How PROTOCOL handles your data.

I am the data controller for everything described here. There are no staff. If you write to reodannathan@gmail.com, I read it.

Membership is open at $9.99 a month. The free 30-minute call and the waiting list are open too, and neither of those takes a card. This page describes every part of the system, including the member areas you only reach after paying.

Payments are processed for me by Stripe. Stripe handles card data on its own pages under its own privacy policy — card numbers never reach this site, the member service, or me.

00The short version

• The site sets no cookies, runs no analytics, and carries no tracking pixel, tag manager, session recorder or heatmap. There is no advertising script on any page.
• The public pages make two off-site requests: Google Fonts, and my own booking service on Cloudflare when you open the calendar or leave your email. Both are named and explained below.
• Everything I store about you sits in one Cloudflare Workers KV store. There is no other database.
• Membership now has an account: an email address and a password. The password is stored only as a hash. An earlier version of this page said there were no accounts and no passwords. That is no longer true, and section 4 says exactly what changed.
• Almost nothing expires on its own. Two things do: the login rate-limit counters, and the payment reference created during signup, which expires after seven days. One thing is deleted by the system without you asking — the evidence file you filed is discarded the moment I pass the chapter, because the verdict and its date are the record, not the file. A hold keeps it, so you can see what you sent beside what was missing. Everything else is deletion I do by hand, on request. I say so rather than pretend a cron job exists. The one exception is the login rate-limit counter, which does expire by itself.
• Where Malaysia's PDPA and the UK/EU rules disagree, I hold myself to the stricter one.

01What happens when you just open the site

Opening a page does not create a record with me. Three things do happen, and you should know about all three.

Server logs. The site is hosted on Netlify and the member service runs on Cloudflare. Both keep their own request logs — your IP address, the page or endpoint requested, the time, and your browser's user-agent string. These are their logs, on their retention schedules, and I use them for nothing except working out why something broke.

Google Fonts. The public pages load two typefaces from fonts.googleapis.com and fonts.gstatic.com. That request tells Google your IP address and your browser. I get nothing from it and I do not ask Google for anything about you — but the request is real, it leaves your device, and pretending otherwise would be a lie by omission.

Nothing is stored on your device. No cookie, no local storage, no session storage, nothing. Close the tab and the only trace this site leaves in your browser is your own history. The one exception is my own control page, which holds my admin key in session storage while I am signed in — that is my device, not yours.

02What I collect when you book a call

The booking form asks for five things, and here they are exactly as stored:

Name

Whatever you want me to call you (80 characters)

Country you'll call from

From a list, so I know which time zone you are in

How I reach you

Email · phone/WhatsApp · Instagram · other — your choice

That contact's value

The address, number or handle itself (120 characters)

Anything I should know

Free text, optional (500 characters)

Plus the slot you picked and the time you submitted. If you choose phone, the dial code for your country is added to the front of the number you typed.

Nothing else is captured. No IP address is stored in your booking record. No browser fingerprint. No referrer. The form does not phone anyone else.

The calendar shows that a slot is taken. It never shows who took it. Booked slots are drawn struck through so the site does not make a busy week look like a quiet one, but the only thing sent to your browser is a timestamp.

No automatic email is sent. There is no email service wired into this. I contact you personally, using the method you chose, before your call.

The waiting list. You can leave an email address to be told once, when the first chapter is filmed. It holds your email address, the date you left it, and which part of the site you left it on. Nothing else. It is not a newsletter, it is not passed to anyone, and it is deleted the moment you ask.

Do not put medical details in the note box. The question is about what you have already tried and what keeps failing, not your health. If you write something about your health, sexuality, religion, or anything else the law treats as special-category data, I hold it only because you chose to write it — and it is deleted the moment you ask.

03What I hold once you are a member

You pay, then you create an account with an email address and a password, then you answer six questions. Your member record holds this:

Your name

From checkout, or from you

Your nickname

What you choose to be called in the room. This is the only name other members ever see.

