Privacy Policy

Last updated: July 26, 2026. This policy describes how Kharazm actually works today. It is written in plain English and is not legal advice.

1. Who we are

Kharazm is a focused program-management platform for teams accountable for complex programs. It is built and operated by Bakaro Art LLC ("we", "us"), the data controller for the information described here. You can reach us at hello@bakaroart.com.

If your organization uses Kharazm at work, your organization decides who joins the workspace and what is recorded in it. For that workspace content we act on your organization's instructions; for account records and service operation we act on our own behalf.

2. What we collect

We practice data minimization: the product stores what it needs to work and nothing more. There are four categories.

Account information

• Your email address, used to sign in, to receive an invitation, and to reset a password.
• Your display name, so colleagues can see who owns a program or a task.
• Your organization membership and access level — admin, manager, member or viewer.
• A password verifier. We never store your password. We store a scrypt hash with a per-user random salt, which cannot be reversed into the original password.

When a signed-out person requests their first workspace, we also keep the submitted email, name, role, workspace name and password verifier while an operator reviews the request. The plaintext password is never stored; the verifier is cleared when the request is approved or rejected. An already signed-in user can create an additional workspace without that approval step.

Workspace content you create

Everything you and your colleagues put into Kharazm: programs, portfolios, milestones, tasks and their status, priorities, assignees, due dates and labels, comments, risks and issues, and weekly stakeholder updates including published snapshots. We treat this as your organization's content. Please do not put information into a program record that does not belong there — Kharazm is not designed to hold health records, financial account numbers, or other special categories of personal data.

Audit records

Most actions that create, change or delete workspace records are recorded in a per-organization audit log with the actor, action, summary and time. Workspace administrators can read that log. Autosaving an update draft is not logged as a separate audit event. The log supports governance review, but it is not a field-by-field version history.

Server logs

The hosting platform may keep standard operational information such as request paths, timestamps, status codes and source IP addresses. The application writes limited service and error events used to operate the service and investigate failures. It does not write plaintext passwords, message bodies, recipient addresses, session/reset/invitation tokens or actionable links to production application logs.

3. Cookies

Kharazm sets one cookie. It is the session cookie that keeps you signed in. There are no advertising cookies, no analytics cookies, and no cross-site identifiers, so there is nothing to opt out of and no consent banner to dismiss.

• httpOnly — scripts in the browser cannot read it.
• SameSite=Lax — it limits cross-site cookie inclusion while still allowing some top-level safe navigations; the application also checks the origin of unsafe requests.
• Secure — in production it only travels over HTTPS.
• 14-day expiry, and it is deleted on the server when you sign out.

The cookie holds an opaque random token. Only a SHA-256 hash of that token is stored on our side, so a database copy does not yield usable sessions.

4. What we do not do

• We do not sell or rent your data. Kharazm has no advertising surface.
• We do not run third-party analytics, trackers, session recorders, heatmaps or ad tech. The application's Content-Security-Policy blocks browser connections to other origins, and the web font is hosted by us rather than fetched from a font network.
• We do not use your workspace content to train machine-learning models, ours or anyone else's.
• We do not currently provide AI or agentic features or send workspace content to a model provider. Those capabilities are a roadmap workstream and will require a separate privacy review before production use.
• We do not build advertising or marketing profiles about you.
• We do not share your content with other organizations. The organization is the security boundary in Kharazm, and that isolation is enforced in code and covered by tests.

5. How we use information

We use the information above only to operate the service:

• To authenticate you and keep you signed in.
• To show the right programs, tasks, comments and reports to the right people at the right access level.
• When transactional email is configured, to send invitations, password resets, and approval notices for initial workspace requests.
• To maintain the audit log your administrators rely on.
• To keep the service secure and available — rate limiting authentication and high-impact write routes, investigating errors, and preventing abuse.
• To answer you when you contact us for support.

Where a legal basis is required, ours is the performance of our agreement with your organization and our legitimate interest in running a secure, working service.

6. Where your data lives, and who touches it

Kharazm runs on a small, deliberately boring infrastructure stack. These are our only subprocessors.

Resend receives only what an email needs: the recipient address and the contents of that message. It does not receive your programs, tasks or comments. Email delivery is optional in the product; when it is not configured, invitations are shared as a link instead and no message leaves the deployment.

Your data never leaves US servers. Application hosting is pinned to the United States, and the database region is enforced in code: Kharazm validates the database connection at start-up against an allowlist of United States regions and a production process refuses to start if a US region cannot be positively proven. A host that cannot be verified is rejected rather than assumed acceptable, so the database cannot be quietly relocated abroad without the service failing to boot.

Two boundaries stated precisely. Because the site is served over an Anycast network, a visitor outside the United States has their own encrypted request accepted at the network edge nearest to them before it reaches the US machine; stored workspace content remains in the United States either way. And transactional email is delivered to the recipient's own mail server, which that recipient controls and may host anywhere — that is inherent to sending email, and it is why email contents, recipient addresses, tokens and actionable links are never written to our logs. We will update this list before adding a new subprocessor.

