Privacy Policy.

Last updated 24 May 2026.

What this page covers

This policy covers knock.works and its subpaths. I am the operator (Umur Tuner); the data and the service are run by me directly.

What I collect, when, and why

Page visits

Plausible Analytics. Cookieless, aggregate counts only. No consent required. No personal data collected at this layer.

Diagnostic submissions

When you complete the search diagnostic, the answers are sent to a private database so I can compile the calibration data over time. The submission is anonymous unless you choose to enter your email at the gate; if you do, the email is stored against your answers.

Email captures

Two surfaces ask for your email: the diagnostic email-gate ("open the full diagnosis") and the article-page footer if you choose to subscribe to the irregular essay list. In both cases:

• The address is stored only for the purpose you submitted it.
• The address is not sold, traded, or shared with third parties under any condition.
• Every email I send includes a one-click unsubscribe link.
• You can request deletion at any time by replying to any Knock. email or by writing to umur@knock.works.

Intake-call data

If you become a Knock. client, the intake call produces a brief that I write up and store against your client record. The brief lives in a private folder and is referenced by every Monday's briefing. It is yours; on cancellation it is deleted within ninety days unless you ask me to retain it.

Auto-apply implications

Knock. submits job applications on your behalf via Greenhouse, Lever, Workday, and LinkedIn Easy Apply. The applications are submitted under your name, with the CV and cover letter you have approved. The submission is logged in your briefing page; the employer's ATS retains the submission under the employer's privacy policy, not Knock.'s. We do not store passwords; for Workday-onboarding employers, the intake call walks through the per-employer account setup once and the credentials are held in your password manager, not mine.

Stripe payment data

Stripe handles all payment processing. Knock. does not store card numbers; the card token and the customer record live in Stripe under their privacy policy. The invoice metadata (date, amount, plan) is retained on the Knock. side for tax purposes for the period the relevant tax authority requires.

Retention

• Diagnostic submissions: retained indefinitely for calibration, anonymised after ninety days if no email was submitted.
• Email-gated lead records: retained until you unsubscribe or request deletion.
• Client briefings and intake notes: retained for ninety days after cancellation; deleted thereafter.
• Stripe payment records: retained for the tax-required period (7 years EU, 7 years US default).
• Operator alerts (if you become a client, hot-lead alerts route to the operator's phone): alerts are deleted from the operator phone every ninety days.

Who else sees your data

• Plausible Analytics. Aggregate pageviews and custom events. Cookieless, EU-hosted, no personal data.
• Supabase (or equivalent Postgres host). Database; stores email captures, diagnostic submissions, client briefings. EU instance, encrypted at rest.
• Postmark / Gmail / Mailerlite. Email delivery for the diagnostic auto-respond and the sequence. The provider may store open and click events for deliverability; deleted on a forget-me request.
• Stripe. Payment processing. Their privacy policy governs the card data.
• Calendly. If you book a call. Your Calendly invitee data is governed by Calendly's privacy policy; Knock. only receives your email and the meeting time.
• Cloudflare Turnstile. Bot prevention on the email gate. One-time token, no personal data.

That is the entire list. I do not sell data to anyone, under any condition.

Your rights (GDPR + CCPA)

• Request a copy of what is held on you.
• Request deletion (single reply to any Knock. email).
• Withdraw consent for marketing pixels (we do not currently run any; if that changes, the cookie banner will return).
• Unsubscribe from all emails with one click.

One email handles all of the above: umur@knock.works. I respond within thirty days, usually within forty-eight hours.

Contact

Knock. — umur@knock.works — Knock. - Geneva, Switzerland.