Legal
Privacy Policy
Kharazm is a workspace for program work, not an advertising product. We collect the information the service needs to run, keep it within the infrastructure disclosed below, and do not sell it, rent it, or use it to train models.
1
Cookie, and it is the session cookie
0
Analytics, trackers or ad scripts
3
Infrastructure subprocessors
14 days
Session cookie expiry
Last updated: July 26, 2026. This policy describes how Kharazm actually works today. It is written in plain English and is not legal advice.
1. Who we are
Kharazm is a focused program-management platform for teams accountable for complex programs. It is built and operated by Bakaro Art LLC ("we", "us"), the data controller for the information described here. You can reach us at hello@bakaroart.com.
If your organization uses Kharazm at work, your organization decides who joins the workspace and what is recorded in it. For that workspace content we act on your organization's instructions; for account records and service operation we act on our own behalf.
2. What we collect
We practice data minimization: the product stores what it needs to work and nothing more. There are four categories.
Account information
- Your email address, used to sign in, to receive an invitation, and to reset a password.
- Your display name, so colleagues can see who owns a program or a task.
- Your organization membership and access level — admin, manager, member or viewer.
- A password verifier. We never store your password. We store a scrypt hash with a per-user random salt, which cannot be reversed into the original password.
When a signed-out person requests their first workspace, we also keep the submitted email, name, role, workspace name and password verifier while an operator reviews the request. The plaintext password is never stored; the verifier is cleared when the request is approved or rejected. An already signed-in user can create an additional workspace without that approval step.
Workspace content you create
Everything you and your colleagues put into Kharazm: programs, portfolios, milestones, tasks and their status, priorities, assignees, due dates and labels, comments, risks and issues, and weekly stakeholder updates including published snapshots. We treat this as your organization's content. Please do not put information into a program record that does not belong there — Kharazm is not designed to hold health records, financial account numbers, or other special categories of personal data.
Audit records
Most actions that create, change or delete workspace records are recorded in a per-organization audit log with the actor, action, summary and time. Workspace administrators can read that log. Autosaving an update draft is not logged as a separate audit event. The log supports governance review, but it is not a field-by-field version history.
Server logs
The hosting platform may keep standard operational information such as request paths, timestamps, status codes and source IP addresses. The application writes limited service and error events used to operate the service and investigate failures. It does not write plaintext passwords, message bodies, recipient addresses, session/reset/invitation tokens or actionable links to production application logs.
3. Cookies
Kharazm sets one cookie. It is the session cookie that keeps you signed in. There are no advertising cookies, no analytics cookies, and no cross-site identifiers, so there is nothing to opt out of and no consent banner to dismiss.
- httpOnly — scripts in the browser cannot read it.
- SameSite=Lax — it limits cross-site cookie inclusion while still allowing some top-level safe navigations; the application also checks the origin of unsafe requests.
- Secure — in production it only travels over HTTPS.
- 14-day expiry, and it is deleted on the server when you sign out.
The cookie holds an opaque random token. Only a SHA-256 hash of that token is stored on our side, so a database copy does not yield usable sessions.
4. What we do not do
- We do not sell or rent your data. Kharazm has no advertising surface.
- We do not run third-party analytics, trackers, session recorders, heatmaps or ad tech. The application's Content-Security-Policy blocks browser connections to other origins, and the web font is hosted by us rather than fetched from a font network.
- We do not use your workspace content to train machine-learning models, ours or anyone else's.
- We do not currently provide AI or agentic features or send workspace content to a model provider. Those capabilities are a roadmap workstream and will require a separate privacy review before production use.
- We do not build advertising or marketing profiles about you.
- We do not share your content with other organizations. The organization is the security boundary in Kharazm, and that isolation is enforced in code and covered by tests.
5. How we use information
We use the information above only to operate the service:
- To authenticate you and keep you signed in.
- To show the right programs, tasks, comments and reports to the right people at the right access level.
- When transactional email is configured, to send invitations, password resets, and approval notices for initial workspace requests.
- To maintain the audit log your administrators rely on.
- To keep the service secure and available — rate limiting authentication and high-impact write routes, investigating errors, and preventing abuse.
- To answer you when you contact us for support.
Where a legal basis is required, ours is the performance of our agreement with your organization and our legitimate interest in running a secure, working service.