Your email

Used to log in, and how I reach you

Your password

Stored as a hash only — see section 4

Your access token

22 random characters, generated for you

Your six answers

The onboarding questions, listed below

The date you joined

Set automatically

Your lesson ticks

Which of the 48 lessons you have marked done yourself

Your evidence

What you file for a chapter

Your verdicts

Each verified chapter, with its date

Your to-do items

Whatever you write in your own list

Your posts and comments

Everything you put in the room

Your booked calls

Which slots you took, and when

The six questions. When you join I ask your age; which chapter is your actual problem; what you have already tried that did not stick; how many hours a week you have; what better looks like in twelve weeks; and anything else I should know, which is optional. Only I read these. They are never shown to another member and never shown in the room. Answer them for me, not for an audience.

Lesson ticks are yours and prove nothing. Ticking a lesson off is you telling yourself you did it. It is stored because it is useful to you, not because it means anything. I do not treat it as evidence and neither should you.

What you file as evidence. A chapter turns verified only when you file evidence and I read it and pass it. You file it as text and optionally a link. Filing again replaces what was there, and the replaced text is not kept. If you want a version history of your own claims, keep your own copy.

Verdicts are permanent. A verified chapter is stored against your record with its date, and it is not revocable and not quietly edited. It stays yours even if you leave. That record is the product.

Your to-do list is private. It is stored on your record so it is there when you come back. No other member sees it, and I do not read it. It is a scratchpad, not a submission.

04Your account, your password, and your private link

This is the part that changed, so read it properly.

Your private link is what actually authenticates you. It carries a 22-character token in its address, and that token is the whole of your authentication. Logging in with your email and password does one thing: it recovers that link and hands it back to you. It is not a second factor and it does not add a second lock. Anyone holding the link is you, as far as the system is concerned.

• Someone with your link can read your name, your email, your six answers, your evidence, your verdicts, your to-do list and your calls.
• The link will sit in your browser history, and in whatever app I sent it to you in.
• Do not screenshot the address bar and do not paste the link anywhere.
• The member area is marked noindex, nofollow and sends no referrer, so the token is not handed to any site you click through to. Neither of those protects you from forwarding it yourself.
• The token travels in the web address, which means it can appear in Cloudflare's request logs.
• Lost it, or think somebody else has it? Tell me. I close it and issue a new one the same day.

Your password is never stored. What is stored is a PBKDF2-SHA256 hash at 210,000 iterations with a random 16-byte salt unique to you. The password you typed is not written to the record, not written to any log, and never sent back to anyone — including me. I cannot look up your password because there is nothing to look up.

There is no automated password reset, because there is no email service to send one through. If you are locked out, email me at reodannathan@gmail.com and I reopen it by hand. That is slower than a reset link and I would rather say so than pretend a machine exists.

Login attempts are rate-limited. To stop somebody guessing their way into an account, failed logins are counted two ways: by the IP address the attempt came from, and by the email address it was made against. Both counters live in the same Cloudflare KV store as everything else, and both expire on their own within an hour. Nothing about a login attempt is kept beyond that, and it is never used to profile you or work out where you are.

05What other members can see about you

One thing: your nickname.

The room is where members post, comment, and reply once beneath a comment. Everything you write there is visible to every other member, attached to your nickname. Write with that in mind — a room is not a private message.

Never shown to another member: your real name, your email address, your password or anything derived from it, your private link, your six onboarding answers, your to-do list, anything you filed as evidence, your lesson ticks, and your booked calls.

There is no all-members roster, no leaderboard, and no public wall. Nothing in the room is visible to the open internet.

I can delete anything in the room. A post, a comment, a reply — mine or yours. There is no appeal process and I am not going to pretend there is one.

06Live calls and recordings

Calls run on Zoom. Zoom sees your name as you enter it, your audio, your video if you turn it on, and your IP address, under its own privacy policy. There are two kinds: the one-to-one call you earn by verifying a chapter, and the weekly community call open to every member.

