What stays on your device
Your conversation history, settings (language, complexity level, font size), chat sessions, bookmarks, and a small anonymous event log are stored only in your browser's local storage. They never leave your device automatically. You can clear them at any time by clearing your browser data, or opt out of the event log entirely (see "What we measure" below).
What is sent to process your questions
When you ask a question, the text of your current conversation is sent to a secure API endpoint (hosted on Supabase, powered by Anthropic's Claude) to generate the Scribe's response. This is the minimum required to provide AI answers.
What we measure (anonymous, local-first)
To understand whether the product is helping seekers — not to retarget, score, or wake them — a small set of anonymous events is logged to your browser's local storage. The buffer is capped at 500 entries and trimmed FIFO. Until a measurement endpoint exists, these events stay on your device.
The events captured are:
message_sent— when you ask a question. Metadata: mode (Ask/Advice/Discuss/Laugh), depth level (Child–Master), locale. Never the question text itself.citation_clicked— when you tap "Read in the Urtext" on a citation.followup_clicked— when you tap a Continue-Exploring suggestion. Metadata: source (static or dynamic).conversation_resumed— when you click Re-send on the "your last question didn't finish" banner.return_visit— once per ≥12-hour gap between page opens. Metadata: locale.crisis_card_shown— when the crisis pre-screen renders. Metadata: locale.crisis_card_path— when you take the "I'm not in crisis" return path (false-positive). Metadata: state.citation_verified— placeholder for the upcoming retrieval-verify pass.
What's never in these events: your name, email, IP address, browser fingerprint, the text of your messages, the text of the AI's answers, the citations themselves, or any identifier of you across sessions. Each event carries only its name, a timestamp, and a tiny whitelist of low-cardinality tags (locale, mode, level, state, source, cached) capped at 32 characters per value.
Opt out at any time: open your browser's developer console and run _acimSetTelemetryOptout(true), or set localStorage.acim_telemetry_optout = "1". A toggle UI is in the backlog. Opting out stops all event capture, including the buffer write, immediately.
What is never collected
No account is required. Used anonymously, no email address, name, or personal identifier is collected. No cross-session tracking of you. No advertising. No third-party analytics. No selling of any data. The anonymous event log described above is local-only until you choose to share it.
Optional account (sync)
If you choose to sign in — with an email address and a password; no verification email is sent — your email and a salted password hash are stored by Supabase Auth solely to operate the account. Signing in adds one thing: your bookmarks, highlights and notes sync to a Postgres table protected by Row-Level Security, readable only by your account. Your conversations are never uploaded — they remain in your browser's localStorage either way. Sign out at any time; synced data can be deleted on request via the contact below.
Third-party services
Google Fonts loads two typefaces (DM Sans, DM Serif Display) — this is a standard web request. The Urtext manuscript is linked from Archive.org. No other third parties receive your data.
Questions? Contact: yehosua@acimurtext.love