openmates 0.12.0-alpha.7 → 0.12.0-alpha.8

package/dist/{chunk-MCIGSMZ2.js → chunk-M5PZQEY2.js}

@@ -26245,6 +26245,9 @@ Only output the final Markdown table. Do NOT include explanations, notes, or any
     }
   },
   chat: {
+    generated_by_cost: {
+      text: "Cost: {credits} credits"
+    },
     new_chat: {
       text: "New chat"
     },
@@ -33037,1014 +33040,1014 @@ As of mid-2026, the severe supply shocks from the 2024\u20132025 avian flu have
           text: "Groq Privacy Policy"
         }
       },
-      revolut_business: {
-        heading: {
-          text: "3.15 Revolut Business (SEPA Bank Transfer)"
-        },
-        description: {
-          text: "We use Revolut Bank UAB (Lithuania, EU) as our receiving bank for SEPA bank transfers. When you choose to pay via bank transfer, we display our Revolut IBAN to you. Revolut notifies us via a cryptographically signed webhook when a transfer arrives. We do not send your personal data to Revolut \u2014 only the transaction reference, amount, and Revolut's own transaction ID are processed."
-        },
-        privacy_policy_link: {
-          text: "Revolut Privacy Policy"
-        }
-      },
-      flightradar24: {
-        heading: {
-          text: "3.16 Flightradar24"
-        },
-        description: {
-          text: 'When you request real flight track data using the "Get flight track" skill, we query Flightradar24 to retrieve historical GPS track data for completed flights. Flightradar24 receives the flight number and departure date. No personal data is shared.'
-        },
-        privacy_policy_link: {
-          text: "Flightradar24 Privacy Policy"
-        }
-      },
-      security_measures: {
-        heading: {
-          text: "4. Security Measures"
-        },
-        intro: {
-          text: "We implement various security measures to protect your account and data in the web application:"
-        },
-        device_fingerprinting: {
-          subheading: {
-            text: "Device Fingerprinting"
+      providers: {
+        payments: {
+          revolut_business: {
+            heading: {
+              text: "3.15 Revolut Business (SEPA Bank Transfer)"
+            },
+            description: {
+              text: "We use Revolut Bank UAB (Lithuania, EU) as our receiving bank for SEPA bank transfers. When you choose to pay via bank transfer, we display our Revolut IBAN to you. Revolut notifies us via a cryptographically signed webhook when a transfer arrives. We do not send your personal data to Revolut \u2014 only the transaction reference, amount, and Revolut's own transaction ID are processed."
+            },
+            privacy_policy_link: {
+              text: "Revolut Privacy Policy"
+            }
           },
-          purpose: {
-            text: "To enhance account security, prevent fraudulent access, and distinguish between new and recognized devices during login and session validation, we collect User-Agent strings (browser, OS, device type information) and IP addresses (used temporarily to derive approximate geo-location like country/city, then discarded from the device record)."
+          heading: {
+            text: "Payment providers (only when you purchase credits)"
           },
-          storage: {
-            text: "A unique, stable hash is generated based on a combination of the collected signals. This hash is the only value stored in the device record. Browser/OS type and derived country code may be used transiently for risk assessment and notifications but are not stored with the device record. Raw IP addresses are NOT stored as part of the device record itself."
+          description: {
+            text: "These providers are only used when you purchase credits, subscribe to monthly auto top-up, or receive a refund. If you never make a purchase, none of your data is shared with them."
           },
-          ip_logging: {
-            text: "For security monitoring and abuse prevention, IP addresses associated with failed login attempts (invalid password or 2FA code) may be logged with limited retention. In addition, certain security/compliance events (e.g., successful backup-code logins) may be logged with IP for audit purposes. IP addresses are also used for rate limiting login attempts."
+          stripe: {
+            heading: {
+              text: "Stripe (primary payment processor)"
+            },
+            description: {
+              text: "Stripe processes one-time credit purchases and monthly auto top-up subscriptions. We send Stripe your email address, a tokenized payment method (we never see your card number), billing address and VAT information when required for invoicing, and transaction metadata."
+            }
           }
-        }
-      },
-      data_categories: {
-        heading: {
-          text: "5. Data Categories We Collect and Process"
-        },
-        intro: {
-          text: "We collect and process the following categories of data to operate and secure our services:"
-        },
-        account: {
-          text: "Account: Email address, username/display name, profile image, locale, and security settings (e.g., 2FA enabled). Email and username are encrypted with your key before storage. We also keep a separate server-side Vault-encrypted copy of your verified email address for mandatory account lifecycle notices, such as account verification, security alerts, and deletion reminders. Passwords are stored as salted hashes."
         },
-        usage: {
-          text: "Usage: Server logs, event timestamps, feature usage, error logs, and device recognition identifiers (hashed). IP addresses may be temporarily processed for security and rate limiting."
-        },
-        content: {
-          text: "Content: Chat messages, prompts, attachments, and uploaded images/videos necessary to deliver the service (subject to moderation where applicable)."
-        },
-        payments: {
-          text: "Payments: Payment method tokens, transaction IDs, billing address and VAT information as required for invoicing (processed primarily by Stripe). We do not store full card numbers."
-        },
-        newsletter: {
-          text: "Newsletter: If you choose to subscribe to our newsletter, we store your email address in encrypted form. Newsletter subscription is optional and separate from account creation \u2014 creating an account does not automatically subscribe you to the newsletter. If you are an OpenMates customer (i.e. you have completed a purchase), we may additionally send you occasional product announcements and service updates about OpenMates' own similar services under the existing-customer exception (\xA77 Abs. 3 UWG / ePrivacy Directive Art. 13(2)). You can object to this at any time in Settings \u2192 Newsletter or via the one-click unsubscribe link in any such email, without affecting your account."
-        },
-        stability_logs: {
-          text: "Stability Logs: To diagnose technical errors, anonymized browser console logs (error messages, component status, connection events) are collected from authenticated users and stored for up to 48 hours. If an error occurs, surrounding context is retained for up to 14 days. No message content, chat titles, names, email addresses, or other personally identifiable information is included. A random session identifier (generated per browser tab, not linked to your account) is used for log correlation. You can disable this at any time in Settings > Privacy > Stability Logs."
-        }
-      },
-      data_retention: {
-        heading: {
-          text: "6. Data Retention"
-        },
-        account: {
-          text: "Account data: Retained until account deletion and completion of related legal obligations."
-        },
-        usage_and_logs: {
-          text: "Usage and logs: Operational logs retained up to 12 months; IPs tied to failed logins up to 30 days for security."
-        },
-        device_fingerprints: {
-          text: "Device fingerprints: Retained until account deletion or manual removal from account settings (when available)."
-        },
-        content: {
-          text: "Content: Retained until the user deletes the content or closes the account, subject to backup cycles."
-        },
-        payments_and_invoices: {
-          text: "Payments and invoices: Retained up to 10 years where required by tax/commercial law."
-        },
-        compliance_logs: {
-          text: "**Compliance logs:** audit logs retained 2 years (BSI \xA734 BDSG); financial compliance logs retained 10 years (AO \xA7147 and HGB \xA7257)"
-        },
-        observability_traces: {
-          text: "**Observability traces:** up to 30 days; user IDs in traces use a hash that rotates every 24 hours, so older traces cannot be joined to a specific user"
-        },
-        user_data_backups: {
-          text: "**User data backups:** 60 days via S3 lifecycle; backups contain only ciphertext encrypted with your own key"
-        }
-      },
-      legal_basis: {
-        heading: {
-          text: "7. Legal Basis for Processing (GDPR)"
-        },
-        contract: {
-          text: "Contract: Processing necessary to perform our contract with you or to take steps at your request prior to entering into a contract (e.g., account creation, delivering web app features)."
-        },
-        consent: {
-          text: "Consent: Processing based on your consent, where applicable (e.g., optional communications, certain analytics or marketing where used). You can withdraw consent at any time."
-        },
-        legitimate_interests: {
-          text: "Legitimate interests: Processing necessary for our legitimate interests, such as service security, fraud prevention, abuse detection, and improving the service, provided these interests are not overridden by your rights and interests."
-        },
-        direct_marketing: {
-          text: "Direct marketing to existing customers: For existing OpenMates customers (users who have completed a purchase), we may rely on Art. 6(1)(f) GDPR (legitimate interests) in combination with \xA77 Abs. 3 UWG and ePrivacy Directive Art. 13(2) to send occasional product announcements, service updates, and marketing about OpenMates' own similar services. Each such email includes a clearly visible one-click unsubscribe link, and you can also manage these preferences at any time in Settings \u2192 Newsletter. You can object to this processing at any time without giving reasons (Art. 21 GDPR)."
-        },
-        legal_obligation: {
-          text: "Legal obligation: Processing necessary to comply with legal obligations (e.g., tax and accounting requirements for invoices and transaction records)."
-        }
-      },
-      legal_rights: {
         heading: {
-          text: "8. Your Privacy Rights"
+          text: "When each provider is used"
         },
         intro: {
-          text: "Depending on your jurisdiction, you may have certain rights over your personal data. The following summarizes key rights under GDPR and CCPA/CPRA and how to exercise them:"
+          text: "Most of the providers below are only reached when you use a specific feature \u2014 for example, image generation providers are only used when you invoke an image skill. The groups below tell you exactly which providers are involved for each feature, so you can opt in or out of data sharing by choosing which features to use."
         },
-        gdpr: {
-          subheading: {
-            text: "GDPR (EU/EEA)"
-          },
-          access: {
-            text: "Right of access"
-          },
-          rectification: {
-            text: "Right to rectification"
+        always_active: {
+          heading: {
+            text: "Always active (used for every user)"
           },
-          erasure: {
-            text: "Right to erasure ('right to be forgotten')"
+          description: {
+            text: "These providers are used for every user, regardless of which features you use. Using OpenMates at all means your data passes through them."
           },
-          restriction: {
-            text: "Right to restriction of processing"
+          vercel: {
+            heading: {
+              text: "Vercel (frontend hosting)"
+            },
+            description: {
+              text: "We use Vercel to host the static frontend of our website and web app. Vercel receives page requests and serves static assets."
