Privacy

Last updated 2026-05-25

phacilitate is a small workspace app for support group facilitators. We try to collect as little as possible and to be plain about what happens with what we do collect. If anything below is unclear, please get in touch.

What we collect

• Your email address. Sign-in is handled by Cloudflare Access, which verifies your email via a one-time code or your single sign-on provider (Google, etc.). We see the email address that signs in.
• Your DocPaqs. The content you create — tabs, notes, shared recipients — is stored in Cloudflare Workers KV, keyed to your email address.
• Images you upload. Images embedded in your DocPaqs are stored in a private Cloudflare R2 bucket and served back to you behind the same Access gate.
• Server logs. Cloudflare records standard request logs (IP address, user agent, timestamp, response code) for the protected endpoints. These are kept by Cloudflare per their retention policy and are used only to operate the service and respond to abuse.

What we don't do

• No third-party analytics, tracking pixels, or advertising.
• No selling, renting, or sharing your data with anyone.
• No reading of your DocPaqs or notes for any purpose.
• No newsletter list — we don't email you unless you've emailed us first.

Notes are special

The per-DocPaq notes drawer is intended for confidential meeting notes. Notes are stored on the server like everything else, but you can enable auto-shred so notes are wiped from the server when the session timer ends or when you sign out. Notes are also never routed to a DocPaq owner when you have edit access to a shared DocPaq — your notes stay yours.

Sharing

When you share a DocPaq with another email address, that recipient sees the DocPaq in their home grid the next time they sign in. They see the DocPaq's content and your email address (as the owner). They do not see who else you've shared it with, and they do not see your notes.

Your data, on request

You can download a full export of any DocPaq from the kebab menu next to its name. If you'd like an export of everything or want your account deleted entirely (DocPaqs, shares, uploads, and the email key removed from KV and R2), email wworland@gmail.com and we'll take care of it within a few days.

Changes

If we change anything material, the "Last updated" date at the top of this page will move. We won't sneak in surprise changes — and again, the short version of this whole page is: we keep what we need to run the service, and nothing else.