How this site handles reader data
Using Cowork is a free teaching site with optional accounts. The site collects the minimum data needed to run accounts, protect sign-up flows, show article progress, and understand basic traffic.
Account data
If you create an account, the site stores the account information needed for sign-in, such as your email address, name when provided, connected login providers, sessions, and authentication tokens. Passwords are handled by the authentication system and are not stored as plain text.
Account data is used to authenticate you, keep your session active, help you manage connected providers, and support account deletion.
Progress data
Signed-in readers can mark articles as read. The site stores those article read states with your account so the table of contents and article navigation can show what you have already finished.
Progress data is private to your account. It is not a public profile, leaderboard, or shareable completion page.
Account and security email
Essential account email is sent regardless of your marketing preferences: magic links, email verification, password resets, email-change confirmation, and account deletion. These messages are part of operating your account and cannot be turned off while the account exists.
Production email is sent through Resend, which processes the recipient address and message on the site's behalf. Local development and test email may be captured through Mailpit.
Newsletter and product email
Separately from account email, the site may send a newsletter and occasional product updates. Whether you receive these depends on your location and your choice. In the EEA, the UK, and Canada we send them only after you opt in. Elsewhere, creating an account may subscribe you, and you can opt out at any time.
You can change this whenever you like from the email preferences in your account settings, or with the unsubscribe link included in every newsletter or product email. Unsubscribing stops the non-essential email but keeps your account and its essential email intact. We keep a record of your choice, when it changed, and the country it was made from so we can honor it.
Abuse prevention and analytics
Signup and magic-link flows may use Cloudflare Turnstile to reduce automated abuse. Turnstile verifies that a request is likely legitimate before the account action is accepted.
The site also uses Cloudflare Web Analytics for basic traffic visibility. It is used to understand page visits and site performance at a broad level, not to build a reader profile.
Account deletion
You can delete your account from the account settings page. Deletion is intended to remove the account and the site-owned progress records attached to it, including read states and account tokens managed by the authentication system.
Operational logs, email-provider records, analytics aggregates, or backups may not disappear instantly, but they are not used to keep a usable account after deletion.