Privacy & Trust
Fictional portfolio demonstration. Use invented requests and test photos. No real trade service or emergency response is provided.
Who can see my records?
Company pages and three synthetic demo perspectives are public. Operational records, private photos and exports require verified identity plus server-enforced workspace, role and record permissions. Sites remains the operational sign-in. A separate development Clerk app has verified login; linking requires simultaneous verified identities and an approved existing owner or invited member. Signup and perspective toggles grant no real access. Revoked memberships are denied. No production-domain cutover has occurred.
What information is saved?
D1 stores fictional requests, conversations, addresses, equipment/access notes, approvals, appointments, parts, audit history and synthetic books/purchasing decisions. Private R2 stores service photos and cached voice. Unsent intake drafts use browser local storage; the ordinary guide keeps up to20messages in tab session storage. This privacy guide uses component memory only. Use invented data; never enter passwords, card numbers or sensitive personal documents.
What goes to outside services?
Default guides use authored local answers and make no paid provider call. Explicit protected Astra reasoning sends your question and a minimized authorized record with a versioned SOP:8192input bytes,1024output tokens including reasoning,20lifetime attempts, no tools, hidden fallback or automatic retry; store:false. Photos, credentials and full histories are excluded. Reviewed transcription sends at most15seconds of canonical PCM16 mono16kHz WAV,480044bytes, with20lifetime attempts. Failed or uncertain allowances remain counted.
How is microphone and voice use limited?
Recording starts only by your action. Stop, discard and text fallback are available. Review audio before sending for transcription, then review returned text before saving it. Browser dictation is a separate browser service and language availability is not guaranteed. Chris / Eleven v4 has one site-wide80-character synthesis attempt, already used; authorized cached audio can replay. The optional provider preview is a sample. Sound is opt-in, with no autoplay. Multilingual synthesis quality has not been verified; no new samples are generated for language switching.
When is information removed?
Operational records, photos and cached voice have no automatic expiration or self-service purge. Public demo access expires after12hours; expired rows are cleaned on a later allowed session start, not a guaranteed scheduled physical purge. Drafts remain until replaced or browser site data is cleared. Sign-out does not clear them; session restoration can retain tab storage. Clear in this privacy guide removes only its in-memory conversation. Failed uploads may retain private unlisted objects; failed admission slots remain counted.
What protection is actually in place?
HTTPS, bound database parameters, permission checks, revision/replay guards, actual-byte limits and private no-store responses are implemented. Evidence admission has a conservative20-slot record cap; image types/signatures are checked. Hosting providers document storage encryption, but the backend can read records: this is not end-to-end encryption. No malware scan, independent penetration test, certification, active MFA or guaranteed breach prevention is claimed. Export and an offline partial fixture restore were tested; a full hosted backup/restore and recovery guarantee are not verified.
Are cards or real payments stored?
No card-number/CVV form, real vault, bank feed, supplier checkout or live payment/refund adapter is connected. Supplier prices, last-four display, Pay results and refunds are labeled fictional fixtures. Commitments, earned work, deposits, cash and inventory stay distinct. Accepted inventory reaches synthetic books only after explicit reviewed posting and source reconciliation; rejected units do not. Supplier websites follow their own policies. No real charge, supplier contract, bank settlement or PCI certification is claimed. No domain/DNS change or recurring service is purchased automatically.
What can I do or report?
Review each change before approval. The owner can pause processing and review or revoke access. Authorized service, books and purchasing exports are available; downloaded copies become your responsibility. Public demos use isolated cookies,6requests,80shared writes,12hours and a300-session site lifetime cap; they cannot access operational files or paid providers. For concerns, contact the project owner in the original Codex build chat. No staffed public hotline or self-service account-wide purge is provided.