Privacy Policy

This Policy explains how Reva Labs, an Ontario-registered business (“Reva Labs,” “Worktable,” “we,” or “us”), handles personal information across Worktable Cloud, our websites, downloads, and support, and local or self-hosted Worktable.

• We collect what we need to run Worktable Cloud: your account, the content you store there, billing records, support messages, and service logs. Separately, we collect usage analytics to improve it.
• We never receive the content of a local or self-hosted Worktable in normal operation, and analytics never include your content.
• No training, sale, or advertising. We do not use customer content or personal information to train AI models, sell it, or use it for advertising, and our providers may not train on customer content.
• You can export your Worktable, turn analytics off, and ask us to access, correct, or delete your information at any time.

We use it only to run, secure, bill for, support, and improve Worktable, to enforce our Terms, and to comply with law.

Account

Through WorkOS, we receive your name, email address, profile image, user ID, and sign-in method, and we keep session and sign-in events.

Content you store in Cloud

We store what you put in your hosted Worktable: documents, HTML docs, records, files, annotations, threads, version history, and related metadata. We also process membership and plan details, connected agents and their permissions, and audit and security events.

Billing

Polar, our Merchant of Record, collects payment and tax details. We receive customer, order, subscription, refund, and receipt identifiers, never full card numbers.

Support

We keep what you send us by email, GitHub, a vulnerability report, or another channel, such as contact details, version, platform, and diagnostics.

Usage analytics

Product analytics is on by default for signed-in Cloud users and their connected agents, so we can see how Worktable Cloud is used. Where the law requires consent first, such as the EEA, the UK, Switzerland, and Quebec, accounts we locate there start with it off. Turn it on or off in Settings → Privacy; that also covers your agents. Events carry an opaque account ID instead of your name or email, so they are pseudonymous, not anonymous. Cookies let us link your website visits to the same ID.

Analytics on worktable.cloud is on by default and uses cookies. If we locate you where the law requires consent first, such as the EEA, the UK, Switzerland, and Quebec, we count visits without cookies or browser storage and set cookies only after you choose Allow. We infer location from your IP address at our host only to make this choice. If you turn analytics cookies off or choose Decline, we still count visits without cookies. Change your choice for this browser below.

docs.worktable.dev uses no cookies or browser storage. It counts visits and selected actions, such as downloads and install-command copies, without them.

• We collect public page paths, referring sites, campaign tags in links you followed, signups, successful saves, which agent operations ran and whether they worked, coarse device information, and plan and payment metadata.
• We never collect documents, records, titles, filenames, private URLs, searches, agent instructions, tool inputs or results, credentials, or card details.

Do Not Track and Global Privacy Control signals stop browser analytics, and an account created with one starts with product analytics off. We do not record sessions, capture every interaction, or add location to analytics. Local and self-hosted Worktable, content activity on linked devices, and anonymous document viewers send no product analytics.

Cookies and logs

Worktable Cloud uses essential cookies and browser storage for sign-in, security, and preferences such as theme, never for advertising. Our systems log IP address, browser and device type, request time, route, response status, coarse errors, and security events. We do not intentionally log content, credentials, checkout URLs, or payment details.

Local Worktable needs no account. In normal operation we receive nothing from your Worktable: its files, settings, credentials, agent tokens, and logs stay where you run it unless you send them to us. Downloads, update checks, the installer, and documentation visits reach our hosting providers and GitHub, which log requests with details such as IP address, client type, URL, and time.

These providers process information for us only for these purposes, under their own contractual and legal obligations:

• WorkOS: sign-in and agent authorization. Privacy policy.
• Convex: account, Worktable, plan, and audit records. Privacy policy.
• Cloudflare: gateway, networking, DNS, security, and email routing. Privacy policy.
• Fly.io Sprites: hosted Worktable compute, storage, and recovery checkpoints. Privacy policy.
• Polar: checkout, payments, tax, receipts, subscriptions, and refunds. Privacy policy.
• Vercel: hosting for our websites and documentation. Privacy notice.
• GitHub: public releases, installer source, issues, and private vulnerability reports. Privacy statement.
• PostHog: website, docs, and product analytics, processed in the United States. Privacy policy.
• Our email and domain providers: routing messages and protecting our domains.

Agents and apps you connect can read or change your Worktable within the permissions you approve. They and their model providers handle that information under their own terms, so review those before sharing confidential or personal information.

We may also share information with professional advisors, to comply with law, to protect users or the service, or in a sale or reorganization of the business, whose successor must keep this Policy’s commitments.

Worktable is operated from Canada. Our providers process information in Canada, the United States, and elsewhere, where local authorities may lawfully access it. We remain responsible for it and protect it as described in our Security Policy.

• Account and Worktable data: while you use Worktable Cloud. When paid access ends, a Worktable is export-only for 30 days, then deleted, or sooner if you ask. Exporting does not delete it.
• Service logs and diagnostics: normally deleted within 30 days.
• Analytics: PostHog’s standard Cloud data retention. You can request deletion of analytics associated with your Cloud account.
• Closed-account audit and security records: deleted or de-identified within 90 days, unless needed for an active incident, fraud investigation, or legal claim.
• Support messages: normally up to 12 months after resolution.
• Billing and tax records: up to six years.

Deletion removes or irreversibly de-identifies your account, Worktable, membership, and agent records, apart from the records above.

You can export your complete Worktable, disconnect agents, manage or cancel billing, and turn analytics off at any time. To access, correct, or delete personal information we hold about you, or to ask how it has been used or disclosed, email privacy@worktable.cloud from your account address.

We may need to verify your identity. We aim to respond within 30 calendar days and will tell you if the law allows more time. You can also complain to the Office of the Privacy Commissioner of Canada or your local privacy regulator.

If you are in the EEA or the UK, we rely on performing our contract with you to run the service, on our legitimate interests for security, abuse prevention, and product analytics, which you can object to by turning it off, and on your consent for website analytics cookies where required. You also have the rights to restrict or object to processing and to data portability. You can complain to your local data-protection authority.

Worktable Cloud is for people 18 and older, and our sites and software are not directed to children.

We may update this Policy as Worktable or the law changes. We will post it here, update the date above, and give more notice before a material change when reasonably practicable or required by law.

Our Privacy Officer is responsible for this Policy. Send questions, requests, and complaints to privacy@worktable.cloud.