Privacy

Who this is from

Strata is owned and operated by Colazul Labs LLC, which is the controller of the data described on this page. “We” means them. Questions, and requests to see or delete something we hold, go to [email protected].

Your documents stay in your browser

The hierarchy you build is saved in your browser’s local storage, on your own device. Strata’s servers do not receive it. Importing a spreadsheet or a PowerPoint file, opening a template, exporting and presenting all happen in your browser.

Local storage also holds your preferences (which view you were in, panel and zoom settings), a note of when you last visited, the address and last-published version of any share you made (never its owner password, which is kept only while the page is open), and a flag that you have joined the waitlist, so we stop asking. The note of your last visit is a date, not an identifier. Clearing this site’s data in your browser removes all of it, and your documents with it, so download a JSON copy of anything you want to keep.

What a shared link stores

Nothing is uploaded until you publish a share link. When you do, we store that version of your document on Cloudflare (in Workers KV), together with its title, the version names and times, and two passwords: an owner password that lets you publish new versions and take the link down, and a view password you give to the people who should read it. We keep only a salted PBKDF2-SHA-256 hash of each password, so we cannot read them.

Each version stays until the owner unpublishes the link. There is no automatic expiry. Unpublishing deletes the document and every saved version; the deletion reaches every location within about a minute. If you have lost the owner password, write to [email protected] with the link.

Anyone who has the link and the view password can read the latest version. Shared pages ask search engines not to index them, send no referrer, and run no analytics.

To slow down guessing and abuse, we count wrong passwords and new shares per connection. The counter is keyed to a one-way code derived from your IP address (a keyed hash, not the address itself) and expires after 15 minutes (wrong passwords) or an hour (new shares).

The one cookie

When you enter the correct view password, the server sets a cookie named strata_view so a reload does not ask again. It holds an expiry time and a signature tied to that one share. It does not hold the password or the document. It is HttpOnly, Secure and SameSite=Strict, it is sent only to that share’s own address under /api/share/, and it lasts 12 hours.

It is strictly necessary for the link to work, and nothing else on the site sets a cookie. We do not use cookies to track you, so there is no cookie banner.

The Plus waitlist

If you join the waitlist (on the pricing page, in the builder’s Plus dialog or from the phone notice), your browser sends your email address, the tool you said you use today, and which of those places you signed up from to our server, which passes them to Mailchimp, our mailing-list service. The Mailchimp key stays on the server and never reaches your browser.

We use them to tell you when Plus is ready and to understand who is asking for it. We do not use them for anything else. Unsubscribe from any email, or write to [email protected] and we will remove you. Mailchimp’s own privacy statement covers what it does with the data it holds.

Analytics

We count visits to our marketing pages with Cloudflare Web Analytics. It is cookieless: it sets no cookie and stores nothing on your device, and it reports in aggregate only (how many page views, from which countries, referrers, browsers and device types, and how fast the pages load), not what any one person did. It does not follow you from one site to another.

It runs only on the marketing pages: not in the builder and not on shared pages. The named actions in our code (such as opening a template) are not sent anywhere. Because nothing here identifies you or sets a tracking cookie, we do not show a consent banner.

Hosting and fonts

The site, the builder and the shared-link service run on Cloudflare, which handles your connection (including your IP address) as our host. The marketing pages use fonts we serve ourselves. The builder at /app loads its typeface, IBM Plex, from Google Fonts, so Google receives your IP address and browser details when you open it.

For IT and security teams

The short answers to what a security review usually asks. For anything else, write to [email protected].

• Where data lives. Your working document lives in your browser’s local storage, on your device. The only copy we hold is a document you publish as a share link, stored in Cloudflare Workers KV with salted PBKDF2-SHA-256 hashes of its two passwords, until the owner unpublishes it. Waitlist addresses are held by Mailchimp. Strata runs no database of its own and has no accounts.
• In transit. Every page and API call is served over HTTPS by Cloudflare, and a Strict-Transport-Security header tells browsers to use HTTPS only.
• Security headers. Every page is served with Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, a Referrer-Policy (no-referrer on shared pages), a Permissions-Policy that turns off the camera, microphone and location, and an enforced Content-Security-Policy. The policy allows scripts only from our own origin (plus Cloudflare’s analytics beacon on the marketing pages), allows no plug-ins, and stops the site being framed.
• Cookies and tracking. No tracking cookies and no advertising or fingerprinting scripts. The one cookie, strata_view, is set only when someone opens a shared link with its view password, holds no password or document, and expires after 12 hours.
• Access to shared links. A link needs its view password, wrong guesses are rate-limited, and a view password cannot publish or unpublish anything. Shared pages are marked noindex.
• Third parties. Cloudflare (hosting and analytics on the marketing pages), Mailchimp (the waitlist) and, for the builder’s typeface only, Google Fonts.

What we do not do

There are no accounts and no sign-in. We do not sell your data, rent it out or use it for advertising. The only parties that handle data for us are the ones named on this page: Cloudflare (hosting and Web Analytics), Mailchimp and Google Fonts (builder only).

Changes

If what Strata collects changes, this page changes first and the date at the top moves. The current text is always at https://stratahierarchy.com/privacy.