Privacy Policy

Last updated: October 13, 2026. This policy describes how Kharazm actually works today. It is written in plain English and is not legal advice.

1. Who we are

Kharazm is a program-management and grant-compliance workspace for organizations that receive and pass through grant funding. It is built and operated by Bakaro Art LLC ("we", "us"), the data controller for the information described here. You can reach us at hello@bakaroart.com.

If your organization uses Kharazm at work, your organization decides who joins the workspace and what is recorded in it. For that workspace content we act on your organization's instructions; for account records and service operation we act on our own behalf.

2. What we collect

We practice data minimization: the product stores what it needs to work and nothing more. There are seven categories.

Account information

• Your email address, used to sign in, to receive an invitation, and to reset a password.
• Your display name, so colleagues can see who owns a program or a task.
• Your organization membership and access level — admin, manager, member or viewer.
• A password verifier. We never store your password. We store a scrypt hash with a per-user random salt, which cannot be reversed into the original password.
• Whether and when your email address was confirmed.
• Only if you turn on two-step sign-in: your authenticator secret, encrypted at rest (AES-256-GCM), and your recovery codes, stored only as hashes. Turning two-step sign-in off deletes them.

When a signed-out person requests their first workspace, we keep the submitted email, name, role, workspace name and password verifier in a confirmation record until the emailed link is opened (it expires after 24 hours and is then deleted), and then while an operator reviews the request. The plaintext password is never stored; the verifier is cleared when the request is approved or rejected. An already signed-in user can create an additional workspace without that approval step.

Workspace content you create

Everything you and your colleagues put into Kharazm: programs, portfolios, milestones, tasks and their status, priorities, assignees, due dates and labels, comments, risks, issues and decisions, weekly stakeholder updates including published snapshots, award records, subrecipients and their risk assessments, monitoring events and findings, and evidence links (a title and a web address — Kharazm stores no files). Records carry the names of the colleagues who created them. We treat this as your organization's content. Please do not put information into a program record that does not belong there — Kharazm is not designed to hold health records, financial account numbers, or other special categories of personal data.

Audit records

Every change to workspace records is recorded in a per-organization audit log: who made it (their name as it was at the time), when, a request id, and what changed, including the before and after values. The log is append-only: entries cannot be edited or deleted, and they are removed only when the whole workspace is deleted. Workspace administrators can read it, download it as CSV, and export it with the workspace.

Sign-in activity

For each account we record security events: sign-ins, failed sign-in attempts, two-step sign-in being turned on or off or a code being wrong, password-reset requests and completions, email confirmation, sign-out, and account or workspace deletion. Each record holds the event, the time, a request id and an approximate network — your IP address truncated to its first three parts for IPv4 (a /24 network) or first three groups for IPv6 (a /48) — never the full address. A failed attempt for an address that has no account is recorded without being linked to any account.

We keep this for account security: so you can spot activity that was not you, and so we can investigate abuse. You can see your own recent activity from the account menu, and it is included in your personal-data export. These records are deleted after 13 months.

Server logs

The hosting platform may keep standard operational information such as request paths, timestamps, status codes and source IP addresses. The application writes limited service and error events used to operate the service and investigate failures. It does not write plaintext passwords, message bodies, recipient addresses, session/reset/invitation tokens or actionable links to production application logs.

Billing and subscription records

When a workspace administrator chooses a plan, payment happens on Stripe's hosted Checkout pages. Card or US bank account (ACH) details are entered on Stripe's pages and never reach Kharazm's servers. For each workspace, our own database keeps:

• the Stripe customer and subscription identifiers;
• the plan, billing cycle and subscription status, the end of the current billing period, the trial end date, and when the trial-ending reminder was sent;
• if the small-organization discount was claimed, who declared it and when.

Stripe receives the billing administrator's email address, the workspace's internal identifier, the chosen plan and billing cycle, and whatever payment details are entered on Stripe's own pages. Section 6 says more about Stripe. If your organization asks to pay by invoice instead, we use the billing contact details it gives us to send the invoice.

Template requests

If you ask us to email you a template from the resources pages, we store your email address, which template prompted the request, and when you made it. We then send one email containing the template links, with an unsubscribe link in it. Unsubscribing deletes your address; otherwise we delete it after 24 months. We do not use the address for anything else unless you separately agree. You do not have to give us an address at all: every template is also directly downloadable.

3. Cookies

Kharazm sets one cookie. It is the session cookie that keeps you signed in. There are no advertising cookies, no analytics cookies, and no cross-site identifiers, so there is nothing to opt out of and no consent banner to dismiss.

• httpOnly — scripts in the browser cannot read it.
• SameSite=Lax — it limits cross-site cookie inclusion while still allowing some top-level safe navigations; the application also checks the origin of unsafe requests.
• Secure — in production it only travels over HTTPS.
• 14-day expiry, and it is deleted on the server when you sign out.

The cookie holds an opaque random token. Only a SHA-256 hash of that token is stored on our side, so a database copy does not yield usable sessions.

