Privacy

Cookies

hub_sessionEssential

Keeps you signed in. It holds a random value, and the hub stores only a hash of it. It ends when you sign out, 7 days after you signed in, or after 24 hours without use, whichever comes first.

hub_oauthOnly during sign-in

Set only while you sign in with Google or Apple. It holds that sign-in’s check values, encrypted, for up to 10 minutes, and is removed as soon as the sign-in completes.

There are no analytics or advertising cookies.

Your notes

Your notes, documents and conversations live in your own cell: a separate container with its own storage. Your session reaches your cell and no one else’s.

What reaches the AI model

Your Holon answers with Qwen, a cloud model on Alibaba Cloud Model Studio in Singapore, reached through this pilot’s model gateway.

When you ask a question, the question and the parts of your notes, memories and knowledge graph that match it are sent to that model. By default, before they leave your cell, e-mail addresses, phone numbers, wallet addresses, long ID numbers, and the names of people, organisations, places, health conditions, medicines and health readings already in your knowledge graph are replaced with placeholders; the answer is put back together inside your cell. Countries and large cities are the exception: they are sent as written, because a question about a city cannot be answered by a model that is not shown its name. In Sovereignty you can choose what is masked, or stop your notes being sent at all, in which case answers cannot use them.

To make them searchable, the text of every note you add and every message you send is also sent, as written, to the same service’s embedding model, which turns it into numbers used for search. This step does not mask anything. To keep a detail from ever leaving your device, turn on client-side masking in Sovereignty: your browser then replaces it before it is sent.

Two kinds of question also reach a public service, through this pilot’s outbound service and never directly from your cell. A question about the weather in a named city sends that city’s name to open-meteo.com. A message you send with Search Wikipedia switched on is sent to wikipedia.org. A question that names people, organisations or private places from your notes, or that contains an e-mail address, a phone number or a long number, is not sent.

The model gateway records how many tokens each request used, not what was said.

Sign-in records

The hub keeps an audit log of sign-ins and account events. An entry holds the time, the ids of the account and of what was acted on, a short action code, and where relevant a request path, a device name, or the e-mail or wallet address involved.

It never holds the body of a note or message, and never a sign-in link or token.