Privacy — Genba Studio

Draft — early access Written against the code that stores it. If a column is added, this page changes with it.

This service holds an account, not a workspace. Your shows, rundowns, graphics and recordings never reach it — they stay on your own machines. What follows is the complete list of what does reach it.

What is stored

Your account name. You choose it, and it can be anything — it is not required to be your real name.
Your password, hashed with argon2id. The password itself is never stored and cannot be recovered from the hash, which is why a forgotten password is reset rather than looked up.
An email address, if you give one. It is optional, and it is used for exactly one thing: sending a password-reset link you asked for. No newsletter, no notices, no product mail. You can remove it from your account page at any time.
The machines you link. The machine identifier your install reports, a label you chose, its operating system, its public key and when it was last seen.
A security audit log. Sign-ins, sign-in refusals, device approvals and revocations, password changes, second-factor changes and download grants — each with a timestamp and the IP address the request came from. It is what lets you and an administrator answer "who approved this machine, and when".
Your downloads. Which build, which account, when. Recorded once per download, not per network request.
Ordinary web-server logs on the machine that serves this site: address, time, path, status, user agent.

What is not stored, and not done

No trackers, no analytics, no advertising identifiers, no pixels.
No third-party requests of any kind. Every font, image and stylesheet on this site is served from this site — open the page with the network panel on and you will see nothing leave.
No cookie is set while you read. The first one arrives when you open a sign-in or sign-up form: a short-lived anti-forgery value that makes the form's own submission verifiable. Signing in adds a session cookie, and signing out removes it.
Nothing is sold, shared, rented or handed to anyone. There is no third party to hand it to.
Your production content is not collected — not clips, not scripts, not recordings, not the names of your guests.

How long it is kept

Sign-in sessions expire after twelve hours. A half-finished sign-in lasts five minutes, a device-link code ten, and a password-reset link thirty — all four are deleted the moment they lapse, not archived.

Your account, your linked machines and the security audit log are kept for as long as the account exists. The audit log is not pruned today; if a retention window is set, the number will be written on this page rather than announced somewhere else.

Getting an account removed

There is no self-serve delete button yet, and saying otherwise would be the easy lie. Today an administrator disables the account — it can no longer sign in, and its machines lose their credentials. The row and its audit history stay until a delete verb exists, which is honest work still owed.

To ask: sign in and use the request form, which reaches a person directly. During early access that is the same person who granted your access.

Where it lives

One server, one file. The account database is a single SQLite file on the machine that serves this site, and there is no second copy anywhere else — no analytics warehouse, no customer-data platform, no backup at a vendor. Secrets in it are encrypted at rest with a key held on that same machine.

Changes