+            }
           },
-          portability: {
-            text: "Right to data portability"
+          hetzner: {
+            heading: {
+              text: "Hetzner (backend, database, storage, observability)"
+            },
+            description: {
+              text: "We host all of our backend services \u2014 API servers, Directus CMS, Postgres database, Redis caches, S3-compatible object storage, and our self-hosted OpenObserve observability platform \u2014 on Hetzner infrastructure in the EU. OpenObserve runs on our own Hetzner servers and is not a third-party service; traces never leave the EU."
+            }
           },
-          objection: {
-            text: "Right to object"
+          brevo: {
+            heading: {
+              text: "Brevo (transactional email)"
+            },
+            description: {
+              text: "We use Brevo to send transactional email \u2014 account verification, password reset links, payment receipts, and credit notes \u2014 and, if you opt in, the OpenMates newsletter. If you are an existing OpenMates customer (i.e. you have completed a purchase), we may also send you occasional product announcements and service updates about OpenMates' own similar services under the existing-customer exception (\xA77 Abs. 3 UWG / ePrivacy Directive Art. 13(2)); you can object in Settings \u2192 Newsletter or via the one-click unsubscribe link in any such email. Brevo sees recipient email addresses and the content of the emails we send you."
+            }
           },
-          withdraw_consent: {
-            text: "Right to withdraw consent"
+          ip_api: {
+            heading: {
+              text: "IP-API (IP geolocation)"
+            },
+            description: {
+              text: "We use IP-API to resolve IP addresses to approximate geolocation for abuse prevention, rate limiting, and regional compliance. The resolved country and city are used transiently and are not stored against your account."
+            }
           },
-          exercise: {
-            text: "To exercise your GDPR rights, contact us at contact@openmates.org or via the Imprint. We may need to verify your identity before fulfilling your request."
+          sightengine: {
+            heading: {
+              text: "Sightengine (image and video moderation)"
+            },
+            description: {
+              text: "Every image and video you upload is scanned by Sightengine for safety moderation before it is stored. Sightengine sees the image or video content."
+            }
           },
-          manual_note: {
-            text: "The following rights are available on request (please contact us by email at contact@openmates.org and we will handle them manually):"
+          api_video: {
+            heading: {
+              text: "api.video (product video hosting)"
+            },
+            description: {
+              text: "We use api.video (EU company, France) to host and stream product demo and feature walkthrough videos shown on our website and web app. When you watch a video, your IP address and basic viewing data are processed by api.video. No user account identifiers are shared."
+            }
           }
         },
-        ccpa_cpra: {
-          subheading: {
-            text: "CCPA/CPRA (California)"
+        ai_models: {
+          heading: {
+            text: "AI model providers (only when you use a model that routes through them)"
           },
-          right_to_know: {
-            text: "Right to know/access"
+          description: {
+            text: 'OpenMates routes AI requests to different providers depending on which model you select. Before any message is sent to a provider in this group, your browser replaces real names, emails, and physical addresses with placeholders (see the "PII placeholder substitution" measure above). You can always see which provider a model uses in the model details panel in AI settings.'
           },
-          right_to_delete: {
-            text: "Right to delete"
+          mistral: {
+            heading: {
+              text: "Mistral (EU direct)"
+            },
+            description: {
+              text: "Mistral hosts its own family of models in the EU. Only used when you select a Mistral model. Mistral receives your chat messages with PII placeholders already substituted client-side."
+            }
           },
-          right_to_correct: {
-            text: "Right to correct"
+          aws_bedrock: {
+            heading: {
+              text: "AWS Bedrock (EU region, primary Claude path)"
+            },
+            description: {
+              text: "AWS Bedrock hosts Anthropic Claude models in its Frankfurt EU region. This is the primary path for Claude requests. AWS receives your chat messages with PII placeholders already substituted client-side."
+            }
           },
-          right_to_opt_out_of_sale_or_sharing: {
-            text: "Right to opt-out of sale or sharing"
+          anthropic: {
+            heading: {
+              text: "Anthropic (US, fallback Claude path)"
+            },
+            description: {
+              text: "Anthropic's direct API is used as a fallback path for Claude models when AWS Bedrock is unreachable. Anthropic is based in the US and receives your chat messages with PII placeholders already substituted client-side."
+            }
           },
-          right_to_non_discrimination: {
-            text: "Right to non-discrimination"
+          openai: {
+            heading: {
+              text: "OpenAI (US)"
+            },
+            description: {
+              text: "OpenAI processes requests for GPT-family models when you select one. OpenAI receives your chat messages with PII placeholders already substituted client-side."
+            }
           },
-          exercise: {
-            text: "California residents can exercise CCPA/CPRA rights by contacting us at contact@openmates.org. We do not sell personal information."
-          }
-        }
-      },
-      discord_integration: {
-        heading: {
-          text: "9. Discord Integration"
-        },
-        description: {
-          text: "If you choose to join our Discord community through links provided on this website, please note that Discord will collect and process your data according to their privacy policy. This includes account information, usage data, communication content, and other information as outlined in Discord's privacy policy."
-        },
-        admin_access: {
-          text: "As Discord server administrators, we have access to all public communications, member lists, and other information shared within our Discord community. However, this information is hosted and primarily processed by Discord. We do not extract, store, or process this data outside of Discord's platform. For more information about how Discord handles your data, please review Discord's Privacy Policy."
-        },
-        privacy_policy_link: {
-          text: "Discord Privacy Policy"
-        }
-      },
-      contact: {
-        heading: {
-          text: "10. Contact Information"
-        },
-        questions: {
-          text: "For questions about data protection:"
-        },
-        email: {
-          text: "Email"
-        },
-        postal: {
-          text: "Postal address: See Legal Notice (Imprint) for the current registered address."
-        },
-        controller: {
-          text: "Controller: OpenMates (see Imprint for legal representative details)."
-        }
-      },
-      aggregate_analytics: {
-        heading: {
-          text: "11. Anonymous Aggregate Analytics"
-        },
-        overview: {
-          text: "We collect anonymous, aggregate statistics about how our website and web application are used. This data is genuinely anonymous \u2014 it cannot be linked to any individual user, and no cookies or tracking identifiers are set. No consent banner is required because no personal data is collected."
-        },
-        what_we_collect: {
-          text: "What we collect (all aggregate, never individual):"
-        },
-        items: {
-          text: "Daily page load counts; approximate unique visit counts (probabilistic HyperLogLog, ~0.81% error); country distribution (GeoIP lookup \u2014 IP discarded immediately, never stored); device class (mobile/tablet/desktop); browser family and major version; OS family; referrer domain (domain only, never full URL); screen size class; session duration distribution (bucketed)"
-        },
-        no_pii: {
-          text: "IP addresses are used transiently for GeoIP lookup only and are never written to disk or any database. User-Agent strings are parsed to metadata only (browser name, OS) \u2014 the raw string is never stored. All data is stored as daily aggregate counters, not as individual records."
-        }
-      },
-      follow_up_1: {
-        text: "How is my chat content encrypted?"
-      },
-      follow_up_2: {
-        text: "How does client-side encryption work?"
-      },
-      follow_up_3: {
-        text: "What if I lose my encryption key?"
-      },
-      follow_up_4: {
-        text: "Do AI providers see my messages?"
-      },
-      follow_up_5: {
-        text: "How do I delete my account?"
-      },
-      follow_up_6: {
-        text: "What data do you share with third parties?"
-      },
-      provider_link_label: {
-        text: "Privacy policy"
-      },
-      overview: {
-        heading: {
-          text: "Overview"
-        },
-        summary: {
-          text: "OpenMates is designed so that most of your data is encrypted on your device before it reaches our servers. This is **not** end-to-end encryption: our servers briefly decrypt your content in memory to run AI responses, render invoices, and deliver reminders. But we never write decrypted content to disk, logs, or traces, and when you delete your account we destroy the encryption key that protects your data \u2014 cryptographically shredding every encrypted field we still hold."
-        }
-      },
-      protection: {
-        heading: {
-          text: "How we protect your data"
-        },
-        intro: {
-          text: "We rely on six technical measures to protect your data. Each is verifiable in our open-source code and maps to a specific GDPR obligation."
-        },
-        client_side_encryption: {
-          heading: {
-            text: "Client-side encryption of your content"
+          openrouter: {
+            heading: {
+              text: "OpenRouter (US, routing aggregator)"
+            },
+            description: {
+              text: "OpenRouter is used as a routing aggregator for several third-party models, including Cerebras-hosted models. OpenRouter sees your chat messages with PII placeholders substituted client-side and forwards them to the underlying model host."
+            }
           },
-          description: {
-            text: "Your chat content, titles, summaries, tags, per-chat keys, app settings and memories, reminders, and sensitive profile fields (encrypted username, auto-top-up email, 2FA secrets) are encrypted in your browser before being sent to our servers. The browser uses a key derived from your login credential; our servers reject writes that contain anything but ciphertext. This is *not* end-to-end encryption \u2014 our servers can decrypt your content in memory when they need to (for AI responses, invoice rendering, reminder delivery). The difference from end-to-end encryption is that decryption happens transiently in process memory and the plaintext is never persisted to disk, logs, or traces."
-          }
-        },
-        pii_placeholder_substitution: {
-          heading: {
-            text: "PII placeholder substitution before AI calls"
+          cerebras: {
+            heading: {
+              text: "Cerebras (US, via OpenRouter)"
+            },
+            description: {
+              text: "Cerebras hosts some of the high-speed models routed through OpenRouter. Only used when you select a Cerebras-hosted model."
+            }
           },
-          description: {
-            text: "Before any message is sent to a third-party AI model, your browser scans your message for real names, email addresses, and physical addresses that you have saved in your privacy settings (or that match common patterns) and replaces any matches with neutral placeholders (for example [USER_0]). The mapping back to your real values is stored encrypted with your key and is never decrypted on our servers. **Important limitation:** this substitution only protects personal data that our client-side detector actually recognizes \u2014 typically the values you have explicitly saved in your privacy settings and values highlighted in the message field before you send. Anything the detector does not recognize (typos of your own name, uncommon address formats, other people's personal data, sensitive topics that are not formally PII) will be transmitted as you typed it. Please treat every message as you would treat a note passed to a third-party AI provider and be cautious with personal data."
