What this site knows about you

No account is created for you, no analytics script runs, and there is no tracking pixel, session recorder or advertising tag anywhere on the site.

One form on the site does send something, and it is the only one. Using the sign in form records four things in the database: the email address you entered, the time, your browser’s user agent string, and the country and city your request arrived from. This exists so the dashboard can show sign in activity as it happens, which is a feature of the demonstration rather than a side effect. Nothing else on the site transmits anything you type.

Your password. The sign in form does not send it, the endpoint does not read it, and the table it writes to has no column it could be put in. That holds at all three layers rather than resting on any one of them.

Your IP address is not stored. It is used only to derive the country and city shown against a sign in, which happens at the edge before the request reaches the database.

Only the most recent two hundred sign ins are held. Each new one pushes the oldest out, so a record removes itself with use rather than being retained indefinitely. Sign in records are visible in the dashboard’s audit screen to anyone who opens it, so treat anything typed into that form as public and use the demonstration address rather than your own.

Four values are kept in your browser’s local storage so the site remembers how you left it. They are readable only by this site, never sent anywhere, and clearing your browser data removes them.

• The workspace you last had open.
• The role you are acting as, so permissions stay as you set them.
• Whether you have already seen the orientation panel.
• The email address you used on the sign in form, so the header can show it.

The form does not authenticate anyone and it gates nothing. Any address is accepted, no password is checked, and the dashboard is open whether you use the form or not.

The address is kept in two places: in your browser so the header can show who you are, and in the database so the activity panel can show that a sign in happened. Signing out clears the first. The second ages out as described above.

No payment is ever taken. The checkout is a walkthrough of a checkout: the card fields are prefilled with a well known test number, there is no payment processor connected, and nothing typed into them is transmitted. Do not enter real card details on this or any demonstration site.

Every company, customer, invoice and figure inside the dashboard is generated for demonstration and does not describe a real business or a real person. The read only API this site queries returns that same generated data.

The site is a static export served by Cloudflare Pages. As with any web host, Cloudflare records request level information such as IP address and user agent for delivery and abuse prevention. That is handled under Cloudflare’s own policies and is not accessible to or used by this site.

If the behaviour of the site changes, this page changes with it. The date above is the last time either did.