Utica: what's kept, and for how long
A plain-English note for the Utica team. Draft, 5 November 2026: Gerald to check before anyone joins, including the two points marked "Gerald to confirm".
Who runs it
Utica is run by Gerald Lee for his interns and himself, so the team can see each other and talk while working remotely. Questions or requests about your data go to Gerald.
What's kept
- Your name and work email, and which desk is yours: so the team can find you and you can sign in.
- Chat messages, in the team chat and one-to-one: kept for 90 days, then deleted.
- Sticky notes: kept until the person they were left for, or the person who left them, takes them down.
- Your current status, your status note if you write one, and where you're standing on the floor: one line per person, overwritten each time it changes and about once a minute while you're signed in. It's not a history: only the latest is kept.
- Call set-up messages: the few messages browsers swap to start a call or join the meeting room, which include network addresses. Kept for at most 10 minutes, then deleted.
- Sign-in records kept by Supabase, the service that runs the sign-in and database.
What isn't kept
- Voice calls, meeting-room calls and shared screens are never recorded or stored. They go straight between the browsers of the people in the call. A screen is shared only when you choose to, and only the screen, window or tab you pick.
- Pop-ups (desktop notifications) are shown by your own browser, and only if you turn them on.
- "Away" is worked out by your own browser, from whether you've used the Utica page in the last few minutes. Nothing else on your computer is looked at.
Who can see what
- Everyone on the team sees the team chat, everyone's status, and where they are on the floor.
- One-to-one chats, notes and call set-up messages are seen only by the people involved.
- On a call or in the meeting room, the other people's browsers can see your internet (IP) address, as with any direct call. That's how the browsers connect without a server in the middle.
- Gerald, as the account owner, could see the stored data in the Supabase dashboard. He won't read other people's one-to-one chats or notes except to deal with a complaint or a legal duty.
The services Utica uses
| Service | What it does | What it gets | Where |
|---|---|---|---|
| Supabase | Sign-in and the database | Everything in "What's kept" | London (UK) region |
| Resend | Sends the sign-in emails | Your email address and the sign-in link | USA |
| Cloudflare Pages | Hosts the website | Your IP address and the pages you load, in its request logs | Worldwide network |
| Google (STUN) | Helps two browsers find each other for a call | Your IP address, when you make or answer a call | USA |
The fonts and code are kept on the Utica site itself, so loading a page doesn't contact Google Fonts or any other outside service.
Where data goes to the USA, it's protected by [Gerald to confirm: the UK–US data bridge where the provider is certified, or the provider's data processing agreement with the UK transfer addendum]. Supabase's region: [Gerald to confirm London when the project is created].
Your rights
You can ask Gerald for a copy of what's kept about you, or to correct or delete it. When you leave the team, you're taken off the members list, your sign-in account is deleted, and your messages, notes and status are deleted with you.