7. How we protect it

The short version: passwords are hashed asynchronously with scrypt and verified in constant time; sessions are opaque tokens stored only as hashes; writes are checked server-side against the actor's role taken from the session, never from the request; HTTPS is enforced with HSTS; and a strict Content-Security-Policy plus same-origin guards defend the browser surface. Authentication and workspace write inputs are schema-validated. In particular, all 37 supported domain writes use a strict, operation-specific Zod schema for IDs, enums, ISO dates, text lengths and arrays, and reject unknown keys.

We are also honest about what we have not done. There has been no third-party penetration test, and off-box point-in-time backups depend on the database plan in use. The full write-up, including the current gaps, is on our security and privacy page.

No system is perfectly secure. If you find a problem, email hello@bakaroart.com rather than opening a public issue.

8. Retention and deletion

Workspace content, account records and audit entries persist for as long as the workspace exists, because a program hub is only useful if last quarter's history is still there. On API traffic, the server runs authentication-record cleanup at most once an hour: expired sessions and password-reset records are removed, first-workspace request records older than 30 days are removed, and expired invitations are removed 30 days after expiry. This is limited cleanup, not configurable retention for program content or audit history. Operational-log and backup retention depends on the provider configuration; ask for the current setting before relying on a contractual period.

When we delete an account or an organization, the associated records are removed from the live database. Copies may remain in routine database backups for a limited period until those backups age out.

9. Your choices and your rights

Depending on where you live you may have rights to access, correct, export, restrict, or delete personal data about you, and to object to certain processing. Regardless of where you live, we will honor these requests:

• Access — ask us what account information we hold about you.
• Correction — ask a workspace administrator to correct your per-workspace role or reporting line, or ask us to correct account information. A workspace administrator cannot change another account holder's display name, and a general self-service profile editor is not available today.
• Export — ask for a copy of your account record and your organization's workspace content.
• Deletion — ask us to delete your account, or ask an administrator to request deletion of the whole workspace.

Write to hello@bakaroart.com. We will verify that the request genuinely comes from you or from an administrator of the workspace before we act, and we aim to respond within 30 days. There is no charge for a reasonable request. If your organization administers your workspace, we may need to refer parts of your request to them, and we will tell you if we do.

10. GDPR notice (European Economic Area, United Kingdom and Switzerland)

Where the General Data Protection Regulation applies, this section states the specifics that regulation requires. Kharazm is operated by Bakaro Art LLC, and for account information we hold about you directly we act as the controller. For the content inside a workspace — programs, awards, subrecipients, monitoring records, comments — your organization is the controller and we act as a processor on its instructions.

Our lawful bases are: contract, for creating and operating your account and workspace; legitimate interests, for keeping the service secure, preventing abuse and maintaining the audit log that the product exists to provide, balanced against your interest in not being profiled — we do not profile you, run behavioural advertising or make automated decisions with legal or similarly significant effects; and legal obligation where we must retain something to comply with law.

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with your supervisory authority. Exercise them by writing to hello@bakaroart.com; the process and the 30-day target in section 9 apply.

International transfers. Kharazm is hosted in the United States and your data never leaves US servers, so using the service from the EEA, the UK or Switzerland involves a transfer to the United States. Where that transfer requires a safeguard, we rely on the European Commission's Standard Contractual Clauses together with the UK Addendum, and we will enter into a data processing agreement incorporating them on request. Ask us and we will send one; we do not require you to negotiate for it.

We do not appoint an EU or UK representative today, because our processing does not currently meet the threshold that requires one. If that changes we will name the representative on this page before it does.

11. CCPA/CPRA notice (California)

Under the California Consumer Privacy Act as amended by the CPRA, California residents have the right to know what personal information is collected and how it is used, to access and delete it, to correct inaccuracies, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of these rights.

The categories we collect are identifiers (name, email address), professional information (your role and reporting line within a workspace), and internet activity limited to server-side operational logs. We collect them to provide and secure the service, as described in section 5. We do not collect sensitive personal information as that term is defined, and we do not collect biometric, geolocation or precise-location data.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We never have. There is no advertising network, no data broker and no analytics vendor in this product, so there is nothing to opt out of — but you may still exercise every other right by writing to hello@bakaroart.com. Making a request will not degrade your service or change your price.

You may use an authorized agent. We will verify the agent's authority and your identity before acting, as section 9 describes.

12. Children

Kharazm is a workplace tool for organizational program teams. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has created an account, tell us at hello@bakaroart.com and we will delete it.

13. Changes to this policy

If we change how we handle data, we will update this page and move the "last updated" date. For a change that meaningfully affects you — a new subprocessor, a new category of data, a new purpose — we will notify workspace administrators by email before it takes effect. Previous practice is not retroactively changed by a new policy.

14. Contact us

Questions about this policy, a data request, or a procurement questionnaire that needs a written answer: email hello@bakaroart.com. A person reads it. You can also use our contact page.

Bakaro Art LLC, the operator of Kharazm and the publisher of this policy.