What Masterji stores, and where it goes

Everything on this page is read out of the code that runs Masterji.

What the database holds is a daily work diary: the task you declared this morning, the proof you filed tonight, and what you said to the coach about both.

What signing in gives us

There are two ways in: Google, or your email address and a password. With Google, three things come out of it and are kept:

• Your email address, which Google has marked as verified.
• Your given name and family name, as Google spells them.
• A username, made from the part of your address before the @.

The other way in is an email link. You give us the address, we mail you a link, and the link opens a page where you choose a password, which creates the account — already confirmed, because clicking the link is what confirms it. What is kept: the address, a username made the same way, from the part of it before the @, and the password as described next.

A password is kept only as a slow, salted, one-way hash — never as itself, so nobody here can read it back or tell you what it was. An account made with Google has no password at all unless you set one on your account screen. Forgetting it is not a dead end: the sign-in screen can mail a link to your confirmed address to choose a new one.

Wrong passwords are counted, per address. Ten in an hour for one address pauses sign-in there until the hour is up or a correct password arrives — what is kept is a one-way fingerprint of the address, never the address itself, plus the count and when it started. A wrong CURRENT password on the change-password form counts the same way. The count clears the moment a password sign-in, signup, reset or change succeeds, and whatever is left expires within about an hour either way, removed by our hourly clean-up.

If you connect Masterji to Claude, one more thing is kept: the sign-in Claude holds for you — which client it was issued to, what it may do, and when it runs out. It runs out thirty days after Claude last used it, deleting your account deletes it at once, and changing or resetting your password ends it too.

What using it writes down

Everything the product is made of: your goal's title and the brief behind it, every morning declaration, every evening's proof and the link or screenshot beside it, every message in the chat and the workshop, which parts of a phase's bar each proof satisfied, every phase transition and the reason you gave, the dates you checked in on, and the cohorts you have joined. From the workshop, the ideas you parked before you committed to one, and what the room worked out about the idea you chose. On each check-in and message, whether it came in from the site or from Claude.

Two settings sit beside that: whether the coach is in coach mode or thinking-partner mode, and — once you switch evening nudges on — one browser subscription per device, with the timezone that browser was in.

One more, and it is the only thing here that is not something you did: if you have a live goal, we write down the days you opened the dashboard. One row per day, so that we can tell the difference between a builder who opened the app and left and one who never opened it. No page, no referrer, no session, nothing else.

We also keep a running ledger of what each model call cost: token counts, the model's name, and which of your turns caused it. The ledger holds no message text.

Beside that ledger we keep, for ninety days, what was actually in each call: the instructions Masterji was working from on that turn, which quote the words you had already written, and anything he asked the app to do with them. On the evenings he judges a proof, that includes the proof itself, exactly as it was handed to him. It is how we work out what happened when he gets something wrong, and while Masterji is in beta it is also how we learn how the product is really used. Nothing older than ninety days is kept, and deleting your account takes it too.

The name you record about someone else

When an evening's proof is a conversation, Masterji stores the name of the person you spoke to. VALIDATION's gate counts distinct people rather than rows, so that name is what makes the phase mean something — three conversations with one willing friend are three days of work and one person's word.

That field is used for counting and nothing else: it is shown nowhere in the product, left out of the record you export, and carried by no cohort board or share link.

The name may also be in what you wrote that evening. Your proof is your own words, so a name you use there sits in the record like any other sentence, and goes to the model provider with the rest of the chat.

If you or they want a name taken out, ask, and it comes out of everywhere we hold it: the counting field, your proof, and the ninety-day record of what Masterji read, which quotes your proof back to him.

Who else it reaches

Masterji does not sell your data, and there is no advertising in this product.

What you can do with your record

Take it with you. The whole record of a goal downloads as a file, from the goal card and from a closed idea, written oldest-first so it can be handed to somebody.

Have it erased. Ask, and your account goes: the record is taken out of the product, your email, username, name and any password are overwritten so the address is free for you to use again, and every sign-in already issued stops working the moment it happens.

Change it. Your goal, your brief and your declarations stay editable in the product for as long as you are working on them.

How it is kept

Your session is short-lived and encrypted in transit. The cookie that authorises requests lasts fifteen minutes; the one that renews it lasts seven days and is scoped to the sign-in endpoints, so your browser attaches it nowhere else.

Signing out ends that sign-in on our side, not only in your browser. Each sign-in is its own record: your browser's own description of itself, when it was last used, and when it runs out. Pressing sign out ends that one immediately. A different browser or device is a separate record and stays signed in until its own sign-out, or its own ninety days, ends it — and this is a different thing from the Claude connection described above, which signing out does not touch. Left alone, a session renews itself for up to ninety days and then asks you to sign in again. No address of any kind is part of that record.

Operator access is read-only, and it is logged. When the person who runs Masterji looks at an account through the app, that session can only read — every request that would write is refused — and a row records who looked, at whose account, when, and for how long. The screen says so while it is happening.

A confirmation, signup or password-reset link writes one short-lived record. When one is sent, we keep the address it went to, what the link is for, when it expires and whether it has been used — and a one-way fingerprint of the link, never the link itself. It works once and stops working after twenty-four hours, whichever comes first. Sending it means the address and that link reach our mail provider, which is in the table above. Asking to be erased takes these records with the rest.

Changing or resetting your password signs you out everywhere else. A new password from a reset link ends every sign-in on the account, the Claude connection included, and signs you in on the page where you chose it; changing it from your account screen does the same but keeps the browser you changed it from.

Your name and your goal stay out of search. Every page that can carry either is marked for search engines to skip. A share link you generate has a random address, and shares the page with the person you send it to.

Asking about any of this

Write to cmahendra9999@gmail.com — to ask what is held about you, to have it deleted, to have a name taken out of a proof, or to tell us that something on this page does not match what the product does.