Privacy

Last updated: 2026-08-18

This site has two halves that behave very differently, so they are described separately. The workbench collects nothing. The account pages collect what an account needs and nothing more.

The workbench (/, /formats)

Your files are not uploaded. When you open a character card, it is read by JavaScript running in your own browser tab. The bytes stay in that tab's memory and are gone when you close it. Nothing about the card — not its contents, not its name, not its size — reaches us or anyone else.

You can verify this rather than take our word for it. Open your browser's developer tools, switch to the Network tab, and use the workbench: no request is made while a card is loaded, edited or exported. We also enforce it at the protocol level — these pages are served with a Content-Security-Policy of connect-src 'none', which means the browser itself refuses to let them make a network request, whatever the code tries to do.

There is no autosave and no history. Reloading discards everything. If you want to keep your work, export it.

The account pages (/signup, /verify)

These pages do talk to our server, because creating an account requires it. They collect:

• Email address — to identify the account and to send the verification message. It is the only way we can contact you.
• Display name — shown to other people in the products where the account is used.
• Password — never stored as you typed it. It is hashed with Argon2id before it is written down; we cannot read it back and cannot tell you what it was.
• A device signal — see below.
• Your IP address and the time — used for rate limiting and abuse detection on sign-up.

The device signal

The sign-up form computes a device fingerprint in your browser using ThumbmarkJS, and sends the resulting value with your registration. It is derived from properties your browser exposes to any site — screen and font metrics, timezone, rendering characteristics — and is a value, not a copy of those properties.

What it is for: counting how many accounts one device creates. Without it, anyone who can change IP address can register unlimited accounts here, and this page becomes the easiest way to attack the account system. What it is not for: advertising, cross-site tracking, building a profile of you, or anything on the workbench pages — the library is loaded only on /signup.

If your browser blocks it — private mode, an anti-fingerprinting extension — sign-up still works. The value is simply absent and the account is reviewed more conservatively.

What the account is for

The account you create here is the same account across our products, in the way a single account works across the several services of any company that runs more than one. After you verify your email, the confirmation page tells you where to sign in. You never need an account to use the workbench.

What we do not do, anywhere on this site

• No analytics. No Google Analytics, no product analytics, no pixels, no tracking beacons. Cloudflare's own visitor-analytics script is explicitly disabled for this domain, so no measurement script is injected into these pages — you can confirm that in view-source. One exception worth naming rather than glossing over: Cloudflare adds standard NEL / Report-To response headers, which let your browser report network-level delivery failures to Cloudflare. That is transport diagnostics for our own CDN, carries no identifier we set, and is covered by the hosting section below — but it is a report your browser can send, so we would rather list it than claim an absolute zero that a look at the response headers would contradict.
• No advertising and no sale or sharing of personal data with advertisers or data brokers.
• No cookies are set by these pages.
• No third-party resources. Every stylesheet, script and image is served from this domain. No CDN, no webfonts, no embedded widgets — so no third party learns that you visited.
• No error reporting. If something breaks, nothing is transmitted about it.

What is unavoidably recorded

Serving a web page requires receiving a request. Our hosting provider, Cloudflare, processes standard request metadata — IP address, timestamp, requested path, user agent — as part of delivering the site and protecting it from abuse. We do not add to it, do not build profiles from it, and do not combine it with anything else. See Cloudflare's privacy policy.

Retention and deletion

Workbench files are never received, so there is nothing to retain. Account data is kept for as long as the account exists. A sign-up that is never verified expires on its own and the pending record is discarded. To delete an account and its data, write to us at the address below.

Children

This site is not directed at children under 13, and accounts are not knowingly created for them.

Changes

If this stops being accurate, this page is updated before the change ships, not after, and the date at the top changes with it. We will not quietly broaden what is collected while leaving an old promise standing. This page was rewritten on 2026-08-18 when account creation was added; the previous version described a site with no accounts at all.

Contact

Questions about this policy, or a deletion request: hello@larkbench.com