Every query is scoped
The account comes from a signed email session and an explicit signed local-account link. The browser cannot nominate another owner.
ENCRYPTION BOUNDARY
The mirror stores ciphertext.
Your browser holds the key.
The hosted companion mirrors useful views and exposes a small, fixed set of revocable management requests. It never accepts shell commands, arbitrary paths, credentials, or free-form remote execution. An enrolled local device approves each browser once. Compatibility-only v1 aggregate rows remain stored separately until erased, but the current Site does not display them.
DATA CLASSHOSTED?CONTROL
Usage totals + limitsENCRYPTED
AES-GCM ciphertext; source timestamps retained
Tasks + session detailsENCRYPTED
Read-only, bounded to the same recent view as local
Prompt text + summariesLOCAL ONLY
Never included in the hosted mirror
Metrics-only coachIN BROWSER
Uses counts, timestamps, agent labels, projects, and token totals; never prompt or summary text
Zero-knowledge coachIN BROWSER
Deterministic analysis of the already decrypted bounded metadata; no model request
Device summary coachingNOT OFFERED
The hosted mirror omits prompt summaries, leaving no eligible input for this mode
Provider-assisted coachingNOT OFFERED
It would require a new provider request, and Private Coach makes none
Project pathsENCRYPTED
Never plaintext in D1, R2, or server logs
Legacy aggregate totalsV1 RETAINED
Separate D1 totals retained for rollback and account deletion pending retirement; not displayed or merged into the encrypted view
Raw transcripts + console promptsNEVER
Remain on enrolled local devices
Provider credentials + account passwordNEVER
OAuth tokens, API keys, and the master password stay local; the relay receives only a password-derived verifier
Account recovery materialNEVER
The account root and signing secrets stay local
Browser private keyNEVER
Non-exportable WebCrypto key stored in this browser
Account emailHMAC DIRECTORY
The sync relay keys new verification and login records by a secret-derived HMAC and lazily removes legacy plaintext directory keys. The Site database stores only a pseudonymous ID: HMAC-derived for current sign-ins, with dormant SHA-derived IDs migrated when their owner returns.
Verified before display
Signed manifests, content hashes, authenticated encryption, generations, and sequences prevent cross-account or stale-object substitution.
Revocable and erasable
Revoke a device or browser, rotate the view key, or delete the hosted account. Ciphertext deletion is attempted immediately and durably retried after a storage error.
Local approval stays authoritative
The browser can queue only documented fixed-schema requests such as collection refresh, summary generation, or a reconnect prompt. The enrolled device authenticates, validates, leases, and completes each request; credentials and arbitrary commands never enter the channel.
YOUR DATA