Privacy
Draft. Not legal advice. Written to be accurate about what the system does today; have it reviewed before public launch.
What is stored
- Workcards — the transcript of a session you published, the repository and branch it came from, and a generated summary.
- Account — your email address, a hashed password, and which organisation and teams you belong to.
- Devices — a name and timestamps for each machine you have signed in from, so you can sign one out individually.
- Usage — which workcards were surfaced in a session, used to rank frequently-useful ones higher.
Where it is processed
Everything runs on the server operating this deployment. Search, ranking and summarisation all use models running on that machine — no part of a transcript is sent to any third-party API.
Credentials in transcripts
Transcripts are scanned before storage and anything matching a credential is replaced with a marker. This runs on the server, so it cannot be bypassed by a modified client. It is a safety net rather than a guarantee.
Who can see a workcard
Only the people you shared it with: yourself, your team, or your organisation. Tenant isolation is enforced by the application on every query. Workcards additionally have row-level security in the database, so a missing filter in ordinary workcard queries cannot expose one organisation's cards to another. Other tables do not have that second layer. There are no public links.
Training
Your transcripts are never used to train any model, ours or anyone else's.
Deletion
Deleting your organisation removes its workcards, accounts and usage history. Backups are retained for 14 days and then discarded.