Legal

Privacy

Last updated: September 2026.

This website

There is no analytics script on this site. No Google Analytics, no tag manager, no session recorder, no advertising pixel, no third-party embed. The content security policy would block them, and we have not asked for an exception.

Our own server records every request to this site, one line each, holding the time, your IP address, the address you asked for including anything after its ?, and the headers your browser sent — which is more than the three worth naming: your user-agent, the referer you arrived from, and your language and client-hint headers. Cookie and Authorization are written as REDACTED; nothing else is.

That is not an aggregate and it is not anonymous. A timestamp beside an address is the pairing an investigator asks for, and an address with a user-agent identifies a person about as well as anything on the open web does.

Those lines go into one file, shared with every request to the console, on the machine that also holds the account database. The server keeps five rotated files besides the one it is writing, rolling at 50 MiB; we have set no separate retention policy, so how long a rotated file survives is whatever the web server does by default. We would rather say that than name a number we have not checked.

There is no CDN, proxy or analytics service between you and us, and no provider dashboard of your requests: the name points at one machine, which terminates TLS and serves these files. That machine is a rented server, so the company we rent it from is the one other party in the path. The site sets no cookies, so there is no cookie banner to dismiss.

There is no form here either, and nothing behind this site that could receive one: it is static files on a file server, with no endpoint and no database. This page used to describe what we did with what you typed into an early-access form. That was false — the form posted to a path nothing served, so every submission was lost and no one saw an error. The form is gone, and this paragraph is the correction.

If you email us

founders@runninglake.com is a mailbox two people read. We keep the thread so we can reply to it and decide whether a design-partner slot is a fit. We do not add you to a newsletter, run you through a sequence, sell the address or share it with an advertising network — and there is nothing here that could. No CRM, no mailing tool, no marketing automation. It is a mailbox.

Ask us to delete the thread and we will, without asking why. That is small enough to be a promise we can actually keep, which is the only reason it is on this page.

If you sign in to the console

The console is swim.runninglake.com ↗, a different origin under a different agreement, and this section is only the handover. Continuing with Google gives our control plane your email address and your name, and holds them for fifteen minutes in a signed cookie on that domain. No user, no organisation and no workspace exists until you name a workspace and submit, and that is the point at which we first store an account. If you arrived on an invitation the account is created when you sign in instead, because the workspace already exists.

Two rows are written on our side before any of that, and both hold your IP address and your browser’s user-agent string. Pressing the Google button writes a handshake row, so the sign-in that comes back can be matched to the one that went out. Completing the sign-in writes a session row, and an append-only audit entry recording that you signed in.

How long each is kept, as the system behaves today. A session row is deleted by a daily sweep once the session has been over for a day — the day of grace is so “why was I signed out?” still has an answer — which means within about two days of it ending. A handshake you abandon is deleted after its ten-minute expiry, the next time anyone starts a sign-in. A handshake you complete is kept, because that sweep only clears abandoned ones, and the audit entry is kept by design. Nothing alerts us if the session sweep stops, so read this as a description of what runs rather than as a guarantee. This page used to say neither sweep ran; that was true when it was written and stopped being true the same evening. The server also records the request itself, as it does for every request to either host — the line above, under This website, says what that line holds.

The product

This page covers the website. The product is a different matter with a different agreement: customer data lives in a data plane, in your own cloud account from the Business tier upward, and the control plane holds metadata and orchestration. What crosses that line, and what does not, is described on the security page — including where the boundary is not absolute.