Status, 22 September 2026. Every fact below is read from the database schema, not written from memory. A privacy impact assessment covering the transfer of this information outside Quebec has been completed and signed. What this page still lacks is a lawyer’s review of its wording. Read it as an accurate description of the system.
Who holds it
Luke Sidney, a sole proprietorship registered in Quebec, Canada (NEQ 2282399502). The site is flowingkhaos.com.
Person responsible for the protection of personal information: Luke Sidney — luke.sidney@clevrstart.com. Write there to ask what we hold about you, to correct it, or to have it removed, or to ask anything about this page.
What an account holds
Making an account writes exactly these fields, and nothing writes any other:
- name, email and a password hash — what you typed at sign-up. The password itself is never stored.
- email verified — whether you followed the link in the verification mail.
- marketing opt-in, and the timestamp of that consent. The box is not pre-ticked, the consent time is stamped by the server and can never be set by your browser, and leaving it unticked costs you nothing.
- a Polar customer id — created when you sign up so that a purchase can find you.
- workshop progress: which steps you passed, when, and what each step weighed at the time; a high-water completion percentage per workshop.
- reading-check attempts: which question variants you were shown, and whether you passed.
- sessions: an opaque token, its expiry, and the IP address and user agent of the browser that signed in.
If you sign in with Google, the account also holds the tokens Google issues, and nothing else from your Google profile.
What it does not hold
No prices, no card details, no billing address. Payment is handled by Polar, which is the merchant of record; receipts and invoices live in their portal, reachable from your purchases. No analytics script runs on this site and no cookie is set except the sign-in cookie.
Where it rests
The database runs on Railway in Virginia, in the United States — the region
us-east4-eqdc4a, named here because “US East” is a marketing phrase and a state is a fact.
Railway offers no Canadian region. That means personal information of people in Quebec is
stored outside Quebec, and a written assessment under Law 25 §17 covers that transfer; the
protection relied on is contractual, through Railway’s data processing addendum and the
Standard Contractual Clauses it incorporates.
Three other companies see part of it. Resend sends the verification and password-reset mail, so it sees your address. Polar Software Inc., a Delaware company, is the merchant of record when you buy and receives your name and email. Cloudflare serves the site and your request crosses its network to reach the database.
No language model ever sees anything about you. The reading checks are generated from the workshop text alone, by an operator, before anyone reads them — your answers, your progress and your identity are never sent to a model.
How long
For as long as the account exists. Deleting it removes the rows immediately — there is no grace period and no soft-delete flag.
Removing it
Delete your account. It empties every table listed above for you and deletes the Polar customer record. A test creates an account with a row in every table, deletes it, and counts the rows to zero; that test runs on every change to the service.
One thing survives, with your name removed: the record that a payment happened. A receipt is not mine to destroy, and once the user reference is cleared it no longer points at you.
The reading check
The questions you are asked are generated once per workshop step by a language model reading that step’s own text. Your answers are sent to the server, scored there, and stored as an attempt. The answer key never leaves the server — it is not in any page, any response, or any script.