What stays in your browser
Fit answers and the resulting assessment remain in the current browser page’s memory. Continuing to Design uses an ephemeral in-memory handoff; direct Fit JSON import is parsed locally. Decisagent does not send these inputs to a Fit API, save them in the research database, put them in a shareable URL, or use them for model training. Resetting or closing the page clears the working state. JSON, Markdown, and print exports are generated locally.
Decision Assurance is local-first
A new Assurance Case begins in memory. Design JSON, Implementation Pack ZIPs, implementation receipts, existing cases, and selected evidence files are parsed locally. A selected evidence file is hashed in the browser and its bytes are discarded; the case retains only the bounded file identity you can review. Decisagent does not upload the case merely because you import, edit, or export it.
Saving a case on the device requires an explicit action and uses browser IndexedDB. Resume and delete act only on that local browser store. Decisagent provides no account, hosted case database, cross-device sync, or server recovery for local cases. Exported copies remain under your control and are not deleted when you delete the browser copy.
Public Design has no model request
The canonical Decision Design workflow is deterministic. Its public runtime does not expose model assistance and has no OpenAI credential. A separately configured exact-owner environment may offer experimental/bounded synthesis after explicit consent; that protected environment is not part of the public product, analytics, or search surface. Zero Data Retention is unproven and is not asserted.
Optional paid Implementation Pack processing
Only after explicit consent, the validated Fit input, deterministic local Decision Design, and bounded readiness answers are sent over HTTPS to the separate Decisagent commerce runtime. They are stored privately under opaque identifiers long enough to create and deliver the deterministic ZIP. Unpaid source is deleted within 24 hours. Paid source is deleted after successful generation as soon as operationally safe. The private ZIP is retained for 30 days for verified re-download, then deleted. Content-free payment and fulfillment receipts may remain longer for operations and accounting.
The Pack generator does not call a model. Private objects are not publicly addressable. Stripe receives payment and checkout data under its own services; Decisagent does not receive card details and does not use customer email as an analytics identifier.
Cloudflare transiently uses an IP-derived key to rate-limit checkout and purchase-retrieval requests for abuse prevention. Decisagent application code does not write that IP or key to D1, private object storage, PostHog, or application logs, and the rate-limit window is not used to identify or profile a visitor.
What public analytics can receive
The public Reference, Fit, Design, Assurance, and product application may emit coarse events such as normalized landing route, bounded acquisition channel, assessment stage, posture, recommended design capability, bounded Assurance lifecycle action, export format, product view, opaque checkout-attempt ID, fixed public SKU/price, fulfillment result, download, and closed feedback category. Assurance analytics contain only allowlisted schema versions, closed enums, and bucketed counts. Full referrers, search queries, arbitrary campaign values, decision descriptions, evidence descriptions, gate rationale, reviewer names, case content, implementation references, receipt URLs, outcome values, clarifications, specification contents, product-match identity, owner names, company names, source-system names, provider content, email, billing details, and other free text are excluded.
First-touch acquisition state lasts only for the active browser session. Decisagent does not create cross-site tracking or durable person profiles. When Do Not Track or Global Privacy Control is enabled, public analytics initialization, capture, and acquisition storage are disabled.
Session Replay
Session Replay is disabled for the initial canonical release. The independent kill switch and total-masking configuration remain available for a future separately verified release; replay cannot be enabled by changing editorial or vendor-publication state.
Private research tooling
The loopback review console and private research tooling never initialize public analytics or Session Replay. Fit, Design, and Assurance data are not written into candidate research, and candidate research is not used as a fallback in any product.
Open Decisagent Fit → · Open Decision Design → · Open Decision Assurance →