Privacy Policy

1. Who We Are

Bardo (the “service”) is operated by [To be confirmed before launch: legal name of the operator], [To be confirmed before launch: business address of the operator] (“we”, “us”). This policy explains what information we collect when you use the service, why, who processes it for us, how long it is kept and what choices you have. It should be read with the Terms of Service and the Billing page.

Today the service is a Markdown workspace. AI features (the “Storyteller”) are not enabled in the service, so your content is not sent to any AI model provider. Section 10 explains what would change if and when AI features are offered.

2. What We Collect

Account information

When you create an account or sign in, our authentication provider, Clerk, collects and stores your account details: your email address, your sign-in credentials or, if you sign in with Google or Discord, the basic profile information that provider shares (such as your name, email address and profile picture), and records of your sign-in sessions. Our application database does not store your name or email address; it identifies you by an opaque account identifier issued by Clerk.

Your content

The projects, folders and notes you create (“your content”), including their names, their text and their version history, are stored so the service can save them, show them back to you, search them and let you restore earlier versions.

Payment information

None. The service is free during the beta: we do not take payments and no payment card details are asked for or collected. The service contains a subscription system, built on Clerk Billing and Stripe, that is switched off. If a paid plan is introduced, this policy will be updated first to say what is collected and who processes payments.

Technical and usage information

• Connection data. Like any website, the servers of the providers that host and run the service necessarily receive the IP address of your connection and standard browser information (such as browser type and version) with each request.
• Page visits and speed. On the live site only, which pages are opened, as generic page names, and how quickly they load (section 6 and section 7).
• Error reports. On the live site only, a technical report when something breaks, reduced as described in section 7.
• Service records. Counters used to apply usage limits (for example how quickly an account creates projects or changes files), linked to your account identifier and holding no content.

What we do not collect

• We do not include the text or names of your projects, folders or notes in analytics or error reports.
• We do not record your screen, keystrokes or mouse movements, and we do not use session replay.
• We do not use advertising cookies or advertising trackers.
• We do not sell your personal information.

3. Why We Use It

• To provide the service: signing you in, storing and showing your content, keeping version history and running search.
• To keep the service secure and fair: preventing abuse and applying usage limits.
• To find and fix problems and understand, in aggregate, which parts of the service are used: analytics and error reports.
• To communicate with you about your account, the service and changes to these documents.
• To comply with the law and enforce our terms.

We do not read your content to profile you or for advertising. We access your content only where needed to operate, secure or fix the service, to respond to a request from you, or where the law requires it.

4. Service Providers

We use the following providers to run the service. Each receives only what is described here and handles it under its own terms and privacy documentation.

• Clerk (authentication and accounts). Receives your account information and your sign-in sessions.
• Google and Discord (optional sign-in). If you choose to sign in with one of them, that provider learns that you signed in to Bardo and shares basic profile information with Clerk.
• Convex (application database). Stores your content, its version history, your account identifier and the service records described above.
• Vercel (website hosting; Vercel Web Analytics and Vercel Speed Insights on the live site). Serves the service to your browser and receives the connection data of your requests, and the page-visit and speed measurements described in section 6.
• Sentry (error monitoring, live site only). Receives the reduced error reports described in section 7.
• PostHog (product analytics, live site only). Receives the content-free events described in section 6.

We may also disclose information where the law requires it, to protect the rights and safety of people or the service, or to a successor if the service is transferred, in which case this policy continues to apply to the information transferred.

Where information is processed: [To be confirmed before launch: data-processing locations and international-transfer wording for each provider]

5. Cookies and Storage on Your Device

• Authentication cookies. Clerk sets cookies that keep you signed in and protect the sign-in process. The service cannot work without them.
• Analytics identifier (live site only). Product analytics keep an identifier in your browser’s local storage, not in a cookie. It is reset when you sign out. Test and preview versions of the site do not start analytics and remove any such identifier left in the browser.
• Appearance preference. Your light or dark theme choice is kept in your browser’s local storage.
• Unsent drafts. While you type, text that has not yet been saved to our servers is kept in your browser’s local storage so that it is not lost if the connection drops or the page closes. Drafts are stored on your device as plain text, without encryption. A draft is removed once its text is saved or you discard it, except that a copy left by another tab or an earlier visit stays on the device until you discard it. Drafts are deliberately not removed when you sign out, so that unsaved text is not lost. This means that anyone who uses the same browser profile on the same device could read them. On a shared or public computer, make sure your work shows as saved and discard any leftover drafts, or clear the site’s data in the browser, before you leave.

[To be confirmed before launch: whether a cookie-consent banner is required for analytics in the regions served]

6. Analytics

Analytics run only on the live site. They are not started on test or preview versions or in development.

