Privacy Policy
Effective: October 6, 2026 · Operator: K4Works
1. Optional account usage measurement
For signed-in accounts that accept the updated usage analytics notice, our server stores the first and latest times of dashboard and editor entry, workspace setup success or failure, meaningful editing or importing, and completion through saving, downloading or sharing, linked to the account. We do not record document content, names, IDs or raw errors. Operators use these reports to improve onboarding; account identifiers are not sent to Google. Existing Google Analytics consent alone does not enable these reports. Withdrawal in Cookie settings stops future collection. Existing records are removed on account deletion or a separate deletion request.
2. Optional visit analytics and advertising measurement
You can choose visit analytics and advertising measurement separately. With analytics consent, Google Analytics 4 collects page visits, device, browser, language and usage statistics. With advertising measurement consent, Google Ads cookies and ad click identifiers measure new signups after ad visits. On signup completion we send a randomly generated conversion identifier unrelated to document or account IDs and a fixed conversion value of 1 KRW; this is not a payment amount. Processing may occur outside your country on Google servers. We do not send document content, names or IDs, emails or authentication tokens, and visit analytics exclude URL query parameters. Enhanced conversion email collection, advertising personalization and Google Signals are disabled. You can decline or withdraw consent at any time through Cookie settings without affecting service access. Withdrawal stops subsequent collection for that measurement and removes its GA or advertising measurement cookies from this browser. Server records preventing duplicate signup measurement are removed when the account is deleted. Contact [email protected] about previously collected information.
3. Operator and scope
K4Works operates Schema Studio at schema-studio.net. This policy covers personal data handled by our website, sign-in, workspaces and cloud documents. Contact us about privacy or the service at [email protected].
4. Information and purposes
When you sign in with Google or GitHub, we process your provider account identifier, email address, and the name and profile image supplied by the provider through Supabase Auth. We use this information to identify your account, maintain your session and manage workspace access. Google access is limited to basic profile and email; we do not access Gmail, Drive or contacts. Email sign-in processes your email address and authentication request. Workspace invitations use the recipient email, role, and invitation and acceptance times. Document and membership change records support access management and troubleshooting. We use the email and information you send in a support request to resolve it.
5. Schema documents and browser storage
We do not request source database passwords or actual records. Imported schemas, descriptions, layouts and edits are stored in browser IndexedDB. Choosing cloud save stores the document and its workspace and author information on our servers, accessible to workspace members according to their permissions. If you turn on cloud autosave, subsequent edits are also sent to the server. Anyone with a read-only share link can view its document until the link expires or is revoked, so check who you share it with. Table names and descriptions may contain confidential information; review them before saving. Browser storage also maintains login sessions and language preferences.
6. Service providers and international processing
Supabase provides authentication and database services; Cloudflare provides website hosting, delivery and security. Our current Supabase project database is in Tokyo, Japan. AWS SES handles sign-in and invitation email delivery in the Seoul region, and AWS SNS delivers bounce and complaint events. This processes recipient email addresses and delivery status. Our suppression list stores a keyed HMAC value instead of the raw email address, along with the suppression reason. Google and GitHub process information under their own policies as your chosen sign-in provider. Cloudflare’s distributed network and provider operations or support may process information outside your country. Operational logs, such as IP addresses, request times and browser information, may be processed to deliver and secure the service. Except where disclosure is legally required, we share information with providers only as needed to operate the service.
7. Limited use of Google user data
We use information received from Google only for the user-facing features described above, not for advertising targeting, sale of data or training general-purpose AI models. Our use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
8. Retention and deletion
We retain account information and cloud documents while maintaining your account and providing the service. You can delete your account from the Cloud panel after deleting every workspace you own or transferring its ownership to another member, or request account or document deletion at [email protected]. After verifying your identity and the permissions and retention scope of shared documents, we delete active data no longer needed; information legally required to be retained is kept until that obligation ends. Provider backups and security logs expire according to provider retention cycles and may not disappear at the same time as active data. Local copies remain after sign-out; clear this site’s browser data to remove them. Local checkpoints are limited to 30 per document and 30 days.
9. Your choices and safeguards
Contact [email protected] to request access, correction or deletion, or ask about data processing. You can revoke access in Google account connections or GitHub’s Authorized OAuth Apps settings. Revocation alone does not delete your existing account, cloud documents or local copies. We protect information with HTTPS, authentication and workspace access controls. Visit analytics are optional, as described below.
10. Policy changes
We publish policy changes and their effective date on this page. We communicate material changes to data processing through an appropriate method, such as a service notice.
Google API Services User Data Policy · Google connections · GitHub OAuth Apps