Privacy
This document describes only what the product actually does today.
The evidence is the code:
src/privacy/inventory.js(what is collected),
src/privacy/vault.js(storage),src/privacy/redact.js(masking),
src/ledger/ledger.js(work record). Nothing here is aspirational.
1. What is collected
| What | Where | Who can see it |
|---|---|---|
| Account name (user_id) | Identity store (outside the ledger) | You, org admins |
| Password | Never stored in plain text. One-way hash only | Nobody |
| Session | Hash of the token only | Nobody |
| Membership (org, project, role) | Identity store | You, org admins |
| Language and time zone | Identity store (profile) | You, org admins |
| Work record (what was asked, what happened) | Work ledger (append-only) | People in that project |
| Worker runs (count, duration, tokens, cost) | Work ledger | People in that project |
| Decisions (approve/reject/hold and why) | Work ledger | People in that project |
2. What is not collected
- National ID, card or bank numbers
- Location, contacts, device identifiers
- Advertising identifiers or tracking cookies
- Personal data is not written into the work ledger. Values that look like email,
phone, card or secret keys are replaced with [masked:kind] before they are stored.
3. Why
- So you can tell later who asked for what and what happened
- So a person decides the risky things
- So one organization or project cannot see another's work
- So usage and cost are reported honestly
4. Where it is stored
This release stores everything on your own computer. Nothing is uploaded to us.
- Work ledger: an append-only file. Entries are added, never rewritten
- Identity and profile: a separate file outside the ledger, because it must be erasable
- Sensitive values, when used: locked with a per-person key. Destroy the key and the
content cannot be read again
5. What is sent to AI workers
When you give work to an AI worker, it receives the instruction, the files in the working
folder, and — if it is taking over — how far the work got.
An AI worker is a separate program running on your computer. What that program sends to
its own vendor is governed by that vendor's policy. The app tells you this before you
connect a worker.
REQUIRES_BUSINESS_INPUT — agreements and data terms with each AI vendor.
6. Retention
- Work ledger: kept. What happened is the core of this product
- Identity and profile: until the account is deleted
- Sensitive values: deleting destroys the key, so the content becomes unreadable
7. Your rights
| Right | Available today |
|---|---|
| See your information | Yes — account, language, membership are on screen |
| Export | The capability exists but is not wired to any screen yet |
| Delete | The capability exists but is not wired to any screen yet |
| See access records | Records are kept but not wired to any screen yet |
Those three are scheduled for the next pack. We state the current gap rather than hide it.
8. Cross-border transfer and processors
This release runs on your computer, so we do not move your data. Using an AI worker may
send work content to that vendor (see 5).
REQUIRES_BUSINESS_INPUT — required once a cloud edition exists.
9. Contact
REQUIRES_BUSINESS_INPUT — privacy officer, contact address, company details.