Written from what the software does rather than from a template. If anything below turns out not to match the code, the code is the bug.
CanaryFlock is operated from Türkiye. Write to hello@canaryflock.com about anything on this page, including a request to see or delete what we hold.
| What | Why | How long |
|---|---|---|
| Your email address | It is how you sign in — there is no password. Colleagues on the same company domain share one workspace, so the domain part also decides which account you join | Until you ask us to delete the account |
| Sign-in codes | Hashed, never stored in the clear, single use, fifteen minutes | Deleted after use or expiry |
| The address a request came from | Rate limiting, and stopping one machine opening unlimited free trials | Kept with the run; sign-in send records roll off |
| Your runs | The URL, the job, the cohort size, what the simulated people did, and the findings | Until you delete them or the account |
| Session traces | Step-by-step records of what each simulated person did — the evidence behind every finding | Until you delete them or the account |
| Payment records | What was bought, the amount, and the transaction reference | As long as tax law requires |
There are no tracking cookies and no analytics inside the application. The only cookie it sets is the one that keeps you signed in.
The pages you test are read by a language model. To decide what a simulated person would do next, we send that model the visible text and the interactive elements of the page being tested, along with the persona and the job.
So: do not point CanaryFlock at a page showing real people's personal data. A signed-in account page, a customer record, an inbox — the contents of those go to the model along with everything else. Test the flow, not somebody's live data.
This is also why filling in forms is refused on any domain you have not proved you control, and why the tool never signs up, buys or submits anything on a site that is not yours.
| Who | What they get |
|---|---|
| Anthropic (United States) | The visible content of the pages being tested, the persona and the job, as the prompt that decides each step |
| Google (United States) | The same, when a run is deliberately configured to use a Gemini model. Off by default |
| Postmark (United States) | Your email address, to deliver sign-in codes and run notifications |
| Hetzner (Germany) | Hosts the application and the database. Your data lives here |
| Cloudflare | Serves canaryflock.com and checks that the application is answering |
| Coinflux / Lemon Squeezy | Payment. We never see or store card details |
Nobody buys this data and we do not sell it. It is not used to train anything of ours, and the model providers above are used through their business APIs.
A copy of what we hold, correction of anything wrong, or deletion of the lot. One email is enough and there is no form. Deleting an account removes its runs, traces and findings; payment records are kept where tax law requires them, and nothing else is.
Backups are taken nightly and kept fourteen days, so deleted data can persist in a backup for up to two weeks before it ages out.
If this page changes in a way that matters, the date at the top changes and anybody with an account is told by email. Quiet edits to a privacy policy are how they stop being worth reading.