-          }
-        },
-        encrypted_at_rest: {
-          heading: {
-            text: "Encrypted at rest, decrypted only in memory"
+          google_gemini: {
+            heading: {
+              text: "Google Gemini (US)"
+            },
+            description: {
+              text: "Google Gemini processes requests for Gemini-family models when you select one. Google receives your chat messages with PII placeholders already substituted client-side."
+            }
           },
-          description: {
-            text: "Our PostgreSQL database, Redis caches, S3 object storage, and backup snapshots hold only ciphertext for any field containing user content. When our servers need to read your content to run an AI response, render an invoice, or deliver a reminder, decryption happens transiently in process memory and is discarded immediately after. Key material is released on demand by HashiCorp Vault and never stored in raw form outside it."
-          }
-        },
-        hashed_identifiers: {
-          heading: {
-            text: "Hashed identifiers throughout"
+          google_vertex_maas: {
+            heading: {
+              text: "Google Vertex AI Model-as-a-Service (US)"
+            },
+            description: {
+              text: "Google Vertex AI Model-as-a-Service hosts third-party open models (such as DeepSeek) on Google infrastructure via an OpenAI-compatible endpoint. This is a separate service from Google Gemini: the model weights are third-party, but the inference runs on Google's servers. Only used when you select a MaaS-hosted model."
+            }
           },
-          description: {
-            text: "Your user ID is stored in most database tables as a SHA-256 hash rather than as a direct reference. Login uses a zero-knowledge password verification flow: we verify that you know your password without ever learning it. API-key device records anonymize the IP address to its first two octets before encryption, so we can recognize a device without storing a precise location."
-          }
-        },
-        cryptographic_erasure: {
-          heading: {
-            text: "Cryptographically shredded on deletion"
+          together: {
+            heading: {
+              text: "Together AI (US)"
+            },
+            description: {
+              text: "Together AI hosts third-party models such as Kimi K2.6 on an OpenAI-compatible endpoint. Only used when you select a Together-hosted model. Together receives your chat messages with PII placeholders already substituted client-side."
+            }
           },
-          description: {
-            text: "When you delete your account we destroy your HashiCorp Vault Transit key in addition to removing your rows from our database. Any encrypted field still sitting in a backup, cache, or running process becomes mathematically unrecoverable ciphertext at that moment \u2014 cryptographic erasure on top of row-level deletion."
-          }
-        },
-        observability_without_tracking: {
-          heading: {
-            text: "Observability without tracking"
+          groq: {
+            heading: {
+              text: "Groq (US, content sanitization)"
+            },
+            description: {
+              text: "Groq is used server-side to sanitize external content (search results and scraped web pages) before it is included in AI responses. Groq sees the external content we fetched on your behalf, not your chat messages, and never learns which user requested each piece of content."
+            }
           },
-          description: {
-            text: "Our internal tracing pipeline (OpenTelemetry) replaces your user ID with a hash that rotates every 24 hours, strips authentication headers and cookies from every span, and redacts chat content before any trace leaves the backend. Our web analytics use a server-side beacon with no cookies and no stored individual identifiers. We do not use Google Analytics, Plausible, PostHog, or any third-party analytics platform."
-          }
-        }
-      },
-      promises: {
-        intro: {
-          text: "Below are the privacy promises we make to every user. Each one is backed by code in our open-source repository and verified by automated tests. When the enforcing code changes, a registry-linked check reminds us to rerun those tests before release."
-        },
-        client_side_chat_encryption: {
-          heading: {
-            text: "Client-side chat encryption"
+          alibaba: {
+            heading: {
+              text: "Alibaba Cloud (Qwen models)"
+            },
+            description: {
+              text: "Alibaba Cloud hosts Qwen-family models. Alibaba receives your chat messages with PII placeholders already substituted client-side only when you select an Alibaba-hosted model."
+            }
           },
-          description: {
-            text: "Your chats, settings, and memories are encrypted on your device with AES-256-GCM before they leave your browser. The server stores only ciphertext on disk, in caches, and in backups. This is not end-to-end encryption: when a server-side task needs to read content (to run an AI response, render an invoice, or deliver a reminder), it decrypts in memory via HashiCorp Vault and discards the plaintext immediately after use."
+          deepseek: {
+            heading: {
+              text: "DeepSeek (reasoning models)"
+            },
+            description: {
+              text: "DeepSeek provides DeepSeek-family reasoning models. DeepSeek receives your chat messages with PII placeholders already substituted client-side only when you select a DeepSeek model."
+            }
+          },
+          moonshot: {
+            heading: {
+              text: "Moonshot AI / Kimi (language models)"
+            },
+            description: {
+              text: "Moonshot AI provides Kimi-family models. Moonshot receives your chat messages with PII placeholders already substituted client-side only when you select a Moonshot-hosted Kimi model."
+            }
+          },
+          zai: {
+            heading: {
+              text: "Z.ai (GLM models)"
+            },
+            description: {
+              text: "Z.ai provides GLM-family models. Z.ai receives your chat messages with PII placeholders already substituted client-side only when you select a Z.ai model."
+            }
           }
         },
-        email_encryption_at_rest: {
+        image_generation: {
           heading: {
-            text: "Email addresses encrypted at rest"
+            text: "Image generation and editing (only when you use an image skill)"
           },
           description: {
-            text: "Your email address is stored only as ciphertext. The server decrypts it transiently in memory during login, billing, and notification delivery, and never writes plaintext to disk or logs."
+            text: "These providers are only used when you invoke an image generation or editing skill. If you never use the images app, none of your data is shared with them."
+          },
+          fal: {
+            heading: {
+              text: "FAL (Flux models)"
+            },
+            description: {
+              text: "FAL hosts Flux image generation models used by the images.generate_draft skill. FAL receives your image generation prompts and, when editing, the source images you supply."
+            }
+          },
+          recraft: {
+            heading: {
+              text: "Recraft (vector and raster image generation)"
+            },
+            description: {
+              text: "Recraft powers the images.generate and images.vectorize skills, producing vector and raster images and converting bitmaps to SVG. Recraft receives your prompts, style preferences, and \u2014 when vectorizing \u2014 your source images."
+            }
+          },
+          bfl: {
+            heading: {
+              text: "Black Forest Labs (FLUX image models)"
+            },
+            description: {
+              text: "Black Forest Labs powers draft image generation via FLUX models. BFL receives your image generation prompts and, when editing, the source images you provide."
+            }
           }
         },
-        no_third_party_tracking: {
+        music_generation: {
           heading: {
-            text: "No third-party tracking cookies or analytics"
+            text: "Music generation (only when you use a music skill)"
           },
           description: {
-            text: "We do not use Google Analytics, Plausible, PostHog, Mixpanel, Amplitude, Segment, or any other third-party analytics platform. Our telemetry is server-side, cookie-free, and contains no individually stored identifiers. A pre-edit check in our repository blocks the introduction of analytics SDKs."
+            text: "These providers are only used when you invoke a music generation skill. If you never use the music app, none of your data is shared with them."
+          },
+          google_vertex_ai: {
+            heading: {
+              text: "Google Vertex AI (Lyria music generation)"
+            },
+            description: {
+              text: "Google Vertex AI hosts the Lyria models used by the music.generate skill. Google receives your music generation prompts, optional lyrics, style preferences, and generation settings only when you ask OpenMates to generate music or background music."
+            }
           }
         },
-        pii_placeholder_substitution: {
+        code_execution: {
           heading: {
-            text: "Personal information never reaches AI providers"
+            text: "Code and developer tools (only when you use code skills)"
           },
           description: {
-            text: "Before any message is sent to an AI provider, your browser detects 32 categories of personal data \u2014 emails, phone numbers, credit card numbers, API keys, and more \u2014 and replaces them with placeholders like `[EMAIL_com]`. The substitution map is encrypted with your chat key so only your devices can restore the original values."
-          }
-        },
-        telemetry_privacy_filter: {
-          heading: {
-            text: "Telemetry stripped of sensitive data"
-          },
-          description: {
-            text: "Our internal tracing pipeline (OpenTelemetry) strips authentication headers, cookies, and database statements from every span, and pseudonymises your user ID with a salt that rotates every 24 hours. Regular users never have their raw identifiers in telemetry."
-          }
-        },
-        cryptographic_erasure: {
-          heading: {
-            text: "Deleted accounts are cryptographically erased"
-          },
-          description: {
-            text: "When you delete your account, the first step destroys your encryption keys. Any residual ciphertext in backups, caches, or audit logs is rendered permanently unreadable \u2014 no key, no content."
-          }
-        },
-        argon2_password_hashing: {
-          heading: {
-            text: "Passwords stored as Argon2 hashes"
-          },
-          description: {
-            text: "We store password and backup-code verifiers as Argon2 hashes. Plaintext passwords are never persisted to disk, never written to logs, and never recoverable \u2014 even by us."
-          }
-        },
-        payment_data_minimization: {
-          heading: {
-            text: "No card numbers ever touch our servers"
-          },
-          description: {
-            text: "Payments flow directly from your browser to Stripe. We store only provider tokens and customer identifiers. We never see, receive, or persist full card numbers, security codes, or bank account details."
-          }
-        },
-        logging_redaction: {
-          heading: {
-            text: "Logs are scrubbed of sensitive data"
-          },
-          description: {
-            text: "Every log line passes through a redaction filter that strips email addresses, IP addresses, bearer tokens, and password values. Compliance logs preserve pseudonymous user IDs but remove all other personal data."
-          }
-        },
-        prompt_injection_defense: {
-          heading: {
-            text: "Defense against prompt injection"
-          },
-          description: {
-            text: "Two layers protect your conversations from malicious content in web pages, files, and URLs you reference. Invisible Unicode characters are stripped first, then a dedicated safety model detects semantic injection attempts and blocks or replaces high-risk content before it reaches your assistant."
-          }
-        },
-        no_training_on_user_data: {
-          heading: {
-            text: "Your conversations are not used to train AI models"
-          },
-          description: {
-            text: "All AI chat providers we use (Anthropic, OpenAI, Mistral, Google Gemini, Google Vertex AI, Together AI, Groq, Cerebras, and OpenRouter) have explicit no-training clauses in their terms \u2014 your conversations are never used to fine-tune, evaluate, or otherwise train AI models. For image generation, Recraft has a training opt-out which we have activated. fal.ai (used for draft image generation) may use anonymized, aggregated derivatives of prompts for model improvement under their standard API terms; no full opt-out is available outside an enterprise contract. A per-provider audit with verbatim policy quotes and verification dates is published in our open-source repository."
