Your data stays yours.

Invitation access and email verification. We store your invitation label and assigned email to manage access for invitees. Invitation emails with the generated password, and later sign-in codes, go to that mailbox through one of our email providers, Resend or SendGrid. Security records include the verified email, sign-in time, IP address, approximate location, browser and operating system. These records are separate from optional analytics. Email codes expire after ten minutes. Secure sign-in cookies last eight hours for visitors and one hour for administrators. Contact us to revoke access or remove your stored invitation email identity. Our sign-in handlers do not send passwords or email codes to Plausible.

The invitee pages you open and the films you play there. After you sign in with your invitation, we record an invitee page you open only when you allow analytics. The invitee home is included, and so is a film you start on an invitee page. Each record holds your invitation, your verified email, the page address and the time. A film record also names the film. Before you allow analytics, this record stays empty. Only the KarmanFlow team sees this record, in the staff-only invitation admin, beside your sign-ins. It shows the pages in order, the films you played, and the time between one page and the next as time on that page. That time is eight hours at most, the length of a sign-in. We keep it so the team can follow up on your invitation knowing what you have already seen. It leaves out your IP address, browser details and cookies. The pages anyone can read stay out of it, even after you sign in, and so does a film you play on one of them.

The films. The films play in the Cloudflare Stream player. On the public pages nothing loads from Stream until you press Play; then the player loads from Cloudflare, which receives your IP address and browser details to play the film. On the invitee pages and on the invitation gate, shown when you open an invitee page before signing in, the player also waits for Play.

Aggregate page views and outbound-link counts (Plausible), on invitee pages. If you allow marketing analytics on an invitee page, a small Plausible script can count the visit, your country, the page URL and the referring site. It can also count outbound links as aggregate link events. It sets no cookies, builds no profile, and never tracks you across other sites. The numbers we see are aggregate counts, not a list of who visited.

Cloudflare edge and optional Web Analytics. Our hosts are proxied through Cloudflare, so Cloudflare receives normal HTTP request metadata to route traffic, serve the Worker, cache assets, mitigate abuse and report edge analytics. On invitee pages, when a Cloudflare Web Analytics token is configured and you allow marketing analytics, the site can also load Cloudflare's browser performance beacon for Web Vitals and page performance. We send a no-transform cache directive on HTML so Cloudflare's automatic injection of that beacon cannot bypass this choice.

First-party page and event logs, on invitee pages. Page views, docs searches, button clicks and successful form submissions on invitee pages can send a small event to /api/track only if you allow marketing analytics. The deployment runtime logs it in Cloudflare Workers Logs. We pseudonymise your IP with a salted SHA-256 hash cut to 16 hex characters. The hash is not the address, but someone who tries every address can match it back, so we treat it as personal data. We log a coarse user-agent family, a two-letter country code from edge headers when available, and the URL of the page or API the request hit. We also keep the HTTP referer and Accept-Language header that the browser sends with the event. Docs search events can include the search text you submitted and the result you clicked; those stay in the first-party log and are not forwarded to Plausible.

Browser storage for privacy choices and attribution, on invitee pages. We store your analytics choice in localStorage under kf:privacy-preferences so the banner does not keep asking. If you allow analytics, we also store one sessionStorage entry, kf:utm, with UTM fields, first-visit time and referrer. Closing the tab clears that attribution entry. The public pages store nothing in your browser; signing in sets the secure sign-in cookies described above.

Contact form submissions. The contact form is on an invitee page. If you send it, we receive the fields you typed, the same pseudonymised IP and user-agent family, and the UTM parameters from the link you arrived through if you allowed analytics. The submission is saved in the KarmanFlow lead store, a Cloudflare D1 database, and the request's log line holds it too. If an email provider is configured, the submission is forwarded to our sales inbox. We use this to reply to you and understand which channels bring us conversations, not to enrich a profile of you.

Plausible aggregates. Retained according to Plausible's data-retention policy. We don't hold any per-visit row beyond what Plausible exposes in its dashboard, which is aggregated counts, not raw events.

First-party event and request logs. Cloudflare Workers Logs keep these lines for operational review and attribution analysis, and delete them after seven days, the account's log retention period. They hold pseudonymised IPs, coarse user-agent families, country codes, page URLs, referring pages and language settings, and, for the contact form, what you typed. Cloudflare's own record of each site request, in the same logs, holds the IP address and request headers and expires the same way. We do not feed these logs into ad platforms.

Sign-in security records. Sign-in records older than 90 days are deleted the next time anyone signs in. The email stored with each sign-in has no automatic deletion schedule; ask us and we delete it.

Observe account requests. The lead row and the team's email stay until you ask us to delete them. The count of requests from your network is deleted after two days, the next time the site counts a request.

Contact form submissions. Until you ask us to delete them. If you write to us and we do not move forward together, you can ask for the submission to be deleted at any time.

Invitee pages and films. Records older than 90 days are deleted the next time anyone signs in, and by a daily clean-up. When we remove your stored invitation email at your request, your page and film records go with it.

Email support@karmanflow.com with the subject "Delete my data" and we remove your Observe account request or contact submission from the lead store. We also delete your emailed request and the emails about it in our mailbox, and confirm by reply within five business days. Log lines are not deleted one by one; they expire after seven days, when the log retention period ends.

If you are exercising rights under GDPR, UK GDPR, CCPA or similar laws, write to the same address and reference the specific right you are exercising. We respond within the statutory window for your jurisdiction.

The same email removes your invitation's records: your stored invitation email, and the record of the invitee pages you opened and the films you played.