4. What we do not do

• We do not sell or rent your data. Kharazm has no advertising surface.
• We do not run third-party analytics, trackers, session recorders, heatmaps or ad tech. The application's Content-Security-Policy blocks browser connections to other origins, and the web font is hosted by us rather than fetched from a font network.
• We do not use your workspace content to train machine-learning models, ours or anyone else's.
• We do not currently provide AI or agentic features or send workspace content to a model provider. Those capabilities are a roadmap workstream and will require a separate privacy review before production use.
• We do not build advertising or marketing profiles about you.
• We do not share your content with other organizations. The organization is the security boundary in Kharazm, and that isolation is enforced in code and covered by tests.

5. How we use information

We use the information above only to operate the service:

• To authenticate you and keep you signed in, including two-step sign-in if you turn it on.
• To record sign-in activity so you, and we, can spot and investigate access that should not have happened.
• To show the right programs, awards, tasks, comments and reports to the right people at the right access level, including viewers limited to particular awards.
• When transactional email is configured, to send email-address confirmations, invitations, password resets, approval notices for initial workspace requests, and a reminder to a workspace's administrators a few days before its trial ends.
• To run a paid subscription: to send a workspace administrator to Stripe's Checkout or customer portal, and to record the plan, status and billing period that Stripe reports back; or, where an organization asks to pay by invoice, to send that invoice.
• To send the one email a template request asks for.
• To maintain the audit log your administrators rely on.
• To keep the service secure and available — rate limiting authentication and high-impact write routes, investigating errors, and preventing abuse.
• To answer you when you contact us for support.

Where a legal basis is required, ours is the performance of our agreement with your organization, our legitimate interest in running a secure, working service, and, for a template request, the request you made.

6. Where your data lives, and who touches it

Kharazm runs on a small, deliberately boring infrastructure stack. These four providers are the only ones that process personal data for the service.

Resend receives only what an email needs: the recipient address and the contents of that message. It does not receive your programs, tasks or comments. Email delivery is optional in the product; when it is not configured, invitations are shared as a link instead and no message leaves the deployment.

Stripe is an independent payment processor. Card and bank account details are entered on Stripe's own pages and never reach Kharazm's servers, and Stripe handles them under its own privacy policy and terms. Stripe does not receive your programs, awards or records.

Workspace content — programs, awards and records — is stored and processed in the United States. Application hosting is pinned to the United States, and the database region is enforced in code: Kharazm validates the database connection at start-up against an allowlist of United States regions and a production process refuses to start if a US region cannot be positively proven. A host that cannot be verified is rejected rather than assumed acceptable, so the database cannot be quietly relocated abroad without the service failing to boot.

The exceptions, stated precisely. Billing data is processed by Stripe, which may process it outside the United States under its own terms. Email is handed to Resend and then delivered to the recipient's own mail server, which that recipient controls and may host anywhere — that is inherent to sending email, and it is why email contents, recipient addresses, tokens and actionable links are never written to our logs. And because the site is served over an Anycast network, a visitor outside the United States has their own encrypted request accepted at the network edge nearest to them before it reaches the US machine; stored workspace content remains in the United States either way. We will update this list before adding a new subprocessor.

7. How we protect it

The short version: passwords are hashed asynchronously with scrypt and verified in constant time; two-step sign-in with an authenticator app is available to everyone, with its secret encrypted at rest; sessions are opaque tokens stored only as hashes; writes are checked server-side against the actor's role taken from the session, never from the request; HTTPS is enforced with HSTS; and a strict Content-Security-Policy plus same-origin guards defend the browser surface. Authentication and workspace write inputs are schema-validated. In particular, all 39 supported domain writes use a strict, operation-specific Zod schema for IDs, enums, ISO dates, text lengths and arrays, and reject unknown keys.

We are also honest about what we have not done. There has been no third-party penetration test, an organization cannot yet require two-step sign-in of its members, and off-box point-in-time backups depend on the database plan in use. The full write-up, including the current gaps, is on our security and privacy page.

No system is perfectly secure. If you find a problem, email hello@bakaroart.com rather than opening a public issue.

8. Retention and deletion

Workspace content, account records and audit entries persist for as long as the workspace exists, unless a record is deleted where the application allows it, because a program record is only useful if last quarter's history is still there. On API traffic, the server runs cleanup at most once an hour: expired sessions, password-reset records, two-step sign-in attempts and email-confirmation links are removed, sign-in activity older than 13 months is removed, first-workspace request records older than 30 days are removed, and expired invitations are removed 30 days after expiry. This is limited cleanup, not a configurable retention policy or legal hold for program content or audit history. Operational-log and backup retention depends on the provider configuration; ask for the current setting before relying on a contractual period.

Nothing is deleted or hidden for non-payment. If a trial ends without a plan, or a paid plan ends, the workspace stays readable and its records can still be viewed and exported; adding or changing records requires an active plan. A workspace's billing record in our database is kept for as long as the workspace exists and is removed with it. Stripe keeps its own records of customers, subscriptions, invoices and payments under its own terms. Template-request addresses are deleted when you unsubscribe, and otherwise after 24 months.