-          }
-        },
-        no_external_resources: {
-          heading: {
-            text: "The web app never loads external images or scripts"
-          },
-          description: {
-            text: "Every external image, favicon, or preview shown in the app is fetched through our own preview.openmates.org proxy \u2014 the originating website never sees your IP address. The only third-party script the web app loads is the Stripe payment SDK needed to process a purchase, and only when you explicitly open the payment flow. There is no ad network, tag manager, CDN font loader, or third-party analytics library."
-          }
-        },
-        cli_no_credential_prompts: {
-          heading: {
-            text: "The command-line tool never asks for your password"
-          },
-          description: {
-            text: "The OpenMates CLI never prompts you for your email, password, 2FA code, or any other login credential. Authentication uses a browser-based pair-auth handshake: the CLI shows a QR code and URL, you approve the session in your logged-in web browser, and you type a short 6-character binding PIN back into the CLI to confirm. Your credentials never pass through the terminal."
-          }
-        },
-        open_source_transparency: {
-          heading: {
-            text: "Every claim on this page is independently auditable"
-          },
-          description: {
-            text: "OpenMates is open source. Every promise above is backed by code you can read, tests you can run, and architecture documents you can audit in our public repository. Our privacy-promises registry links each claim to the exact files that enforce it."
-          }
-        }
-      },
-      providers: {
-        heading: {
-          text: "When each provider is used"
-        },
-        intro: {
-          text: "Most of the providers below are only reached when you use a specific feature \u2014 for example, image generation providers are only used when you invoke an image skill. The groups below tell you exactly which providers are involved for each feature, so you can opt in or out of data sharing by choosing which features to use."
-        },
-        always_active: {
-          heading: {
-            text: "Always active (used for every user)"
-          },
-          description: {
-            text: "These providers are used for every user, regardless of which features you use. Using OpenMates at all means your data passes through them."
+            text: "These providers are only used when you invoke a code app skill, such as searching public repositories, running code in an isolated sandbox, creating a generated application that auto-starts a short screenshot preview, or explicitly starting a generated application live preview. If you never use the code app, none of your data is shared with them."
           },
-          vercel: {
+          github: {
             heading: {
-              text: "Vercel (frontend hosting)"
+              text: "GitHub (public repository search)"
             },
             description: {
-              text: "We use Vercel to host the static frontend of our website and web app. Vercel receives page requests and serves static assets."
+              text: "GitHub powers the code app's repository search skill. GitHub receives public repository search queries without an OpenMates user identifier."
             }
           },
-          hetzner: {
+          context7: {
             heading: {
-              text: "Hetzner (backend, database, storage, observability)"
+              text: "Context7 (programming documentation lookup)"
             },
             description: {
-              text: "We host all of our backend services \u2014 API servers, Directus CMS, Postgres database, Redis caches, S3-compatible object storage, and our self-hosted OpenObserve observability platform \u2014 on Hetzner infrastructure in the EU. OpenObserve runs on our own Hetzner servers and is not a third-party service; traces never leave the EU."
+              text: "Context7 powers the code app's documentation lookup skill. Context7 receives library names and documentation questions without an OpenMates user identifier."
             }
           },
-          brevo: {
+          e2b: {
             heading: {
-              text: "Brevo (transactional email)"
+              text: "E2B (isolated code sandbox)"
             },
             description: {
-              text: "We use Brevo to send transactional email \u2014 account verification, password reset links, payment receipts, and credit notes \u2014 and, if you opt in, the OpenMates newsletter. If you are an existing OpenMates customer (i.e. you have completed a purchase), we may also send you occasional product announcements and service updates about OpenMates' own similar services under the existing-customer exception (\xA77 Abs. 3 UWG / ePrivacy Directive Art. 13(2)); you can object in Settings \u2192 Newsletter or via the one-click unsubscribe link in any such email. Brevo sees recipient email addresses and the content of the emails we send you."
+              text: "E2B runs selected code embeds, generated application previews, and Remotion video renders inside isolated sandboxes. E2B receives the code or generated application/Remotion files and assets needed to run or render the result, runtime inputs, preview/render logs, and execution output needed to display the sandbox result. This sharing happens when you explicitly run code, create a generated application that auto-starts a short screenshot preview, start/resume an application live preview, or when a Remotion video render auto-starts after the assistant closes an explicit remotion code fence."
             }
+          }
+        },
+        web_and_search: {
+          heading: {
+            text: "Web, search, and content retrieval (only when you use a web or search skill)"
           },
-          ip_api: {
+          description: {
+            text: "These providers are only used when you invoke a web, videos, news, or web-read skill. They see the content of what you search for or the URLs you ask to read, but no user identifier \u2014 they do not know which OpenMates user made each request."
+          },
+          brave: {
             heading: {
-              text: "IP-API (IP geolocation)"
+              text: "Brave Search (web, videos, news)"
             },
             description: {
-              text: "We use IP-API to resolve IP addresses to approximate geolocation for abuse prevention, rate limiting, and regional compliance. The resolved country and city are used transiently and are not stored against your account."
+              text: "Brave Search powers the web, videos, and news search skills. Brave sees the text of your search queries and your country and language preferences for localized results, but no user identifier."
             }
           },
-          sightengine: {
+          firecrawl: {
             heading: {
-              text: "Sightengine (image and video moderation)"
+              text: "Firecrawl (web page scraping)"
             },
             description: {
-              text: "Every image and video you upload is scanned by Sightengine for safety moderation before it is stored. Sightengine sees the image or video content."
+              text: "Firecrawl powers the web read skill, scraping and extracting content from web pages you ask about. Firecrawl sees the URL you requested and the full content of the scraped page."
             }
           },
-          api_video: {
+          webshare: {
             heading: {
-              text: "api.video (product video hosting)"
+              text: "Webshare (rotating proxy)"
             },
             description: {
-              text: "We use api.video (EU company, France) to host and stream product demo and feature walkthrough videos shown on our website and web app. When you watch a video, your IP address and basic viewing data are processed by api.video. No user account identifiers are shared."
+              text: "Webshare provides a rotating proxy for requests to services that would otherwise block us. We route YouTube transcript requests (for the videos get-transcript skill) and doctor appointment searches (for the health search-appointments skill \u2014 see Group H) through Webshare. Webshare sees the URLs we route through it."
             }
-          }
-        },
-        payments: {
-          heading: {
-            text: "Payment providers (only when you purchase credits)"
           },
-          description: {
-            text: "These providers are only used when you purchase credits, subscribe to monthly auto top-up, or receive a refund. If you never make a purchase, none of your data is shared with them."
+          google_maps: {
+            heading: {
+              text: "Google Maps Platform (places search)"
+            },
+            description: {
+              text: "Google Maps powers the places search skill. Google sees the text of your place queries and an approximate location for localized results, but no user identifier."
+            }
           },
-          stripe: {
+          youtube: {
             heading: {
-              text: "Stripe (primary payment processor)"
+              text: "YouTube (video transcripts)"
             },
             description: {
-              text: "Stripe processes one-time credit purchases and monthly auto top-up subscriptions. We send Stripe your email address, a tokenized payment method (we never see your card number), billing address and VAT information when required for invoicing, and transaction metadata."
+              text: "YouTube is queried when you ask OpenMates to retrieve a transcript for a YouTube video. YouTube receives video URLs and requested transcript language preferences without an OpenMates user identifier."
             }
           }
         },
-        ai_models: {
+        travel: {
           heading: {
-            text: "AI model providers (only when you use a model that routes through them)"
+            text: "Travel (only when you use a travel skill)"
           },
           description: {
-            text: 'OpenMates routes AI requests to different providers depending on which model you select. Before any message is sent to a provider in this group, your browser replaces real names, emails, and physical addresses with placeholders (see the "PII placeholder substitution" measure above). You can always see which provider a model uses in the model details panel in AI settings.'
+            text: "These providers are only used when you invoke a travel skill \u2014 flight search, hotel search, or flight tracking. If you never use the travel app, none of your data is shared with them."
           },
-          mistral: {
+          serpapi: {
             heading: {
-              text: "Mistral (EU direct)"
+              text: "SerpAPI (flight and hotel search)"
             },
             description: {
-              text: "Mistral hosts its own family of models in the EU. Only used when you select a Mistral model. Mistral receives your chat messages with PII placeholders already substituted client-side."
+              text: "SerpAPI powers flight and hotel search via its Google Flights and Google Hotels endpoints. SerpAPI receives your search queries \u2014 origin, destination, dates, and preferences \u2014 without a user identifier."
             }
           },
-          aws_bedrock: {
+          flightradar24: {
             heading: {
-              text: "AWS Bedrock (EU region, primary Claude path)"
+              text: "Flightradar24 (flight tracking)"
             },
             description: {
-              text: "AWS Bedrock hosts Anthropic Claude models in its Frankfurt EU region. This is the primary path for Claude requests. AWS receives your chat messages with PII placeholders already substituted client-side."
+              text: "Flightradar24 provides real flight track data when you ask about a specific flight number. It receives IATA flight numbers and departure dates without a user identifier."
             }
           },
-          anthropic: {
+          deutsche_bahn: {
             heading: {
-              text: "Anthropic (US, fallback Claude path)"
+              text: "Deutsche Bahn (train connections)"
             },
             description: {
-              text: "Anthropic's direct API is used as a fallback path for Claude models when AWS Bedrock is unreachable. Anthropic is based in the US and receives your chat messages with PII placeholders already substituted client-side."
+              text: "Deutsche Bahn provides train connection results when you search for rail routes. Deutsche Bahn receives origin, destination, and date search details without an OpenMates user identifier."
             }
           },
-          openai: {
+          flix: {
             heading: {
-              text: "OpenAI (US)"
+              text: "FlixBus / FlixTrain (bus and train connections)"
             },
             description: {
-              text: "OpenAI processes requests for GPT-family models when you select one. OpenAI receives your chat messages with PII placeholders already substituted client-side."
+              text: "Flix provides intercity bus and rail connection results when you search for FlixBus or FlixTrain routes. Flix receives origin, destination, and date search details without an OpenMates user identifier."