Product analytics (PostHog)

• What is sent. A fixed list of events and nothing else. In the service as offered today that is a page view carrying a generic page name (a project page is reported as “/projects/[id]”, never its real address, and anything after a “?” or “#” is removed), and an event with no details when a project of the campaign kind is created or deleted. The list also contains events that would apply only to AI campaign features if and when they are offered (for example the kind of an action, such as “move” or “speak”). The analytics library attaches standard technical properties such as browser, operating system, device type and screen size; address-type properties, including the referring page, are reduced to the site and a generic page name before they leave your browser.
• How you are identified. When you are signed in, events are linked to your opaque Clerk account identifier. We do not send your email address or name to PostHog. Signed-out visitors are counted under a random identifier.
• What is switched off. Automatic capture of clicks and form input, session recording and surveys are disabled.
• Do Not Track. If your browser sends a “Do Not Track” signal, product analytics are not sent.

Page visits and speed (Vercel)

• What we send. Only that a page was opened, as the site address plus a generic page name, and, for Speed Insights, loading-speed figures. Pages we do not recognise are not reported. No project, folder or note name or identifier is included, and we send no custom events.
• What Vercel records itself. Our filter cannot remove what Vercel’s own measurement collects when your browser contacts it, such as an approximate location derived from your IP address, your device type, operating system and browser, and the referrer. Vercel describes its Web Analytics as working without cookies; we rely on its description, which Vercel can change. See Vercel’s own privacy documentation.
• Not linked to your account. We do not give Vercel your email address, name or account identifier for these measurements.

7. Error Monitoring (Sentry)

Error monitoring runs only on the live site. Before a report leaves your browser or our server it is reduced to what is needed to locate a fault:

• Kept. The type of error, the application’s own error codes, the stack trace (file names, function names and line numbers of our code), the generic page name, the version of the service, and the name and version of your browser, operating system and device type. If performance sampling is switched on, timing figures for page loads and requests are sent, reduced in the same way.
• Removed. Error message text is replaced by error codes or a fixed “[redacted]” marker, because messages could quote what you typed. User details, cookies, request headers and bodies, query strings and server names are removed, and the trail of earlier actions keeps only the category and time of each step. Reports therefore do not contain the contents or names of your files.
• Switched off. We do not send your account identifier, email address or name with error reports, the error-reporting library is configured not to ask Sentry to record your IP address, and session replay is disabled.

8. Retention and Deletion

• While you have an account. Your content and its version history are kept until you delete them or delete your account.
• Deleting files and projects. You can delete a file, a folder or a project. Deletion is permanent: the item and its version history are removed from the application database and cannot be restored. Large deletions are completed by a background job, so removal may take a short time to finish.
• Deleting your account. You delete your account from Account → Billing → “Delete account”. Clerk removes your account information and a background job removes the application data your account owns, which is every project with its folders, notes and version history. The job is resumable, so removal is not instantaneous, and from the moment it starts the account can no longer be used to create anything.
• What is kept after account deletion. A small number of records that contain no content are kept, linked to your opaque account identifier (not your name or email address): a marker that the account was deleted, which stops it being used again; usage-limit counters, which expire on their own; and, only if AI features were ever used on the account, usage and cost accounting records. These are kept to keep accounts and costs accountable. How long: [To be confirmed before launch: retention period for content-free accounting records]
• Backups. Operational backups and exports of the database made before a deletion may still contain the deleted content until they expire. We therefore do not promise that deleted content disappears from every system immediately. Backup period: [To be confirmed before launch: backup retention period]
• Analytics and error reports. These hold content-free events and, for analytics, your opaque account identifier. They are not removed automatically when you delete your account; we remove them on request.
• Drafts on your device. Drafts in your browser’s storage (section 5) are outside our systems. Deleting your account does not remove them; discard them in the editor or clear the site’s data in your browser.

9. Your Choices and Requests

• You can read, edit, copy out and delete your content in the service, and you can delete your account from Account → Billing → “Delete account”.
• You can update your account details in your account settings.
• You can turn on your browser’s “Do Not Track” signal to stop product analytics, and your browser or its extensions may block the measurement tools entirely; the service works without them.
• You can ask us for a copy of the personal information we hold about you, to correct it, or to delete it, including the records described in section 8 that are not removed automatically. Depending on where you live, you may have further rights under your local law. We will respond as that law requires. Contact: [To be confirmed before launch: support contact email]

10. AI Features, If and When Offered

AI features are not enabled in the service today. If and when they are offered, providing them would require sending the text needed for a request to AI model providers. Before that happens we will update this policy to name those providers and describe what they receive and how it is used.

11. Children

[To be confirmed before launch: minimum age, and whether people under 18 may use Bardo] If you believe that a child has given us personal information without the consent the law requires, contact us and we will delete it.

12. Security

We take reasonable measures to protect the information we hold, and access to your content is restricted to your account. No online service can promise perfect security, and you are responsible for keeping your sign-in details and your device secure.

13. Changes to This Policy

We may update this policy. When we do, we will change the effective date above, and if a change is material we will give reasonable advance notice in the service or by email.

14. Contact

Questions or requests about privacy: [To be confirmed before launch: support contact email]