Deleting an account or a workspace

You can delete your own account from the account menu, with your password. Your sign-in, your workspace memberships and your sessions are removed, and your profile name is replaced with "Deleted account". The records you created — tasks, comments, monitoring entries and so on — stay in each workspace, because the workspace belongs to the organization; they are shown as made by "Deleted account". Two kinds of record keep the name as it was recorded at the time: audit-log entries and published updates, which are frozen records. Your sign-in activity is kept until it ages out after 13 months. Deletion is refused while you are the last admin of a workspace others still use, or its only member, so a workspace is never left without an owner by accident.

A workspace administrator can delete the whole workspace, with their password and by typing the workspace's name. Everything in it is removed, including its audit log.

When an administrator removes someone from a workspace, that person's name stays on the records they created there. If it was their last workspace, they can no longer sign in.

Deleted records are removed from the live database. Copies may remain in routine database backups for a limited period until those backups age out.

9. Your choices and your rights

Depending on where you live you may have rights to access, correct, export, restrict, or delete personal data about you, and to object to certain processing. Regardless of where you live, we will honor these requests:

• Access — download the personal data Kharazm holds about you (profile, account, memberships, comments, sessions and sign-in activity) from the account menu, or ask us.
• Correction — ask a workspace administrator to correct your per-workspace role or reporting line, or ask us to correct account information. A workspace administrator cannot change another account holder's display name, and a general self-service profile editor is not available today.
• Export — download your personal data yourself, as above. A workspace administrator can export the organization's whole workspace as JSON.
• Deletion — delete your account yourself, as section 8 describes. A workspace administrator can delete the whole workspace.

For anything the app does not let you do yourself, write to hello@bakaroart.com. We will verify that the request genuinely comes from you or from an administrator of the workspace before we act, and we aim to respond within 30 days. There is no charge for a reasonable request. If your organization administers your workspace, we may need to refer parts of your request to them, and we will tell you if we do.

10. GDPR notice (European Economic Area, United Kingdom and Switzerland)

Where the General Data Protection Regulation applies, this section states the specifics that regulation requires. Kharazm is operated by Bakaro Art LLC, and for account information we hold about you directly we act as the controller. For the content inside a workspace — programs, awards, subrecipients, monitoring records, comments — your organization is the controller and we act as a processor on its instructions.

Our lawful bases are: contract, for creating and operating your account and workspace, running a paid subscription, and sending a template you asked for; legitimate interests, for keeping the service secure, recording sign-in activity, preventing abuse and maintaining the audit log that the product exists to provide, balanced against your interest in not being profiled — we do not profile you, run behavioural advertising or make automated decisions with legal or similarly significant effects; and legal obligation where we must retain something to comply with law.

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with your supervisory authority. You can exercise access, portability and erasure yourself in the app, as section 9 describes; for anything else, write to hello@bakaroart.com, and the process and the 30-day target in section 9 apply.

International transfers. Kharazm is hosted in the United States, where workspace content is stored and processed, so using the service from the EEA, the UK or Switzerland involves a transfer to the United States. Billing data is processed by Stripe, which may process it in other countries under its own terms, as section 6 describes. Where that transfer requires a safeguard, we rely on the European Commission's Standard Contractual Clauses together with the UK Addendum, and we will enter into a data processing agreement incorporating them on request. Ask us and we will send one; we do not require you to negotiate for it.

We do not appoint an EU or UK representative today, because our processing does not currently meet the threshold that requires one. If that changes we will name the representative on this page before it does.

11. CCPA/CPRA notice (California)

Under the California Consumer Privacy Act as amended by the CPRA, California residents have the right to know what personal information is collected and how it is used, to access and delete it, to correct inaccuracies, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of these rights.

The categories we collect are identifiers (name, email address, and the email address on a template request), professional information (your role and reporting line within a workspace), commercial information (the plan a workspace subscribes to, its billing cycle, status and billing period, and any small-organization discount declaration), and internet activity limited to server-side operational logs and the sign-in activity log (event, time and an approximate network, not a full IP address). We collect them to provide and secure the service, as described in section 5. We do not collect sensitive personal information as that term is defined — card and bank account details are entered on Stripe's pages and do not reach us — and we do not collect biometric, geolocation or precise-location data.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We never have. There is no advertising network, no data broker and no analytics vendor in this product, so there is nothing to opt out of — but you may still exercise every other right by writing to hello@bakaroart.com. Making a request will not degrade your service or change your price.

You may use an authorized agent. We will verify the agent's authority and your identity before acting, as section 9 describes.

12. Children

Kharazm is a workplace tool for organizational program teams. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has created an account, tell us at hello@bakaroart.com and we will delete it.

13. Changes to this policy

If we change how we handle data, we will update this page and move the "last updated" date. For a change that meaningfully affects you — a new subprocessor, a new category of data, a new purpose — we will notify workspace administrators by email before it takes effect. Previous practice is not retroactively changed by a new policy.

14. Contact us

Questions about this policy, a data request, or a procurement questionnaire that needs a written answer: email hello@bakaroart.com. A person reads it. You can also use our contact page.

Bakaro Art LLC, the operator of Kharazm and the publisher of this policy.