             }
+          }
+        },
+        events: {
+          heading: {
+            text: "Events (only when you use the events skill)"
           },
-          openrouter: {
+          description: {
+            text: "These providers are only used when you invoke the events search skill. The specific set of providers called depends on the city and event type you search for."
+          },
+          meetup: {
             heading: {
-              text: "OpenRouter (US, routing aggregator)"
+              text: "Meetup"
             },
             description: {
-              text: "OpenRouter is used as a routing aggregator for several third-party models, including Cerebras-hosted models. OpenRouter sees your chat messages with PII placeholders substituted client-side and forwards them to the underlying model host."
+              text: "Meetup powers event search for community events. Meetup receives your search queries \u2014 city, category, dates \u2014 without a user identifier."
             }
           },
-          cerebras: {
+          luma: {
             heading: {
-              text: "Cerebras (US, via OpenRouter)"
+              text: "Luma"
             },
             description: {
-              text: "Cerebras hosts some of the high-speed models routed through OpenRouter. Only used when you select a Cerebras-hosted model."
+              text: "Luma powers event search for tech, creative, and community events. Luma receives your search queries without a user identifier."
             }
           },
-          google_gemini: {
+          resident_advisor: {
             heading: {
-              text: "Google Gemini (US)"
+              text: "Resident Advisor"
             },
             description: {
-              text: "Google Gemini processes requests for Gemini-family models when you select one. Google receives your chat messages with PII placeholders already substituted client-side."
+              text: "Resident Advisor powers event search for electronic music events. RA receives your search queries without a user identifier."
             }
+          }
+        },
+        health: {
+          heading: {
+            text: "Health appointment search (only when you use the health skill)"
           },
-          google_vertex_maas: {
+          description: {
+            text: `These upstream services are reached through the Webshare rotating proxy (see Group E) only when you invoke the health app's appointment search skill. The queries you send \u2014 for example "dermatologist in Berlin next Tuesday" \u2014 are transmitted without user identifiers, but the content of the query itself can imply a health concern. By invoking the skill you consent to this processing under GDPR Art. 9(2)(a) (explicit consent for special-category data).`
+          },
+          doctolib: {
             heading: {
-              text: "Google Vertex AI Model-as-a-Service (US)"
+              text: "Doctolib (EU)"
             },
             description: {
-              text: "Google Vertex AI Model-as-a-Service hosts third-party open models (such as DeepSeek) on Google infrastructure via an OpenAI-compatible endpoint. This is a separate service from Google Gemini: the model weights are third-party, but the inference runs on Google's servers. Only used when you select a MaaS-hosted model."
+              text: "Doctolib lists doctors and specialists across supported EU regions. We query Doctolib for available appointments matching your criteria, routed through the Webshare proxy, without a user identifier."
             }
           },
-          together: {
+          jameda: {
             heading: {
-              text: "Together AI (US)"
+              text: "Jameda (Germany)"
             },
             description: {
-              text: "Together AI hosts third-party models such as Kimi K2.6 on an OpenAI-compatible endpoint. Only used when you select a Together-hosted model. Together receives your chat messages with PII placeholders already substituted client-side."
+              text: "Jameda lists doctors and specialists across Germany. We query Jameda for available appointments matching your criteria, routed through the Webshare proxy, without a user identifier."
             }
+          }
+        },
+        shopping: {
+          heading: {
+            text: "Shopping (only when you use the shopping skill)"
           },
-          groq: {
+          description: {
+            text: "These providers are only used when you invoke the shopping search skill for live product and price lookups."
+          },
+          rewe: {
             heading: {
-              text: "Groq (US, content sanitization)"
+              text: "REWE (German grocery)"
             },
             description: {
-              text: "Groq is used server-side to sanitize external content (search results and scraped web pages) before it is included in AI responses. Groq sees the external content we fetched on your behalf, not your chat messages, and never learns which user requested each piece of content."
+              text: "REWE's product catalogue is queried for live product and price data when you search German grocery items. REWE receives your search queries without a user identifier."
             }
           },
-          alibaba: {
+          amazon: {
             heading: {
-              text: "Alibaba Cloud (Qwen models)"
+              text: "Amazon"
             },
             description: {
-              text: "Alibaba Cloud hosts Qwen-family models. Alibaba receives your chat messages with PII placeholders already substituted client-side only when you select an Alibaba-hosted model."
+              text: "Amazon's product catalogue is queried for live product and price data. Amazon receives your search queries without a user identifier."
             }
+          }
+        },
+        nutrition: {
+          heading: {
+            text: "Nutrition (only when you use the recipe search skill)"
           },
-          deepseek: {
+          description: {
+            text: "These providers are only used when you invoke the nutrition recipe search skill. They receive recipe search queries and selected dietary filters without a user identifier."
+          },
+          edamam: {
             heading: {
-              text: "DeepSeek (reasoning models)"
+              text: "Edamam"
             },
             description: {
-              text: "DeepSeek provides DeepSeek-family reasoning models. DeepSeek receives your chat messages with PII placeholders already substituted client-side only when you select a DeepSeek model."
+              text: "Edamam's Recipe Search API is queried when you search for recipes. Edamam receives the recipe query and selected dietary or nutrition filters without a user identifier."
             }
+          }
+        },
+        electronics: {
+          heading: {
+            text: "Electronics (only when you use the electronics skill)"
           },
-          moonshot: {
+          description: {
+            text: "These providers are only used when you invoke the electronics component search skill for live component and reference-design lookups."
+          },
+          ti_webench: {
             heading: {
-              text: "Moonshot AI / Kimi (language models)"
+              text: "Texas Instruments WEBENCH (US)"
             },
             description: {
-              text: "Moonshot AI provides Kimi-family models. Moonshot receives your chat messages with PII placeholders already substituted client-side only when you select a Moonshot-hosted Kimi model."
+              text: "TI WEBENCH is queried for power converter component candidates and reference design summaries. Texas Instruments receives the electrical requirements you search for, such as input voltage, output voltage, output current, temperature, isolation, and optimization goal, without a user identifier."
             }
+          }
+        },
+        mail: {
+          heading: {
+            text: "Mail (only when you use mail skills)"
           },
-          zai: {
+          description: {
+            text: "This provider is only used when you invoke mail skills against a connected mailbox. If you never use the mail app, none of your data is shared with it."
+          },
+          protonmail: {
             heading: {
-              text: "Z.ai (GLM models)"
+              text: "Proton Mail (mail search)"
             },
             description: {
-              text: "Z.ai provides GLM-family models. Z.ai receives your chat messages with PII placeholders already substituted client-side only when you select a Z.ai model."
+              text: "Proton Mail is queried when you search a connected Proton Mail mailbox. Proton receives the mail search query and mailbox data needed to return matching results."
             }
           }
         },
-        image_generation: {
+        home: {
           heading: {
-            text: "Image generation and editing (only when you use an image skill)"
+            text: "Home and housing (only when you use housing search)"
           },
           description: {
-            text: "These providers are only used when you invoke an image generation or editing skill. If you never use the images app, none of your data is shared with them."
+            text: "These providers are only used when you invoke the home app's housing search skill. If you never search for housing, none of your data is shared with them."
           },
-          fal: {
+          immoscout24: {
             heading: {
-              text: "FAL (Flux models)"
+              text: "ImmoScout24 (German housing search)"
             },
             description: {
-              text: "FAL hosts Flux image generation models used by the images.generate_draft skill. FAL receives your image generation prompts and, when editing, the source images you supply."
+              text: "ImmoScout24 is queried when you search German housing listings. ImmoScout24 receives housing search queries, locations, filters, and listing pages requested without an OpenMates user identifier."
             }
           },
-          recraft: {
+          kleinanzeigen: {
             heading: {
-              text: "Recraft (vector and raster image generation)"
+              text: "Kleinanzeigen (German classified housing search)"
             },
             description: {
-              text: "Recraft powers the images.generate and images.vectorize skills, producing vector and raster images and converting bitmaps to SVG. Recraft receives your prompts, style preferences, and \u2014 when vectorizing \u2014 your source images."
+              text: "Kleinanzeigen is queried when you search German classified housing listings. Kleinanzeigen receives housing search queries, locations, filters, and listing pages requested without an OpenMates user identifier."
             }
           },
-          bfl: {
+          wg_gesucht: {
             heading: {
-              text: "Black Forest Labs (FLUX image models)"
+              text: "WG-Gesucht (German shared-apartment search)"
             },
             description: {
-              text: "Black Forest Labs powers draft image generation via FLUX models. BFL receives your image generation prompts and, when editing, the source images you provide."
+              text: "WG-Gesucht is queried when you search German shared-apartment or rental listings. WG-Gesucht receives housing search queries, locations, filters, and listing pages requested without an OpenMates user identifier."
             }
           }
         },
-        music_generation: {
+        community: {
           heading: {
-            text: "Music generation (only when you use a music skill)"
+            text: "Community and developer channels (only if you choose to use them)"
           },
           description: {
-            text: "These providers are only used when you invoke a music generation skill. If you never use the music app, none of your data is shared with them."
+            text: "These providers are only involved if you choose to join our community or developer channels. You can use OpenMates without ever touching them."
           },
-          google_vertex_ai: {
+          discord: {
             heading: {
-              text: "Google Vertex AI (Lyria music generation)"
+              text: "Discord (community server)"
             },
             description: {
-              text: "Google Vertex AI hosts the Lyria models used by the music.generate skill. Google receives your music generation prompts, optional lyrics, style preferences, and generation settings only when you ask OpenMates to generate music or background music."
+              text: "If you join the OpenMates community Discord server, Discord will see anything you post on its platform, plus your Discord username and whatever data Discord itself collects per its own privacy policy. We have no control over what Discord does with that data."
+            },
+            admin_access: {
+              text: "OpenMates administrators with Discord server admin rights can read all messages posted in the OpenMates Discord server. Do not share sensitive information on Discord."
             }
           }
         },
-        code_execution: {
+        social_media: {
           heading: {
-            text: "Code and developer tools (only when you use code skills)"
+            text: "Social media (only when you use social media skills)"
           },
           description: {
-            text: "These providers are only used when you invoke a code app skill, such as searching public repositories, running code in an isolated sandbox, creating a generated application that auto-starts a short screenshot preview, or explicitly starting a generated application live preview. If you never use the code app, none of your data is shared with them."