6. Where your data lives, and who touches it
Kharazm runs on a small, deliberately boring infrastructure stack. These are our only subprocessors.
| Provider | What it does | Location |
|---|---|---|
| Fly.io | Application hosting — runs the Kharazm server and holds operational logs | United States (San Jose, California) |
| Neon | Managed PostgreSQL database — stores accounts and workspace content | Managed account region; confirm in writing for residency requirements |
| Resend | Transactional email only — password resets, invitations, approval notices | Provider processing locations; confirm in the applicable agreement |
Resend receives only what an email needs: the recipient address and the contents of that message. It does not receive your programs, tasks or comments. Email delivery is optional in the product; when it is not configured, invitations are shared as a link instead and no message leaves the deployment.
The application host is configured in the United States. The current repository does not independently prove the live managed-database region or every email-processing location, so do not rely on this page alone for a contractual residency requirement; ask us for written provider confirmation. We will update this list before adding a new subprocessor.
7. How we protect it
The short version: passwords are hashed asynchronously with scrypt and verified in constant time; sessions are opaque tokens stored only as hashes; writes are checked server-side against the actor's role taken from the session, never from the request; HTTPS is enforced with HSTS; and a strict Content-Security-Policy plus same-origin guards defend the browser surface. Authentication and workspace write inputs are schema-validated. In particular, all 27 supported domain writes use a strict, operation-specific Zod schema for IDs, enums, ISO dates, text lengths and arrays, and reject unknown keys.
We are also honest about what we have not done. There has been no third-party penetration test, and off-box point-in-time backups depend on the database plan in use. The full write-up, including the current gaps, is on our security and privacy page.
No system is perfectly secure. If you find a problem, email hello@bakaroart.com rather than opening a public issue.
8. Retention and deletion
Workspace content, account records and audit entries persist for as long as the workspace exists, because a program hub is only useful if last quarter's history is still there. On API traffic, the server runs authentication-record cleanup at most once an hour: expired sessions and password-reset records are removed, first-workspace request records older than 30 days are removed, and expired invitations are removed 30 days after expiry. This is limited cleanup, not configurable retention for program content or audit history. Operational-log and backup retention depends on the provider configuration; ask for the current setting before relying on a contractual period.
A gap we want you to know about. Self-serve account and organization deletion is not yet available in the product's interface. Today, deletion is performed by us at the database level on request. Email hello@bakaroart.com from the address on the account (or, for a whole workspace, from an administrator of that workspace) and we will confirm the request and carry it out. Building self-serve deletion is on the roadmap.
When we delete an account or an organization, the associated records are removed from the live database. Copies may remain in routine database backups for a limited period until those backups age out.
9. Your choices and your rights
Depending on where you live you may have rights to access, correct, export, restrict, or delete personal data about you, and to object to certain processing. Regardless of where you live, we will honor these requests:
- Access — ask us what account information we hold about you.
- Correction — ask a workspace administrator to correct your per-workspace role or reporting line, or ask us to correct account information. A workspace administrator cannot change another account holder's display name, and a general self-service profile editor is not available today.
- Export — ask for a copy of your account record and your organization's workspace content.
- Deletion — ask us to delete your account, or ask an administrator to request deletion of the whole workspace.
Write to hello@bakaroart.com. We will verify that the request genuinely comes from you or from an administrator of the workspace before we act, and we aim to respond within 30 days. There is no charge for a reasonable request. If your organization administers your workspace, we may need to refer parts of your request to them, and we will tell you if we do.
10. Children
Kharazm is a workplace tool for organizational program teams. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has created an account, tell us at hello@bakaroart.com and we will delete it.
11. Changes to this policy
If we change how we handle data, we will update this page and move the "last updated" date. For a change that meaningfully affects you — a new subprocessor, a new category of data, a new purpose — we will notify workspace administrators by email before it takes effect. Previous practice is not retroactively changed by a new policy.
12. Contact us
Questions about this policy, a data request, or a procurement questionnaire that needs a written answer: email hello@bakaroart.com. A person reads it. You can also use our contact page.
Bakaro Art LLC, the operator of Kharazm and the publisher of this policy.
This page describes our current practice in plain English so that a program team can understand it without a lawyer. It is not legal advice, and it does not replace whatever data-processing agreement or procurement terms your organization requires. If you need those, write to us and we will work through them with you.
Still have a question about your data?
We would rather answer a specific question than have you guess from a policy page. Ask us anything about how Kharazm stores, protects or deletes your organization's information.