Privacy and data ownership

Public browsing

No account is required. Init drafts and decision paths are saved in this browser’s local storage. Use “Start a fresh draft” or clear browser site data to remove them. Exported specs contain your entered configuration; inspect them before sharing. They must not contain passwords, tokens or private personal records.

Photo Guestbook and Showcase

Uploads and moderation require the invited owner credential. Pending originals remain in private R2 storage. Only currently approved contributions are served publicly. Hiding revokes controlled requests; deletion removes the original and leaves a moderation tombstone. Responses use no-store. Files people already downloaded and third-party copies cannot be recalled.

Original demo artwork is labelled. The hosted demo is not a public submission service; do not upload personal or sensitive images to test it.

Credentials and logs

Cloudflare and GitHub credentials stay in the authorised agent/runtime. Owner credentials and encryption settings are runtime secrets. Portable specs do not carry them. Cloudflare processes request metadata and retains bounded operational logs according to the operator’s account settings. The existing Cloudflare zone injects Cloudflare Web Analytics on public pages. It is separate from saved drafts and does not receive owner credentials or vault plaintext. The encrypted state mini-app blocks that script with its content security policy.

Portable AI State

The fictional demo encrypts locally with a key derived from an owner-held passphrase. Plaintext and the key are never uploaded by this tool. Clipboard disclosure to a model is an explicit separate action. It remains a synthetic-only demonstration pending the complete security and interoperability gates.