privacy policy
This policy explains what the North Pole Window website collects, why it collects it, and how to ask for a change. It was last updated on September 23, 2026.
Who we are
North Pole Window operates this website at northpolewindow.com. You can reach us at hello@northpolewindow.com or through the contact form. We do not publish a street address or phone number here.
What we collect
Waitlist
If you join the Holiday 2026 waitlist, we store your email address, an optional first name, the time you consented to updates, and a hash of the IP address used for the request. The hash is for abuse prevention. We do not keep the raw IP address in the waitlist record.
Parent accounts
Activation asks for a parent email, a password, a timezone, and agreement to this policy. The password is stored only as a hash. You may add one optional child display name of up to 40 characters. We do not ask for a child’s age, birthdate, surname, school, photo, or home address.
The account is built so a passwordless sign-in could be added later. Today, sign-in uses the email and password.
Windows and scenes
Each window has an unguessable public token and a hash of its activation code. We do not keep the plain activation code after it is shown to an administrator at creation. When someone opens a personalized window page, we may store one view record per window, scene, day, and hashed IP address. That count tells us a scene was seen. It is not a profile of a child.
Contact messages
The contact form stores the name you type, your email, the message, a hashed IP address, and the time. Messages are read by the people who operate the site.
Cookies
The site sets a first-party session cookie so forms can be protected and so parents or administrators can stay signed in. The cookie is HttpOnly and SameSite=Lax. It is marked Secure when the site is served over HTTPS. We do not use it for advertising.
What we do not do
We do not sell personal information. We do not run third-party advertising. Analytics settings exist in the admin area as a placeholder and are not injected into public pages. The site works with that feature left blank. We do not publish reviews, prices, or invented customer counts.
Children
The December experience is made for families, and the account is for a parent or guardian. The window a child opens shows the day’s picture and a short story. It does not show the optional display name. We do not knowingly collect personal information directly from a child. If you believe a child’s information was submitted by mistake, write to us and we will delete it.
How long we keep information
Waitlist entries stay until you ask to be removed or until we no longer need them for launch updates. Parent accounts and window settings stay while the account is in use. View records are aggregate scene counts and can be deleted with the window. Server logs may briefly contain technical errors. They are not a marketing list.
Asking for a copy or a deletion
Email hello@northpolewindow.com from the address on the account or waitlist. Tell us whether you want a copy, a correction, or deletion. We may ask you to confirm you control that email. Administrators can remove a waitlist row directly.
Security
Passwords and activation codes are hashed. Public window tokens are random. Forms use a per-session token. Uploaded scene files are renamed and limited to image and MP4 types. No method of storage is perfect. If we learn of a breach that affects your account, we will write to the email we have.
Changes
If this policy changes in a way that matters, we will update the date on this page. If you are on the waitlist or have a parent account, a material change about how we use email will also be sent to that email when we can.