This practice argues that a claim should carry visible evidentiary status. It would be strange to make that argument and then describe our own data handling in the usual vague terms, so this page names each thing we keep, where it is kept, how long it lasts, and whether it is tied to you at all.
The inventory below is derived from the code rather than written alongside it. A test in this repository reads the codebase and fails the build if we set a cookie or write to a store that this page does not list — because the ordinary way a privacy policy becomes false is not a lie but a deploy, and nothing about that failure is visible while it happens.
Cookies
One, and only if you sign in. There are no advertising cookies, no cross-site trackers, and no consent banner to dismiss — because there is nothing here that would need consent.
ppl_session
Tied to your email address · Thirty days, renewed as you use the site. Signing out destroys it here and on the server, so a copy of the cookie is no use afterwards.
A random session identifier. It is not your email address — it is a reference our server exchanges for one. It cannot be read by scripts in your browser (httpOnly), is not sent to other sites (SameSite=Lax), and travels only over HTTPS.
What is stored
Each row is a real key in our store, named as the code writes it.
ppl:auth:session:…
Tied to your email address · Until the session expires or you sign out.
The email address your session belongs to.
ppl:auth:link:…
Tied to your email address · Fifteen minutes, and it is deleted the moment it is used — a link followed twice signs you in once.
A sign-in link, stored as a SHA-256 hash rather than the link itself, so the stored value cannot be used to sign in as you.
ppl:auth:links:…
Tied to your email address · The rest of the day.
A count of how many sign-in links your address has asked for today, so nobody can use this form to flood your inbox.
tool:… / custodian:…
Tied to your IP address · Until the end of the day, then it expires by itself.
A count of how many analyses or searches you have run today, against the published free allowance. Signed in, the count is kept against your email address. NOT SIGNED IN, IT IS KEPT AGAINST YOUR IP ADDRESS — which is the one piece of information here you did not choose to give us. It is a count and a date; it is never attached to what you asked.
ppl:entitlement:…
Tied to your email address · Until it expires.
Which access tier you bought and when it ends. No card details — those never reach this site at all.
ppl:custodian:sources
Carries nothing that names you · The most recent 500 entries. Older ones fall off as new ones arrive.
The last 500 questions put to the Custodian, with how well the published corpus covered each and exactly which records and web pages were read. This exists so the practice can account for what its own advisor has been drawing on — provenance work that cannot say where its sources came from is holding others to a standard it does not meet. It deliberately carries NO IP ADDRESS, NO SESSION AND NO COOKIE: it is a record of the Custodian, not of the people talking to it, and the code has a test that makes adding any field to it require saying out loud why that field is about the Custodian.
ppl:custodian:gaps
Carries nothing that names you · Kept as a research list; not automatically deleted.
When the Custodian cannot ground an answer it records the gap so the research can be done. THAT RECORD INCLUDES YOUR QUESTION AND THE PRECEDING TURNS OF YOUR CONVERSATION, and it is emailed to Charlotte. If you would not want a question read by a person, do not put it to the Custodian.
ppl:social:…
Carries nothing that names you · Kept as working records of the practice.
The practice’s own social media drafts, approvals and platform credentials. Nothing here comes from visitors, and nothing about a visitor is ever sent to a social platform.
Two of those deserve to be read rather than skimmed. The allowance counter is kept against your IP address when you are not signed in — the one piece of information on this page you did not choose to give us. And a flagged research gap carries your question and the preceding turns of your conversation, and is emailed to Charlotte. If you would not want a question read by a person, do not put it to the Custodian.
What is not kept
Things people reasonably assume are kept, and are not:
- The photograph you upload to the Tool. It is passed to the model inside the request and is never written to disk, to storage, or to any log. When the request ends it is gone.
- Your conversation with the Custodian, except where a research gap is flagged, above. The transcript on your screen lives in your own browser and ends with the tab — it is not sent anywhere to be stored.
- Your card details. Payment happens on Stripe’s own pages; this site never sees a card number.
- Any advertising or cross-site tracking identifier. There are none on this site, and the analytics we do use sets no cookie and does not follow you to other sites.
Who else sees it
This site is small and runs on other people's infrastructure. Everyone below necessarily handles some of what is described above.
Anthropic
The question you ask the Custodian, or the photograph and description you give the Tool. Both surfaces are answered by a Claude model, so what you submit is sent to Anthropic to be answered.
Web search, through Anthropic
The Custodian reads openly available sources at the time you ask, so search terms derived from your question reach a search service. The Tool does not do this — it fetches nothing from any website.
Upstash (Redis)
Everything in the table above is stored with them.
Vercel
Hosts the site, so it handles every request, including your IP address. Vercel Web Analytics counts page views without setting a cookie and without tracking visitors between sites.
Stripe
Your payment, if you make one, and the email address and brief you give at checkout. Card details go to Stripe and not to us.
Resend
Your email address, to deliver a sign-in link or a message about an engagement.
Nothing about a visitor is sent to any social platform. The accounts this practice posts from are its own.
Asking us about your data
Write to Charlotte through the contact page and say what you want to know, corrected or deleted. Signing out destroys your session on the server as well as in your browser. A day's allowance counter expires by itself overnight, and consultation log entries fall off after the most recent five hundred.
If you want the research-gap record of a question removed, say so — it is a short list and it is read by a person, so there is someone to ask.