Privacy
What we do with your data
Two different things share this domain, and they collect very different amounts. This page covers both, starting with the one that collects nothing.
This website
No cookies, no analytics, no tracking of any kind. Nothing is stored in your browser and no visit is logged to a profile. There is no cookie banner because there is nothing to consent to — which is the honest version of that badge everyone puts in their footer.
The one request that leaves our infrastructure is for the two typefaces, to Bunny Fonts (BunnyWay d.o.o., Slovenia — inside the EU). Your browser sends its IP address to fetch the files, and Bunny states it does not log or profile those requests. We use it rather than Google Fonts on purpose. If you would rather nothing at all left our servers, say so and we will self-host the fonts.
Our web server keeps ordinary access logs — IP address, page, timestamp — for a short period, to keep the service running and spot abuse. They are not used to build a picture of you and are not shared.
The product, if you create an account
Creating an account means we hold some personal data about you:
| What | Why |
|---|---|
| Email address, first and last name | To create the account, sign you in, and email you about the service |
| Password (stored hashed, never in readable form) | To authenticate you |
| The content you put in — pages, files, work items | It is the service. We do not read it, mine it, or train anything on it. |
| Security and audit records of actions in your workspace | So you can see who did what, and so we can investigate abuse |
Where it lives, and who else touches it
Everything runs on servers we rent from Hetzner Online GmbH in Falkenstein, Germany, on an encrypted volume. Backups are encrypted and stored with the same provider in Helsinki, Finland. Both are inside the EU.
Cloudflare answers DNS for the domain. It is configured DNS-only, so it resolves names and never sees your traffic or terminates the encrypted connection.
Identity, email and file storage all run on our own machine rather than a third-party service, so the list of companies that touch your data is genuinely short. We do not use an analytics provider, an advertising network, or a customer-tracking tool anywhere.
There is no payment provider in this list because nothing is for sale during the beta. When paid plans open, a payment provider will be added here before it handles anyone's money.
Where we are, and where your data is
Worth stating plainly, because the two are not the same place.Your data is stored in the EU — Germany, backed up to Finland — and it stays there. The person who operates the service is in Singapore, and administers those servers from there.
Singapore's Personal Data Protection Act applies to how we handle your data.
How long we keep it
Account data and content for as long as the account exists. Delete your account and the content goes with it, including from backups as those age out — which takes a few weeks rather than being instant, because backups are written once and expire on a schedule. Access and audit logs are kept for a limited period and then discarded.
Your rights
You can ask for a copy of your data, correct it, or delete it. The product has export and deletion built in, so you can do most of this yourself. For anything else, email hello@sovereignworkspace.org and we will answer within a month.
Who runs this service
Sovereign Workspace - Chris Armstrong10 Bedok Rise, Singapore 469601
hello@sovereignworkspace.org
Last updated 2026-08-11.