• The weekly community call is recorded — it runs on Zoom, and the recording is made on my own machine and kept by me rather than in Zoom’s cloud — and posted for members who could not attend.
• Anything with you in it is recorded only if everyone on the call agrees, that session. One "no" governs the call.
• Consent is per session, not per membership. You are asked each time.
• Camera off is always fine and costs you nothing. Attendance is never conditional on being recorded.
• Your one-to-one calls are not recorded unless you and I both agree to it, on that call, for that call. The terms say the same thing, deliberately.
• If you want to be cut afterwards, you ask and it is done — removed within 7 days, everywhere.

Nothing said in a crisis or a private disclosure is ever recorded, quoted, or repeated anywhere.

07Who else touches your data

Cloudflare, Inc.

Runs the booking and member service and stores every record in Workers KV — including your password hash and the login rate-limit counters. Sees everything in sections 2, 3 and 4, plus request logs.

Netlify, Inc.

Hosts the website files. Standard server logs: IP, page, time, browser.

Google LLC

Serves two typefaces on the public pages, and hosts my email. Sees your IP and browser on page load, and whatever you write to me.

Stripe, Inc.

Takes the payment. Sees your name, email and card details — on Stripe's pages, not mine.

Zoom Video Communications

Hosts the live calls. Sees your display name, audio, video and IP.

I do not sell your data. I do not share it for advertising. I have never run an ad pixel and there is no list to sell you to.

Your data is held outside the EU, and it leaves your country. I am in Malaysia and that is where I read it. Cloudflare and Netlify run global networks. Stripe, Google and Zoom are American companies. Each of these providers publishes data-processing terms incorporating the European Commission's Standard Contractual Clauses, and those clauses are what these transfers rest on. If you want the current links, ask and I will send them.

08How long I keep things

There is no automatic expiry anywhere in this system except the login rate-limit counters. Nothing else deletes itself. These are commitments I keep by hand, and I would rather say that than imply machinery I have not built.

Booking records — call happened

90 days after the call, then deleted

Booking records — call didn't happen

30 days, then deleted

Waiting-list email

Until the doors open and I have told you, or until you ask me to remove it — whichever comes first

Your member record, while a member

For as long as you are one

Your member record, after you leave

Kept, so you can come back to it and so the dates on your verdicts stay true. Deleted the day you ask me to delete it, and not before

Your password hash and salt

Deleted with your record

Evidence you filed

Deleted with your record, or individually on request at any time

Your to-do items

Deleted with your record, or on request at any time

Your posts and comments in the room

Deleted on request; otherwise they stay in the room

Login rate-limit counters

Under an hour — these expire on their own

Recordings that include you

Removed within 7 days of you asking

Anything you emailed me

Deleted with your record, unless a tax or legal record needs it

Payment records

7 years — a tax obligation, not a choice. Held by Stripe and by me.

Deleting a piece of evidence does not rewrite the record. If a chapter was verified on something and you later delete the file, the verdict and its date stand and say what they said. The system does not make you choose between your privacy and your own proof.

09Why I'm allowed to hold it

If the UK GDPR or the EU GDPR applies to you, this is the ground I rely on for each thing:

Your booking details

Contract — steps you asked me to take before a contract, Art. 6(1)(b)

Member record, account, verdicts

Contract — I cannot run the school without them, Art. 6(1)(b)

Your six onboarding answers

Contract — they are how I make the thing useful to you, Art. 6(1)(b)

Payment and billing records

Contract, and legal obligation for the tax records, Art. 6(1)(b) and (c)

Password hash and login rate limiting

Legitimate interests — keeping other people out of your account, Art. 6(1)(f)

Server and request logs

Legitimate interests — running and defending a working service, Art. 6(1)(f)

Google Fonts

Legitimate interests — serving the page as built, Art. 6(1)(f)

The waiting-list email

Consent — you gave it to be told one thing, Art. 6(1)(a)

Recording anything with you in it

Consent, asked per session, withdrawable at any time, Art. 6(1)(a)

Anything sensitive you volunteer

Explicit consent only, Art. 9(2)(a) — withdraw it and I delete it

Withdrawing consent does not undo what was lawful before you withdrew it. It stops everything after.