+            text: "These providers are only used when you invoke the social media app's get-posts or search skills. They receive public profile, page, or search queries without an OpenMates user identifier."
           },
-          github: {
+          reddit: {
             heading: {
-              text: "GitHub (public repository search)"
+              text: "Reddit (public posts and discussions)"
             },
             description: {
-              text: "GitHub powers the code app's repository search skill. GitHub receives public repository search queries without an OpenMates user identifier."
+              text: "Reddit is queried when you fetch or search public Reddit posts. Reddit receives subreddit names, public post URLs, and search queries without an OpenMates user identifier."
             }
           },
-          context7: {
+          bluesky: {
             heading: {
-              text: "Context7 (programming documentation lookup)"
+              text: "Bluesky (public posts and profile feeds)"
             },
             description: {
-              text: "Context7 powers the code app's documentation lookup skill. Context7 receives library names and documentation questions without an OpenMates user identifier."
+              text: "Bluesky is queried when you fetch or search public Bluesky posts. Bluesky receives handles and search queries without an OpenMates user identifier."
             }
           },
-          e2b: {
+          mastodon: {
             heading: {
-              text: "E2B (isolated code sandbox)"
+              text: "Mastodon (public profile posts)"
             },
             description: {
-              text: "E2B runs selected code embeds, generated application previews, and Remotion video renders inside isolated sandboxes. E2B receives the code or generated application/Remotion files and assets needed to run or render the result, runtime inputs, preview/render logs, and execution output needed to display the sandbox result. This sharing happens when you explicitly run code, create a generated application that auto-starts a short screenshot preview, start/resume an application live preview, or when a Remotion video render auto-starts after the assistant closes an explicit remotion code fence."
+              text: "Mastodon is queried when you fetch public Mastodon profile posts. The relevant Mastodon server receives profile identifiers or public profile URLs without an OpenMates user identifier."
             }
           }
+        }
+      },
+      flightradar24: {
+        heading: {
+          text: "3.16 Flightradar24"
         },
-        web_and_search: {
-          heading: {
-            text: "Web, search, and content retrieval (only when you use a web or search skill)"
+        description: {
+          text: 'When you request real flight track data using the "Get flight track" skill, we query Flightradar24 to retrieve historical GPS track data for completed flights. Flightradar24 receives the flight number and departure date. No personal data is shared.'
+        },
+        privacy_policy_link: {
+          text: "Flightradar24 Privacy Policy"
+        }
+      },
+      security_measures: {
+        heading: {
+          text: "4. Security Measures"
+        },
+        intro: {
+          text: "We implement various security measures to protect your account and data in the web application:"
+        },
+        device_fingerprinting: {
+          subheading: {
+            text: "Device Fingerprinting"
           },
-          description: {
-            text: "These providers are only used when you invoke a web, videos, news, or web-read skill. They see the content of what you search for or the URLs you ask to read, but no user identifier \u2014 they do not know which OpenMates user made each request."
+          purpose: {
+            text: "To enhance account security, prevent fraudulent access, and distinguish between new and recognized devices during login and session validation, we collect User-Agent strings (browser, OS, device type information) and IP addresses (used temporarily to derive approximate geo-location like country/city, then discarded from the device record)."
           },
-          brave: {
-            heading: {
-              text: "Brave Search (web, videos, news)"
-            },
-            description: {
-              text: "Brave Search powers the web, videos, and news search skills. Brave sees the text of your search queries and your country and language preferences for localized results, but no user identifier."
-            }
+          storage: {
+            text: "A unique, stable hash is generated based on a combination of the collected signals. This hash is the only value stored in the device record. Browser/OS type and derived country code may be used transiently for risk assessment and notifications but are not stored with the device record. Raw IP addresses are NOT stored as part of the device record itself."
           },
-          firecrawl: {
-            heading: {
-              text: "Firecrawl (web page scraping)"
-            },
-            description: {
-              text: "Firecrawl powers the web read skill, scraping and extracting content from web pages you ask about. Firecrawl sees the URL you requested and the full content of the scraped page."
-            }
+          ip_logging: {
+            text: "For security monitoring and abuse prevention, IP addresses associated with failed login attempts (invalid password or 2FA code) may be logged with limited retention. In addition, certain security/compliance events (e.g., successful backup-code logins) may be logged with IP for audit purposes. IP addresses are also used for rate limiting login attempts."
+          }
+        }
+      },
+      data_categories: {
+        heading: {
+          text: "5. Data Categories We Collect and Process"
+        },
+        intro: {
+          text: "We collect and process the following categories of data to operate and secure our services:"
+        },
+        account: {
+          text: "Account: Email address, username/display name, profile image, locale, and security settings (e.g., 2FA enabled). Email and username are encrypted with your key before storage. We also keep a separate server-side Vault-encrypted copy of your verified email address for mandatory account lifecycle notices, such as account verification, security alerts, and deletion reminders. Passwords are stored as salted hashes."
+        },
+        usage: {
+          text: "Usage: Server logs, event timestamps, feature usage, error logs, and device recognition identifiers (hashed). IP addresses may be temporarily processed for security and rate limiting."
+        },
+        content: {
+          text: "Content: Chat messages, prompts, attachments, and uploaded images/videos necessary to deliver the service (subject to moderation where applicable)."
+        },
+        payments: {
+          text: "Payments: Payment method tokens, transaction IDs, billing address and VAT information as required for invoicing (processed primarily by Stripe). We do not store full card numbers."
+        },
+        newsletter: {
+          text: "Newsletter: If you choose to subscribe to our newsletter, we store your email address in encrypted form. Newsletter subscription is optional and separate from account creation \u2014 creating an account does not automatically subscribe you to the newsletter. If you are an OpenMates customer (i.e. you have completed a purchase), we may additionally send you occasional product announcements and service updates about OpenMates' own similar services under the existing-customer exception (\xA77 Abs. 3 UWG / ePrivacy Directive Art. 13(2)). You can object to this at any time in Settings \u2192 Newsletter or via the one-click unsubscribe link in any such email, without affecting your account."
+        },
+        stability_logs: {
+          text: "Stability Logs: To diagnose technical errors, anonymized browser console logs (error messages, component status, connection events) are collected from authenticated users and stored for up to 48 hours. If an error occurs, surrounding context is retained for up to 14 days. No message content, chat titles, names, email addresses, or other personally identifiable information is included. A random session identifier (generated per browser tab, not linked to your account) is used for log correlation. You can disable this at any time in Settings > Privacy > Stability Logs."
+        }
+      },
+      data_retention: {
+        heading: {
+          text: "6. Data Retention"
+        },
+        account: {
+          text: "Account data: Retained until account deletion and completion of related legal obligations."
+        },
+        usage_and_logs: {
+          text: "Usage and logs: Operational logs retained up to 12 months; IPs tied to failed logins up to 30 days for security."
+        },
+        device_fingerprints: {
+          text: "Device fingerprints: Retained until account deletion or manual removal from account settings (when available)."
+        },
+        content: {
+          text: "Content: Retained until the user deletes the content or closes the account, subject to backup cycles."
+        },
+        payments_and_invoices: {
+          text: "Payments and invoices: Retained up to 10 years where required by tax/commercial law."
+        },
+        compliance_logs: {
+          text: "**Compliance logs:** audit logs retained 2 years (BSI \xA734 BDSG); financial compliance logs retained 10 years (AO \xA7147 and HGB \xA7257)"
+        },
+        observability_traces: {
+          text: "**Observability traces:** up to 30 days; user IDs in traces use a hash that rotates every 24 hours, so older traces cannot be joined to a specific user"
+        },
+        user_data_backups: {
+          text: "**User data backups:** 60 days via S3 lifecycle; backups contain only ciphertext encrypted with your own key"
+        }
+      },
+      legal_basis: {
+        heading: {
+          text: "7. Legal Basis for Processing (GDPR)"
+        },
+        contract: {
+          text: "Contract: Processing necessary to perform our contract with you or to take steps at your request prior to entering into a contract (e.g., account creation, delivering web app features)."
+        },
+        consent: {
+          text: "Consent: Processing based on your consent, where applicable (e.g., optional communications, certain analytics or marketing where used). You can withdraw consent at any time."
+        },
+        legitimate_interests: {
+          text: "Legitimate interests: Processing necessary for our legitimate interests, such as service security, fraud prevention, abuse detection, and improving the service, provided these interests are not overridden by your rights and interests."
+        },
+        direct_marketing: {
+          text: "Direct marketing to existing customers: For existing OpenMates customers (users who have completed a purchase), we may rely on Art. 6(1)(f) GDPR (legitimate interests) in combination with \xA77 Abs. 3 UWG and ePrivacy Directive Art. 13(2) to send occasional product announcements, service updates, and marketing about OpenMates' own similar services. Each such email includes a clearly visible one-click unsubscribe link, and you can also manage these preferences at any time in Settings \u2192 Newsletter. You can object to this processing at any time without giving reasons (Art. 21 GDPR)."
+        },
+        legal_obligation: {
+          text: "Legal obligation: Processing necessary to comply with legal obligations (e.g., tax and accounting requirements for invoices and transaction records)."
+        }
+      },
+      legal_rights: {
+        heading: {
+          text: "8. Your Privacy Rights"
+        },
+        intro: {
+          text: "Depending on your jurisdiction, you may have certain rights over your personal data. The following summarizes key rights under GDPR and CCPA/CPRA and how to exercise them:"
+        },
+        gdpr: {
+          subheading: {
+            text: "GDPR (EU/EEA)"
           },
-          webshare: {
-            heading: {
-              text: "Webshare (rotating proxy)"
-            },
-            description: {
-              text: "Webshare provides a rotating proxy for requests to services that would otherwise block us. We route YouTube transcript requests (for the videos get-transcript skill) and doctor appointment searches (for the health search-appointments skill \u2014 see Group H) through Webshare. Webshare sees the URLs we route through it."
-            }
+          access: {
+            text: "Right of access"
           },
-          google_maps: {
-            heading: {
-              text: "Google Maps Platform (places search)"
-            },
-            description: {
-              text: "Google Maps powers the places search skill. Google sees the text of your place queries and an approximate location for localized results, but no user identifier."
