How Private Beta application information is handled.

This notice covers the public DbState website, the Private Beta application questionnaire, application processing, Turnstile verification, application records stored in Cloudflare D1, and optional DbState product-update consent.

It does not yet cover future paid customer accounts, product telemetry, hosted DbState workspaces, billing, customer database contents, or production support systems. Those systems do not currently exist as part of this website workflow.

Accepted participants may receive additional notices if future onboarding collects different information.

DbState does not claim to automatically detect every sensitive value an applicant might type. Applicants should describe workflows and evaluation goals without exposing secrets or database content.

DbState uses application information to evaluate Private Beta fit, contact the applicant about the application, understand PostgreSQL workflows and product needs, manage application status, and investigate submission or security failures.

Occasional DbState product updates are sent only when the optional update consent is separately selected.

Submitting an application does not guarantee Private Beta access.

Required application-processing consent is needed to evaluate the application, contact the applicant about the application, and manage the application record.

Optional product-update consent is separate. It may be used for occasional DbState product updates and future Private Beta announcements.

Optional product-update consent is not preselected, is not required to submit an application, and may be withdrawn by contacting darwin@dbstate.com.

DbState uses Cloudflare services for static website delivery, Worker API execution, D1 application storage, and Turnstile bot and abuse verification.

For Turnstile, Cloudflare may process browser and connection signals needed for bot detection. The Turnstile token is validated server-side and is not stored in the application database.

DbState does not send the applicant IP address as a separate Siteverify parameter. Cloudflare may independently process connection and browser signals as described in its own notices, including the Cloudflare Turnstile Privacy Addendum and Cloudflare Privacy Policy. External links open in a new tab.

Private Beta application records are stored in Cloudflare D1. Production and preview D1 databases currently report an APAC operating region, and preview and production are separate resources.

Browser tests do not use remote D1.

The APAC operating region is not presented as a legally guaranteed data-residency commitment.

Private Beta application records are assigned a retention date 365 days after submission.

The retention period applies to the application record and its status history. The retention date is stored with the application.

Accepted applicants may later receive a separate onboarding notice for information needed during active participation. Records may be deleted earlier following an approved deletion request.

Retention enforcement is an operational control and does not make recovery copies disappear instantly.

Automated retention enforcement has been implemented but remains disabled until the Private Beta application process is activated and operationally verified. Public application intake remains closed.

Application information may be accessed for application review, application administration, technical troubleshooting, security investigation, and required infrastructure processing.

Cloudflare is used as an infrastructure provider.

DbState does not currently sell Private Beta application data, provide application data to advertisers, publish applicant answers, use applicant answers for public testimonials without separate permission, or require applicants to participate in marketing.

DbState may disclose information if required to respond to a valid legal requirement.

Implemented controls include HTTPS in production, server-side request validation, Turnstile verification, D1 prepared statements, duplicate-submission protection, no application-token persistence, no password collection, no applicant IP field in the application tables, and no browser local-storage or cookie persistence for application answers.

No security measure can guarantee that an incident will never occur.

Applicants may request correction of application information, withdrawal of optional update consent, deletion of an application, or information about the current application record.

Requests should include the application reference when available. DbState may request reasonable information to verify the requester.

Do not send passwords, IDs, database content, private keys, access tokens, customer records, or production data with a privacy request.

Questions or requests about this notice may be sent to darwin@dbstate.com.

The Private Beta application is intended for professionals evaluating database-development workflows and is not directed to children.

Do not submit an application on behalf of a child.

Age verification is not currently implemented.

This notice may be updated as the Private Beta process changes. The effective date will be updated when the notice changes.

Material changes should be reflected before newly affected processing begins.

Privacy questions and requests: darwin@dbstate.com