@nac3/forge-cli 0.2.0-alpha.5 → 0.2.0-alpha.59z.119

package/dist/docs/PRIVACY_POLICY.md

@@ -0,0 +1,169 @@
+# Yujin Forge -- Privacy Policy
+
+Effective date: 2026-06-04 (draft pending Pablo's approval +
+publication on https://yujin.app/privacy)
+
+Yujin Forge is a development tool. This page describes what data
+it sends to Yujin servers, what we keep, and what we don't.
+
+## Quick summary
+
+- **BYOK chat** (`yf chat` with your own Anthropic / OpenAI /
+  Gemini API key): nothing leaves your machine except the call
+  to the LLM provider you chose. Yujin servers are not in the
+  loop.
+- **Managed flows** (3 of them: `spec-extract`, `spec-plan`,
+  `ai-decorate`): your payload travels to `prompts.yujin.app`
+  so we can compose the prompt + call Claude on your behalf.
+  Required for these features to work.
+- **Everything else** (verb dispatch, file I/O, voice, MCP
+  bridges, audit log, agent runtime): local to your machine.
+
+If you only use BYOK, this policy effectively does not apply to
+you. Read on if you use any of the 3 managed flows.
+
+## 1. What we send (managed flows only)
+
+When you invoke one of these 3 flows:
+
+| Flow | Triggered by | Payload sent |
+|---|---|---|
+| spec-extract | `yf chat` extracting structure from a spec doc | The spec text you supply (markdown, plain text, or a transcript) |
+| spec-plan | `yf chat` generating a plan from extracted spec | The extracted spec object |
+| ai-decorate | `yf migrate --ai-decorate` | The source HTML / JS being decorated to NAC-3 |
+
+Every request also carries:
+- Your `license_key` (so we can verify you're entitled to the
+  flow and meter token usage).
+- A `request_id` (so you can quote it to support when something
+  fails).
+- Forge CLI version (so we know which client capabilities you
+  have).
+
+Nothing else. We do NOT collect:
+- Your local filesystem path, project name, or hostname.
+- Other API keys you have stored in the vault.
+- The contents of files you didn't explicitly pass into the
+  flow.
+- Telemetry of your editor / OS / IDE.
+
+## 2. Why we send it
+
+`prompts.yujin.app` composes the full prompt (using
+Yujin-proprietary prompt engineering) and forwards it to
+Anthropic's Claude. The resulting structured output is returned
+to your CLI. The composed prompt itself is what we keep
+server-side; your payload is the variable input that completes
+it.
+
+This server-side composition is what makes the 3 managed flows
+deliver measurably better output than a naive Claude call.
+
+## 3. What we keep -- and what we don't
+
+**We keep, indefinitely**, the following metadata per request:
+- `request_id`
+- ISO timestamp
+- License key (foreign key into your subscription)
+- Per-flow status code (success / quota / claude-error / etc)
+- Token usage (input + output token counts)
+- Cost in fractional cents
+
+**We DO NOT keep**:
+- Your spec text, HTML, JS, transcripts, or any other content
+  you sent as the payload.
+- The composed prompt that included your payload (it lives in
+  memory only for the request lifetime, then is discarded).
+- Claude's response to you (we forward it; we don't store it).
+
+The "we keep nothing" rule is enforced by infrastructure: the
+request handlers run on stateless compute with no attached
+persistent storage. Structured logs go to a log aggregator
+with payload fields explicitly stripped at emit time.
+
+## 4. Where data is hosted
+
+- `prompts.yujin.app` runs on infrastructure managed by Yujin.
+  Specific region + cloud-provider details are documented
+  internally and disclosed on request to license holders via
+  contact@yujin.app.
+- Claude API calls go to Anthropic; Anthropic's privacy policy
+  applies to those request bodies once they leave our server.
+  We send only the composed prompt + the necessary parameters;
+  we do not opt your data into Anthropic's model training.
+- Logs are aggregated within the same hosting environment.
+
+## 5. Who at Yujin can access this data
+
+Only Yujin staff on incident-response rotation can query the
+logs. Every query is audited. There is no "ops dashboard with
+everyone's traffic" -- direct log access requires 2FA +
+audit trail.
+
+## 6. Your rights
+
+- **Right to deletion.** Email contact@yujin.app referencing
+  your license key; we delete all log entries referencing that
+  license within 30 days. This is free + does not affect your
+  subscription.
+- **Right to access.** Same email address; we export every log
+  row referencing your license as a JSON file and email it to
+  you within 30 days. Also free.
+- **Right to opt out.** You can stop using the 3 managed flows
+  at any time by setting `YF_USE_HITO4_FLOWS=0` in your shell.
+  The BYOK chat keeps working; the 3 managed features become
+  unavailable until you re-enable.
+
+## 7. Cost transparency
+
+Every managed-flow response includes a `billing` envelope:
+
+```json
+{
+  "billing": {
+    "this_call_cost_cents": 0.142,
+    "cumulative_month_cents": 38.50
+  }
+}
+```
+
+The Forge panel renders this in the cost tab so you always
+know what a call costs.
+
+## 8. Adopters building products on Forge
+
+If you publish a product that uses Forge as a tool, your
+end-users' data does NOT pass through `prompts.yujin.app`
+unless your product itself invokes the 3 managed flows on
+their behalf. Forge as a development tool is one thing;
+products built on Forge are a separate trust relationship
+between you and your users.
+
+## 9. Changes to this policy
+
+Material changes (anything that broadens what we collect or
+weakens what we delete) ship with at least 30 days notice via:
+- A banner in `yf chat` panel.
+- An email to the address on file with your license.
+- A git commit to `docs/PRIVACY_POLICY.md` with a clear
+  "BREAKING" tag in the message.
+
+Cosmetic edits (typos, clarifications) ship silently with
+their git commits.
+
+## 10. Contact
+
+All requests (privacy, security disclosure, billing,
+everything else) go to:
+
+- **contact@yujin.app**
+
+For security vulnerabilities, please use the subject prefix
+`[SECURITY]` so we can route quickly. See `docs/SECURITY.md`
+for the full disclosure process.
+
+---
+
+This document is the source of truth. The hosted version at
+https://yujin.app/privacy is a mirror of this markdown,
+regenerated on every `docs/PRIVACY_POLICY.md` commit.