Privacy
What is stored, who can see it, what is sent out. Updated 24 August 2026.
The short version
- 1.Your consultations are private. Nobody else sees one unless you agree to share it and an administrator then publishes it. An administrator can read any session.
- 2.What you type reaches a model provider — OpenAI or Anthropic — exactly as it would with ChatGPT or Claude. Use your own API key and that happens on your account instead of ours.
- 3.Consultations are kept; Simulator runs are not. Transcripts and design plans are retained so the research can be evaluated. Nothing the Simulator computes survives 24 hours — the one exception is a setup you deliberately save, which holds your own exercise and never a result.
- 4.One cookie, for signing in. No analytics, no advertising, no tracking.
- 5.Not for student data. This is a faculty tool. Do not put student work, grades or records into it.
Who can see your consultations
A consultation transcript holds more of you than the design plan does — what you did not know, what you tried, what you find hard to teach. So it belongs to you by default.
| Session | You | Other members | Administrator |
|---|---|---|---|
| Yours, private | read & write | no access | read & write |
| Yours, published | read & write | read | read & write |
| Somebody else's | no access unless published | same | read & write |
Publishing takes two steps and two people. You consent, from inside the session where you can see what you would be sharing. An administrator then publishes it. Neither step works without the other, and withdrawing your consent un-publishes it immediately.
An administrator can read every session. That is how support, moderation and the research evaluation are possible at all, and it is worth knowing rather than discovering.
What we store
Your account
Name and email, held by Clerk, our sign-in provider. When an account is created — invited or self-serve — the project team gets a Slack message with your name and email so new members are noticed rather than accumulating unseen.
Consultations
The full transcript, the design state it builds up, and the synthesis document. Kept so the research question this project exists to answer — where the consultation helps and where it fails — can be answered.
Requests for user access
Your name, email, affiliation, the reason you gave, and whether you said you already had an account. Reviewed, then used for nothing else.
Library annotations
Notes and stars you add to cases, blocks or elements, with your name on them.
Saved tags
A tag keeps a name and the search behind it, against your account. Private tags are visible only to you — not to other readers, and not to administrators. A public tag belongs to the shared vocabulary rather than to you, and any administrator can rename or remove it. Delete a tag in Settings and it is gone.
Live workshop sessions
If you unlock a live session with a spoken word, the fact that you did is recorded against your account for the length of that session.
What we do not store
Simulator runs
Token-probability measurements, branching walks and decoding comparisons are computed for the request and never written down at all. Agent conversations are the single mechanical exception: a multi-round conversation needs its earlier turns to exist, so they are held while it runs and swept within 24 hours. None of it is kept for evaluation.
A Simulator setup you save
Only if you press Save, and only the inputs — the persona, the question, the answer options, whichever comparison you configured and which models. Never a measurement: a stored number would be a result detached from the run that produced it. It is kept against your account until you delete it, it is visible to you alone, and administrators cannot see it either.
Your API keys
A key you enter in Settings never reaches our database or our logs. It stays in your browser, is attached to the requests it pays for, and is discarded. If this site were breached, your key would not be among what was taken — though it also means we cannot revoke or rotate it for you, and you will need to enter it again on another computer.
Cookies, and what sits in your browser
One cookie. Clerk sets a session cookie so the site knows you are signed in as you move between pages. That is the entire list.
There is no analytics, no advertising, no tracking pixel and no third-party script other than Clerk. That is why you have not been asked to dismiss a cookie banner: a cookie strictly necessary for a service you asked for needs to be disclosed, not consented to.
Separately, a few things live in your browser's own storage and never reach our servers except where noted: your API keys and model choices (sent as a header with the requests they pay for), your scratchpad notes, which items you have starred, and display settings like text size. Clearing this site's data removes all of it, and none of it follows you to another computer.
What goes to OpenAI and Anthropic
Consultations, analyses, Simulator runs and probes are all answered by a commercial model. What you type in them is sent to OpenAI or Anthropic to be answered.
Searching the Knowledge Graph also sends what you type. A search is matched by meaning rather than wording, and that works by sending your query to OpenAI to be turned into a vector before anything is compared. The same is true when you ask for a name to be suggested for a tag: the query goes to a model to be named. Neither is stored by us as a query log — but both leave the site, so a search box is not a more private place to type than a chat box.
By default that runs on this project's API keys, so the provider sees the traffic as ours. Supplying your own key in Settings moves it to your account, under whatever agreement you already have with them — the better option if you are working with anything sensitive.
The practical rule is the one you already use: do not paste anything here you would not paste into ChatGPT. Student records, identifiable work, unpublished material under embargo — treat all of it the same way.
Repositories you analyse
The Analyze tab reads public GitHub repositories. It clones them shallowly and reads files. It never executes what it reads, and it is not a route for processing private or personal data — do not point it at a repository holding student work or anything confidential.
What you can do
Run on your own key
Prompts go to your provider account instead of ours. Settings.
Delete a consultation
From the Workshop list, any time. It leaves your list at once — but it moves to a trash an administrator can still see and restore. If you want one gone for good, ask and it will be purged.
Keep something out of the record entirely
Use the Simulator rather than the Workshop, and do not press Save. Nothing the Simulator computes is retained; a saved setup is the only thing that persists, and only if you ask for it.
Ask what is held about you, or have it removed
Write to us. Annotations, your account, a purge — all fine to ask for.
For any of these: gewu.z2.ai@gmail.com.
Honest limits
This is a small research platform run by an academic lab, not a commercial service with a compliance department. There is no formal retention schedule and no automatic deletion apart from the Simulator sweep, which does not reach a setup you saved — that one is yours to delete. Data sits in a managed Postgres database on Railway, reachable by the project lead.
It has not been reviewed as a system for handling personal data, and it should not be used for any. If what you want to do would involve student data or need an IRB determination, that determination is yours to obtain — and this is probably the wrong venue for it.