Read without being watched.
Watermark is a static, public-record site. Reading it takes no account, sets no cookies, and runs no analytics or advertising trackers — every page reads with JavaScript off. This page states that plainly, and gives an honest account of the few places where using the site does touch your data.
This describes the current build. Some surfaces below — accounts, email digests — ship behind a switch and may not be live in this pre-launch site yet; when they are, this is how they behave.
Reading anonymously
The site is a set of static files served from Cloudflare Pages. Reading any page — a record, a document, a report — requires no login and stores nothing on your device for us. There are no advertising trackers, no analytics cookies, and no third-party tags, and no page depends on JavaScript to be read.
Two small exceptions, both first-party and neither identifying you:
- Edge logs. Like any web host, Cloudflare processes your IP address and request in transit to serve the page and block abuse. We use it transiently for rate-limiting the interactive endpoints below; we don't build a profile from it.
- Performance telemetry (optional). When enabled, the browser may send an anonymous beacon of page-load timings (Core Web Vitals) and JavaScript errors to our monitoring backend (Honeycomb) so we can keep the site fast and unbroken. It carries no account, no name, and no reading history — just the technical shape of the page load.
Interactive forms (Ask, Submit) use Cloudflare Turnstile, a privacy-preserving alternative to CAPTCHA that verifies you're not a bot without the cross-site tracking a conventional CAPTCHA does.
When you ask the corpus
Ask the corpus answers a question using only the extracted record. When you submit a question, the text of that question is sent to Anthropic's API to generate a cited answer from the retrieved sources, and your IP is used transiently to rate-limit the endpoint. Your question isn't tied to an account and isn't kept as a profile of you. Don't paste anything private into it — treat it like a public search box.
When you submit a tip or correction
Submitting a tip, document, or correction proposes an entry to a public case file: what you type is used to open a labeled issue on our public GitHub repository. Please don't put anything you wouldn't want on the public record into the body of a submission.
- Optional contact. If you choose to leave a way to reach you, it's held in a private channel keyed to your submission — never written to the public issue — and is kept only briefly before it expires.
- Attachments. Files you upload are stored to support the submission and referenced from it.
- Your IP is used transiently to rate-limit the endpoint and, with Turnstile, to keep out spam. Sources are never named without consent.
If you create an account
An account is entirely optional — nothing on the reading side requires one. If you do sign
up, identity is handled by AWS Cognito, which holds your email address, a
verified-email flag, and a stable user identifier. Sign-in uses a standard authorization-code
flow; your session's refresh token is kept in an HttpOnly, Secure
cookie that scripts on the page cannot read.
Your preferences live in our own database (Lakebase) under a user_prefs record
keyed to your account:
- an optional display name;
- notification preferences — which sites and categories you follow, and how often;
- your digest opt-in state.
Your email is used only to send the digests and notifications you opt into. Every such email carries a one-click unsubscribe that works from a signed link without logging in, and you can change or clear these preferences any time from your account.
What we never do
We do not sell, rent, or trade your data. We don't run advertising, we don't share your information with ad networks or data brokers, and we don't track you across other sites. The record is funded by contributions, not by your data.
Access, correction & deletion
You can reach the record team through the submission form for any privacy request — to see what's associated with your account, correct it, or have it deleted. Deleting your account removes your stored preferences; an optional contact left with a submission expires on its own. Corrections to the record itself run through the same correction path, published with a provenance note.
Last updated 8 July 2026