Privacy
What we do with your data
Two different things share this domain, and they collect very different amounts. This page covers both, starting with the one that collects nothing.
This website
No cookies, no analytics, no tracking of any kind. Nothing is stored in your browser and no visit is logged to a profile. There is no cookie banner because there is nothing to consent to — which is the honest version of that badge everyone puts in their footer.
The one request that leaves our infrastructure is for the two typefaces, to Bunny Fonts (BunnyWay d.o.o., Slovenia — inside the EU). Your browser sends its IP address to fetch the files, and Bunny states it does not log or profile those requests. We use it rather than Google Fonts on purpose. If you would rather nothing at all left our servers, say so and we will self-host the fonts.
Our web server keeps ordinary access logs — IP address, page, timestamp — for a short period, to keep the service running and spot abuse. They are not used to build a picture of you and are not shared.
The product, if you create an account
Creating an account means we process personal data, and for that we are the controller:
| What | Why | Basis |
|---|---|---|
| Email address, first and last name | To create the account, sign you in, and email you about the service | Performance of a contract |
| Password (stored hashed, never in readable form) | To authenticate you | Performance of a contract |
| The content you put in — pages, files, work items | It is the service. We do not read it, mine it, or train anything on it. | Performance of a contract |
| Security and audit records of actions in your workspace | So you can see who did what, and so we can investigate abuse | Legitimate interest in a secure service |
Where it lives, and who else touches it
Everything runs on servers we rent from Hetzner Online GmbH in Falkenstein, Germany, on an encrypted volume. Backups are encrypted and stored with the same provider in Helsinki, Finland. Both are inside the EU.
Cloudflare answers DNS for the domain. It is configured DNS-only, so it resolves names and never sees your traffic or terminates the encrypted connection.
Identity, email and file storage all run on our own machine rather than a third-party service, so the list of companies that touch your data is genuinely short. We do not use an analytics provider, an advertising network, or a customer-tracking tool anywhere.
There is no payment processor in this list because nothing is for sale during the beta. When paid plans open, a processor will be added here before it handles anyone's money, along with a data processing agreement for business customers.
Where we are, and where your data is
Worth stating plainly, because the two are not the same place.Your data is stored in the EU — Germany, backed up to Finland — and it stays there. The person who operates the service is in Singapore, and administers those servers from there.
If you are in the EU or the UK, the GDPR applies to us because we offer the service to you, regardless of where we sit. Singapore's Personal Data Protection Act applies as well. Where the two differ we will follow whichever gives you more protection.
How long we keep it
Account data and content for as long as the account exists. Delete your account and the content goes with it, including from backups as those age out — which takes a few weeks rather than being instant, because backups are written once and expire on a schedule. Access and audit logs are kept for a limited period and then discarded.
Your rights
You can ask for a copy of your data, correct it, delete it, restrict what we do with it, object to processing, or ask for it in a portable form. The product has export and erasure built in, so most of these you can do yourself without asking. For anything else, email hello@sovereignworkspace.org and we will answer within a month.
If you think we have handled your data badly, you can complain to a data protection authority. We would rather you told us first, but that is your right, not a courtesy you owe us.
Controller
Sovereign Workspace - Chris Armstrong10 Bedok Rise, Singapore 469601
hello@sovereignworkspace.org
No data protection officer is appointed. At this size the law does not require one; the address above is the person accountable.
Last updated 2026-08-11.