-            }
+          rectification: {
+            text: "Right to rectification"
           },
-          youtube: {
-            heading: {
-              text: "YouTube (video transcripts)"
-            },
-            description: {
-              text: "YouTube is queried when you ask OpenMates to retrieve a transcript for a YouTube video. YouTube receives video URLs and requested transcript language preferences without an OpenMates user identifier."
-            }
+          erasure: {
+            text: "Right to erasure ('right to be forgotten')"
+          },
+          restriction: {
+            text: "Right to restriction of processing"
+          },
+          portability: {
+            text: "Right to data portability"
+          },
+          objection: {
+            text: "Right to object"
+          },
+          withdraw_consent: {
+            text: "Right to withdraw consent"
+          },
+          exercise: {
+            text: "To exercise your GDPR rights, contact us at contact@openmates.org or via the Imprint. We may need to verify your identity before fulfilling your request."
+          },
+          manual_note: {
+            text: "The following rights are available on request (please contact us by email at contact@openmates.org and we will handle them manually):"
           }
         },
-        travel: {
-          heading: {
-            text: "Travel (only when you use a travel skill)"
+        ccpa_cpra: {
+          subheading: {
+            text: "CCPA/CPRA (California)"
           },
-          description: {
-            text: "These providers are only used when you invoke a travel skill \u2014 flight search, hotel search, or flight tracking. If you never use the travel app, none of your data is shared with them."
+          right_to_know: {
+            text: "Right to know/access"
           },
-          serpapi: {
-            heading: {
-              text: "SerpAPI (flight and hotel search)"
-            },
-            description: {
-              text: "SerpAPI powers flight and hotel search via its Google Flights and Google Hotels endpoints. SerpAPI receives your search queries \u2014 origin, destination, dates, and preferences \u2014 without a user identifier."
-            }
+          right_to_delete: {
+            text: "Right to delete"
           },
-          flightradar24: {
-            heading: {
-              text: "Flightradar24 (flight tracking)"
-            },
-            description: {
-              text: "Flightradar24 provides real flight track data when you ask about a specific flight number. It receives IATA flight numbers and departure dates without a user identifier."
-            }
+          right_to_correct: {
+            text: "Right to correct"
           },
-          deutsche_bahn: {
-            heading: {
-              text: "Deutsche Bahn (train connections)"
-            },
-            description: {
-              text: "Deutsche Bahn provides train connection results when you search for rail routes. Deutsche Bahn receives origin, destination, and date search details without an OpenMates user identifier."
-            }
+          right_to_opt_out_of_sale_or_sharing: {
+            text: "Right to opt-out of sale or sharing"
           },
-          flix: {
-            heading: {
-              text: "FlixBus / FlixTrain (bus and train connections)"
-            },
-            description: {
-              text: "Flix provides intercity bus and rail connection results when you search for FlixBus or FlixTrain routes. Flix receives origin, destination, and date search details without an OpenMates user identifier."
-            }
+          right_to_non_discrimination: {
+            text: "Right to non-discrimination"
+          },
+          exercise: {
+            text: "California residents can exercise CCPA/CPRA rights by contacting us at contact@openmates.org. We do not sell personal information."
+          }
+        }
+      },
+      discord_integration: {
+        heading: {
+          text: "9. Discord Integration"
+        },
+        description: {
+          text: "If you choose to join our Discord community through links provided on this website, please note that Discord will collect and process your data according to their privacy policy. This includes account information, usage data, communication content, and other information as outlined in Discord's privacy policy."
+        },
+        admin_access: {
+          text: "As Discord server administrators, we have access to all public communications, member lists, and other information shared within our Discord community. However, this information is hosted and primarily processed by Discord. We do not extract, store, or process this data outside of Discord's platform. For more information about how Discord handles your data, please review Discord's Privacy Policy."
+        },
+        privacy_policy_link: {
+          text: "Discord Privacy Policy"
+        }
+      },
+      contact: {
+        heading: {
+          text: "10. Contact Information"
+        },
+        questions: {
+          text: "For questions about data protection:"
+        },
+        email: {
+          text: "Email"
+        },
+        postal: {
+          text: "Postal address: See Legal Notice (Imprint) for the current registered address."
+        },
+        controller: {
+          text: "Controller: OpenMates (see Imprint for legal representative details)."
+        }
+      },
+      aggregate_analytics: {
+        heading: {
+          text: "11. Anonymous Aggregate Analytics"
+        },
+        overview: {
+          text: "We collect anonymous, aggregate statistics about how our website and web application are used. This data is genuinely anonymous \u2014 it cannot be linked to any individual user, and no cookies or tracking identifiers are set. No consent banner is required because no personal data is collected."
+        },
+        what_we_collect: {
+          text: "What we collect (all aggregate, never individual):"
+        },
+        items: {
+          text: "Daily page load counts; approximate unique visit counts (probabilistic HyperLogLog, ~0.81% error); country distribution (GeoIP lookup \u2014 IP discarded immediately, never stored); device class (mobile/tablet/desktop); browser family and major version; OS family; referrer domain (domain only, never full URL); screen size class; session duration distribution (bucketed)"
+        },
+        no_pii: {
+          text: "IP addresses are used transiently for GeoIP lookup only and are never written to disk or any database. User-Agent strings are parsed to metadata only (browser name, OS) \u2014 the raw string is never stored. All data is stored as daily aggregate counters, not as individual records."
+        }
+      },
+      follow_up_1: {
+        text: "How is my chat content encrypted?"
+      },
+      follow_up_2: {
+        text: "How does client-side encryption work?"
+      },
+      follow_up_3: {
+        text: "What if I lose my encryption key?"
+      },
+      follow_up_4: {
+        text: "Do AI providers see my messages?"
+      },
+      follow_up_5: {
+        text: "How do I delete my account?"
+      },
+      follow_up_6: {
+        text: "What data do you share with third parties?"
+      },
+      provider_link_label: {
+        text: "Privacy policy"
+      },
+      overview: {
+        heading: {
+          text: "Overview"
+        },
+        summary: {
+          text: "OpenMates is designed so that most of your data is encrypted on your device before it reaches our servers. This is **not** end-to-end encryption: our servers briefly decrypt your content in memory to run AI responses, render invoices, and deliver reminders. But we never write decrypted content to disk, logs, or traces, and when you delete your account we destroy the encryption key that protects your data \u2014 cryptographically shredding every encrypted field we still hold."
+        }
+      },
+      protection: {
+        heading: {
+          text: "How we protect your data"
+        },
+        intro: {
+          text: "We rely on six technical measures to protect your data. Each is verifiable in our open-source code and maps to a specific GDPR obligation."
+        },
+        client_side_encryption: {
+          heading: {
+            text: "Client-side encryption of your content"
+          },
+          description: {
+            text: "Your chat content, titles, summaries, tags, per-chat keys, app settings and memories, reminders, and sensitive profile fields (encrypted username, auto-top-up email, 2FA secrets) are encrypted in your browser before being sent to our servers. The browser uses a key derived from your login credential; our servers reject writes that contain anything but ciphertext. This is *not* end-to-end encryption \u2014 our servers can decrypt your content in memory when they need to (for AI responses, invoice rendering, reminder delivery). The difference from end-to-end encryption is that decryption happens transiently in process memory and the plaintext is never persisted to disk, logs, or traces."
+          }
+        },
+        pii_placeholder_substitution: {
+          heading: {
+            text: "PII placeholder substitution before AI calls"
+          },
+          description: {
+            text: "Before any message is sent to a third-party AI model, your browser scans your message for real names, email addresses, and physical addresses that you have saved in your privacy settings (or that match common patterns) and replaces any matches with neutral placeholders (for example [USER_0]). The mapping back to your real values is stored encrypted with your key and is never decrypted on our servers. **Important limitation:** this substitution only protects personal data that our client-side detector actually recognizes \u2014 typically the values you have explicitly saved in your privacy settings and values highlighted in the message field before you send. Anything the detector does not recognize (typos of your own name, uncommon address formats, other people's personal data, sensitive topics that are not formally PII) will be transmitted as you typed it. Please treat every message as you would treat a note passed to a third-party AI provider and be cautious with personal data."
           }
         },
-        events: {
+        encrypted_at_rest: {
           heading: {
-            text: "Events (only when you use the events skill)"
+            text: "Encrypted at rest, decrypted only in memory"
           },
           description: {
-            text: "These providers are only used when you invoke the events search skill. The specific set of providers called depends on the city and event type you search for."
-          },
-          meetup: {
-            heading: {
-              text: "Meetup"
-            },
-            description: {
-              text: "Meetup powers event search for community events. Meetup receives your search queries \u2014 city, category, dates \u2014 without a user identifier."
-            }
-          },
-          luma: {
-            heading: {
-              text: "Luma"
-            },
-            description: {
-              text: "Luma powers event search for tech, creative, and community events. Luma receives your search queries without a user identifier."
-            }
-          },
-          resident_advisor: {
-            heading: {
-              text: "Resident Advisor"
-            },
-            description: {
-              text: "Resident Advisor powers event search for electronic music events. RA receives your search queries without a user identifier."
-            }
+            text: "Our PostgreSQL database, Redis caches, S3 object storage, and backup snapshots hold only ciphertext for any field containing user content. When our servers need to read your content to run an AI response, render an invoice, or deliver a reminder, decryption happens transiently in process memory and is discarded immediately after. Key material is released on demand by HashiCorp Vault and never stored in raw form outside it."
           }
         },
-        health: {
+        hashed_identifiers: {
           heading: {
-            text: "Health appointment search (only when you use the health skill)"
+            text: "Hashed identifiers throughout"
           },
           description: {
-            text: `These upstream services are reached through the Webshare rotating proxy (see Group E) only when you invoke the health app's appointment search skill. The queries you send \u2014 for example "dermatologist in Berlin next Tuesday" \u2014 are transmitted without user identifiers, but the content of the query itself can imply a health concern. By invoking the skill you consent to this processing under GDPR Art. 9(2)(a) (explicit consent for special-category data).`
-          },
-          doctolib: {
-            heading: {
-              text: "Doctolib (EU)"
-            },
-            description: {
-              text: "Doctolib lists doctors and specialists across supported EU regions. We query Doctolib for available appointments matching your criteria, routed through the Webshare proxy, without a user identifier."
