Data and system

Your data and security

• Workspace. Your account owns one knowledge base, the workspace; raw/, wiki/ and schema/ live in it, nobody else sees it, and the agent cannot reach other workspaces.
• What leaves the server. When you press auto-ingest, send a chat message or run a deep lint, the note text the agent reads is sent to the model provider you chose (OpenRouter forwards to the model's provider); the 5 no-key trial runs go through the platform's account. Pasted URLs are fetched by the server (the site sees the server, not you); DOIs are looked up at Crossref. Zotero sync reads Zotero with your key. Nothing else is sent to third parties, and there is no telemetry.
• What the agent can and cannot do. Six tools only: read rules, search, read a page, create a page, update a page, list a folder. It cannot update or delete raw/, cannot delete any page, cannot browse the web, and never sees your API key. Every write is versioned and attributed to the agent and model, and can be rolled back. Note that the agent can edit schema/ rules and that source content enters its prompt; version history is your recovery path.
• API key. Encrypted with a key separate from the login secret, only the last four characters are shown, decrypted only when a job starts or when testing the connection, deletable at any time.
• Export. Settings offers the whole wiki as a Markdown zip (with image attachments, opens in Obsidian), plus .bib and CSL-JSON. The zip excludes version history, deleted pages, chat transcripts and agent job logs.
• Sources cannot be deleted. raw/ is the immutable source layer: neither the web nor the agent can delete it. Press Archive on a source you no longer want to see; it moves under raw/archive/, drops out of the pending list, keeps versions and links, and can be unarchived any time.
• Retention. The latest version of every page is kept forever, older snapshots for 90 days; deleting the account deletes the workspace and everything in it.
• Location and open source. Hosted data is planned to live in Singapore; the privacy policy at launch is authoritative. The code will be released under AGPL-3.0 and self-hosts with docker compose.

How the system works

One Node service serves the MCP server, the web API, the OAuth authorization server and the web app; all data lives in PostgreSQL; there is no vector database and no RAG. The plan gate is checked when an agent job starts; rate limits on every request.

How knowledge flows between the three layers (the operations run in Cursor/Claude via MCP, or in the web agent with your key):