Privacy

The warning under the question box is the operative one: your question is stored so the answer can be produced and re-checked. Do not paste confidential documents into it. If you are signed in you can delete a run from your account; if you are not, the run has no owner and no delete control, and it waits for the sweep described below.

• The question and the brief are what the answer is about. They are also the cache key: an identical brief asked again within 24 hours returns the run that already exists rather than re-querying every source.

• The run log — queries, statuses, documents, the validator report — is what makes an answer inspectable. Without it, “this figure came from that page on that date” is a claim rather than a record.

• The IP hash exists to rate-limit the public write endpoints. It cannot be reversed into an address.

• Account details exist so a run can belong to you, so a contribution can be attributed, and so you can sign back in.

• Enquiry details exist so somebody can reply to you.

External sources are queried with search terms derived from the brief — the matched use case and its aliases, the jurisdiction name, the leading recipe’s technology term, and a small fixed set of qualifiers such as “self hosted”. Your sentence is not sent to a search provider, a directory or a repository API. That is enforced in the planner and asserted by a test that rebuilds the permitted vocabulary independently.

There are two exceptions, and both are visible:

1. A configured language model receives the question verbatim.

   Only when this deployment has a language-model provider configured, and only to read the question into a brief. Truncated to 6,000 characters. With no provider configured the brief is built by rules and the sentence never leaves the machine. This deployment: openai — your question is sent to that provider.

2. An enquiry you send is emailed.

   When you submit the hire form, its contents — including the deployment description, which is prefilled from your question if you arrived from an answer — are emailed to the operator and a confirmation is emailed to you, through the configured email provider. With no email provider configured the enquiry is stored and logged, and nothing is delivered.

Which sources this deployment can reach, and how, is listed at /sources. Nothing is sold, and nothing is shared with anyone for advertising.

A nightly retention job deletes research runs that have no owner and are older than 30 days, together with their queries, results and recommendations. It removes up to 500 runs per pass.

Two honest limits on that sentence, because they are true of the software as it stands:

• The second copy of the question — the query log that records what was asked and the brief it produced — is not swept by that job. It is removed when an account is deleted; for an anonymous question it currently persists.

• The job only runs on a schedule when the background worker is running. In the default single-process mode there is no scheduler, and an operator has to run it.

• Enquiries, cached responses and rate-limit buckets are not covered by any scheduled deletion.

Sessions expire after 30 days and are refreshed while you keep using the site. Retrieved documents, claims and evidence are not personal data and are kept — they are what makes an old answer checkable.

If you have an account, go to your account page. You can delete one run at a time, or delete the account. Deleting the account happens in a single transaction and requires typing a confirmation.

There is no self-service export. An anonymous run cannot be deleted from the interface, because nothing connects it to you — that is also why nothing about it can be produced on request.

• No analytics. There is no analytics product, no tag manager, no product-analytics SDK and no error-reporting SDK in this application.

• No third-party trackers, pixels, embeds or advertising of any kind.

• No third-party requests to render a page. Fonts are served from this origin; there is no request to a font host, a CDN or anything else.

• No profiling, no behavioural scoring, and no automated decision about you.

• No raw IP address in the research path — only a salted, one-way hash used for rate limiting.

A visitor who never signs in receives no cookies at all. Signing in sets four strictly-necessary cookies, all belonging to the authentication library: the session token, a short-lived signed cache of the session, and two the library keeps for its own bookkeeping. Signing out or deleting the account clears them.

Your light-or-dark preference is stored in your browser’s local storage, not in a cookie, and is never sent to the server. Nothing else is written to local storage.

An answer is meant to be shared, so a run that has no owner is readable by anyone holding its link. It is not listed anywhere and search engines are told not to index it, but the link is the only thing protecting it. A run that belongs to an account is private, and a request for it from anyone else is answered as if it did not exist.

An administrator of this deployment can read the questions and answers in the admin console, including anonymous ones, because that is where moderation and failure diagnosis happen. Administrative actions are recorded.

The terms of use cover what the service is and is not. How we research describes what happens to a question after it is stored.