Data and privacy¶
What the browser can send¶
The browser can send validated commands and edited learner text. It sends a signed session token for live session routes.
The browser does not send raw voice audio. Client Whisper changes audio into an editable text draft inside the browser.
Where data lives¶
| Data | Location | Retention rule |
|---|---|---|
| Current learner state | CockroachDB Cloud | Session and projection records. |
| Vectors | CockroachDB DVI | Filtered by learner and concept. |
| Context traces | Server records | Read-only source and filter metadata. |
| Passport files | Private versioned S3 | Manifest-linked artifacts. |
| Session token | Browser session storage | Cleared on reset or session expiry. |
| Whisper audio | Browser runtime | Not sent to Orion. |
Server-only secrets¶
Secrets Manager holds the provider and database values. Lambda reads them. The frontend build does not contain them.
Do not put a provider key in:
VITE_*variables;dist/;- S3 frontend objects;
- browser local storage;
- logs;
- screenshots or evidence.
Learner control¶
The learner can correct or reject a proposal. The learner can forget a memory. The full reset deletes the learner data in scope and returns to onboarding.
Honest disclosure¶
Replay data is synthetic. Live data is only a claim after the external provider and database evidence passes. A runtime label is not proof by itself.