10Your rights, and how to use them

If you are in the UK or the EU, you can ask me to: give you a copy of everything I hold on you; correct anything wrong; delete it; stop or limit what I do with it; hand it to you in a machine-readable form; or object to anything I do on legitimate-interests grounds. You can withdraw consent to a recording at any moment. You can complain to your national data protection authority — in the UK, the Information Commissioner's Office at ico.org.uk.

If you are in Malaysia, the Personal Data Protection Act 2010 gives you the right to make a data access request and a data correction request. I do not charge a fee for either. You can complain to the Personal Data Protection Department (JPDP) under the Ministry of Digital.

Everyone else: ask me for the same things. I am not going to check your passport before answering a reasonable request.

Where the two regimes differ, I apply the stricter one to everybody. The PDPA does not give a general right to erasure; I give you one anyway.

To ask for something, email reodannathan@gmail.com and say what you want. You do not need a form, a subject line, or a reason.

• "Send me everything you have on me." You get it, readable and machine-readable.
• "Delete me." Your posts and comments in the room are stored separately from your member record and are not covered by this — say "and my posts" and they go too, otherwise they stay in the room under your nickname. Everything else — your member record, your account, your evidence, your to-do list, your booking and your token are erased. Payment records stay for the tax period; nothing else does. This ends your membership, because there is nothing left to run it on.
• "Delete this one thing." Fine, and it does not affect anything else.
• "Take my posts out of the room." Done.
• "Cut me out of that recording." Done within 7 days.
• "I'm locked out." I reopen it by hand. There is no reset email.
• "Take me off the waiting list." Done, and it is the whole record gone.

I answer within 30 days, and in practice usually the same week. Deleting your data is not the same as cancelling your subscription, and cancelling is not the same as deleting your data — ask for whichever one you actually want, or both.

11Marketing

I do not run a mailing list. There is no email service connected to this site, no newsletter, no automated sequence, and no "we may contact you about offers" clause. The waiting list exists to tell you one thing once — that the doors are open. I will not use your data for direct marketing, and I will not pass it to anyone else for theirs. If that ever changes, I will ask you first, and Malaysia's PDPA requires me to.

12Younger members

There is no age limit on PROTOCOL. What I hold about a younger member is exactly what I hold about anyone else — the list in section 3, and nothing extra. One of the six onboarding questions asks your age, and that is the only reason I know it.

Two things I ask rather than enforce. If you are under 18, tell a parent or guardian you have joined before your first call. And if a parent or guardian asks me what I hold about you, or asks me to delete it, I will do it — the same way I would if you asked me yourself.

Nothing on this site is written for children, and nothing here is a substitute for the people responsible for you. If you need someone right now, the numbers on the help page are free, staffed, and open to anyone of any age.

13Security, and what I will not claim

What is true:

• Everything runs over HTTPS.
• Your records live in Cloudflare Workers KV, encrypted at rest by Cloudflare.
• Your password is stored only as a PBKDF2-SHA256 hash, 210,000 iterations, with a random 16-byte salt unique to you. The plaintext is never stored, never logged, and never returned.
• Failed logins are rate-limited by IP and by email, so nobody guesses their way in.
• Your access token is 22 characters, either from a cryptographic random source or derived by HMAC from a secret only my server holds — more entropy either way than a password you would have chosen.
• Nothing you type is ever written into a page as raw HTML.

If something leaks in a way that could hurt you, I tell you and I tell the relevant regulator — within 72 hours where the law requires it. I do not sit on it and I do not wait to see if anyone notices.

14Changes to this page

If I change what I collect, who touches it, or how long I keep it, I update this page, change the date at the top, and tell every current member directly. I will not make a material change quietly and rely on you re-reading a page you have already read.

Version 2.0 is a material change. Version 1.0 described a school with paths, cohorts and no accounts, and it said in two places that there were no passwords. There are now. Sections 3, 4, 5 and 13 are where the difference lives.

15Contact

Reodan Nathan, sole proprietor · Malaysia
reodannathan@gmail.com

One person. No staff. No ticket queue.