-            }
-          },
-          jameda: {
-            heading: {
-              text: "Jameda (Germany)"
-            },
-            description: {
-              text: "Jameda lists doctors and specialists across Germany. We query Jameda for available appointments matching your criteria, routed through the Webshare proxy, without a user identifier."
-            }
+            text: "Your user ID is stored in most database tables as a SHA-256 hash rather than as a direct reference. Login uses a zero-knowledge password verification flow: we verify that you know your password without ever learning it. API-key device records anonymize the IP address to its first two octets before encryption, so we can recognize a device without storing a precise location."
           }
         },
-        shopping: {
+        cryptographic_erasure: {
           heading: {
-            text: "Shopping (only when you use the shopping skill)"
+            text: "Cryptographically shredded on deletion"
           },
           description: {
-            text: "These providers are only used when you invoke the shopping search skill for live product and price lookups."
-          },
-          rewe: {
-            heading: {
-              text: "REWE (German grocery)"
-            },
-            description: {
-              text: "REWE's product catalogue is queried for live product and price data when you search German grocery items. REWE receives your search queries without a user identifier."
-            }
-          },
-          amazon: {
-            heading: {
-              text: "Amazon"
-            },
-            description: {
-              text: "Amazon's product catalogue is queried for live product and price data. Amazon receives your search queries without a user identifier."
-            }
+            text: "When you delete your account we destroy your HashiCorp Vault Transit key in addition to removing your rows from our database. Any encrypted field still sitting in a backup, cache, or running process becomes mathematically unrecoverable ciphertext at that moment \u2014 cryptographic erasure on top of row-level deletion."
           }
         },
-        nutrition: {
+        observability_without_tracking: {
           heading: {
-            text: "Nutrition (only when you use the recipe search skill)"
+            text: "Observability without tracking"
           },
           description: {
-            text: "These providers are only used when you invoke the nutrition recipe search skill. They receive recipe search queries and selected dietary filters without a user identifier."
-          },
-          edamam: {
-            heading: {
-              text: "Edamam"
-            },
-            description: {
-              text: "Edamam's Recipe Search API is queried when you search for recipes. Edamam receives the recipe query and selected dietary or nutrition filters without a user identifier."
-            }
+            text: "Our internal tracing pipeline (OpenTelemetry) replaces your user ID with a hash that rotates every 24 hours, strips authentication headers and cookies from every span, and redacts chat content before any trace leaves the backend. Our web analytics use a server-side beacon with no cookies and no stored individual identifiers. We do not use Google Analytics, Plausible, PostHog, or any third-party analytics platform."
           }
+        }
+      },
+      promises: {
+        intro: {
+          text: "Below are the privacy promises we make to every user. Each one is backed by code in our open-source repository and verified by automated tests. When the enforcing code changes, a registry-linked check reminds us to rerun those tests before release."
         },
-        electronics: {
+        client_side_chat_encryption: {
           heading: {
-            text: "Electronics (only when you use the electronics skill)"
+            text: "Client-side chat encryption"
           },
           description: {
-            text: "These providers are only used when you invoke the electronics component search skill for live component and reference-design lookups."
+            text: "Your chats, settings, and memories are encrypted on your device with AES-256-GCM before they leave your browser. The server stores only ciphertext on disk, in caches, and in backups. This is not end-to-end encryption: when a server-side task needs to read content (to run an AI response, render an invoice, or deliver a reminder), it decrypts in memory via HashiCorp Vault and discards the plaintext immediately after use."
+          }
+        },
+        email_encryption_at_rest: {
+          heading: {
+            text: "Email addresses encrypted at rest"
           },
-          ti_webench: {
-            heading: {
-              text: "Texas Instruments WEBENCH (US)"
-            },
-            description: {
-              text: "TI WEBENCH is queried for power converter component candidates and reference design summaries. Texas Instruments receives the electrical requirements you search for, such as input voltage, output voltage, output current, temperature, isolation, and optimization goal, without a user identifier."
-            }
+          description: {
+            text: "Your email address is stored only as ciphertext. The server decrypts it transiently in memory during login, billing, and notification delivery, and never writes plaintext to disk or logs."
           }
         },
-        mail: {
+        no_third_party_tracking: {
           heading: {
-            text: "Mail (only when you use mail skills)"
+            text: "No third-party tracking cookies or analytics"
           },
           description: {
-            text: "This provider is only used when you invoke mail skills against a connected mailbox. If you never use the mail app, none of your data is shared with it."
+            text: "We do not use Google Analytics, Plausible, PostHog, Mixpanel, Amplitude, Segment, or any other third-party analytics platform. Our telemetry is server-side, cookie-free, and contains no individually stored identifiers. A pre-edit check in our repository blocks the introduction of analytics SDKs."
+          }
+        },
+        pii_placeholder_substitution: {
+          heading: {
+            text: "Personal information never reaches AI providers"
           },
-          protonmail: {
-            heading: {
-              text: "Proton Mail (mail search)"
-            },
-            description: {
-              text: "Proton Mail is queried when you search a connected Proton Mail mailbox. Proton receives the mail search query and mailbox data needed to return matching results."
-            }
+          description: {
+            text: "Before any message is sent to an AI provider, your browser detects 32 categories of personal data \u2014 emails, phone numbers, credit card numbers, API keys, and more \u2014 and replaces them with placeholders like `[EMAIL_com]`. The substitution map is encrypted with your chat key so only your devices can restore the original values."
           }
         },
-        home: {
+        telemetry_privacy_filter: {
           heading: {
-            text: "Home and housing (only when you use housing search)"
+            text: "Telemetry stripped of sensitive data"
           },
           description: {
-            text: "These providers are only used when you invoke the home app's housing search skill. If you never search for housing, none of your data is shared with them."
+            text: "Our internal tracing pipeline (OpenTelemetry) strips authentication headers, cookies, and database statements from every span, and pseudonymises your user ID with a salt that rotates every 24 hours. Regular users never have their raw identifiers in telemetry."
+          }
+        },
+        cryptographic_erasure: {
+          heading: {
+            text: "Deleted accounts are cryptographically erased"
           },
-          immoscout24: {
-            heading: {
-              text: "ImmoScout24 (German housing search)"
-            },
-            description: {
-              text: "ImmoScout24 is queried when you search German housing listings. ImmoScout24 receives housing search queries, locations, filters, and listing pages requested without an OpenMates user identifier."
-            }
+          description: {
+            text: "When you delete your account, the first step destroys your encryption keys. Any residual ciphertext in backups, caches, or audit logs is rendered permanently unreadable \u2014 no key, no content."
+          }
+        },
+        argon2_password_hashing: {
+          heading: {
+            text: "Passwords stored as Argon2 hashes"
           },
-          kleinanzeigen: {
-            heading: {
-              text: "Kleinanzeigen (German classified housing search)"
-            },
-            description: {
-              text: "Kleinanzeigen is queried when you search German classified housing listings. Kleinanzeigen receives housing search queries, locations, filters, and listing pages requested without an OpenMates user identifier."
-            }
+          description: {
+            text: "We store password and backup-code verifiers as Argon2 hashes. Plaintext passwords are never persisted to disk, never written to logs, and never recoverable \u2014 even by us."
+          }
+        },
+        payment_data_minimization: {
+          heading: {
+            text: "No card numbers ever touch our servers"
           },
-          wg_gesucht: {
-            heading: {
-              text: "WG-Gesucht (German shared-apartment search)"
-            },
-            description: {
-              text: "WG-Gesucht is queried when you search German shared-apartment or rental listings. WG-Gesucht receives housing search queries, locations, filters, and listing pages requested without an OpenMates user identifier."
-            }
+          description: {
+            text: "Payments flow directly from your browser to Stripe. We store only provider tokens and customer identifiers. We never see, receive, or persist full card numbers, security codes, or bank account details."
           }
         },
-        community: {
+        logging_redaction: {
           heading: {
-            text: "Community and developer channels (only if you choose to use them)"
+            text: "Logs are scrubbed of sensitive data"
           },
           description: {
-            text: "These providers are only involved if you choose to join our community or developer channels. You can use OpenMates without ever touching them."
+            text: "Every log line passes through a redaction filter that strips email addresses, IP addresses, bearer tokens, and password values. Compliance logs preserve pseudonymous user IDs but remove all other personal data."
+          }
+        },
+        prompt_injection_defense: {
+          heading: {
+            text: "Defense against prompt injection"
           },
-          discord: {
-            heading: {
-              text: "Discord (community server)"
-            },
-            description: {
-              text: "If you join the OpenMates community Discord server, Discord will see anything you post on its platform, plus your Discord username and whatever data Discord itself collects per its own privacy policy. We have no control over what Discord does with that data."
-            },
-            admin_access: {
-              text: "OpenMates administrators with Discord server admin rights can read all messages posted in the OpenMates Discord server. Do not share sensitive information on Discord."
-            }
+          description: {
+            text: "Two layers protect your conversations from malicious content in web pages, files, and URLs you reference. Invisible Unicode characters are stripped first, then a dedicated safety model detects semantic injection attempts and blocks or replaces high-risk content before it reaches your assistant."
           }
         },
-        social_media: {
+        no_training_on_user_data: {
           heading: {
-            text: "Social media (only when you use social media skills)"
+            text: "Your conversations are not used to train AI models"
           },
           description: {
-            text: "These providers are only used when you invoke the social media app's get-posts or search skills. They receive public profile, page, or search queries without an OpenMates user identifier."
+            text: "All AI chat providers we use (Anthropic, OpenAI, Mistral, Google Gemini, Google Vertex AI, Together AI, Groq, Cerebras, and OpenRouter) have explicit no-training clauses in their terms \u2014 your conversations are never used to fine-tune, evaluate, or otherwise train AI models. For image generation, Recraft has a training opt-out which we have activated. fal.ai (used for draft image generation) may use anonymized, aggregated derivatives of prompts for model improvement under their standard API terms; no full opt-out is available outside an enterprise contract. A per-provider audit with verbatim policy quotes and verification dates is published in our open-source repository."
+          }
+        },
+        no_external_resources: {
+          heading: {
+            text: "The web app never loads external images or scripts"
           },
-          reddit: {
-            heading: {
-              text: "Reddit (public posts and discussions)"
-            },
-            description: {
-              text: "Reddit is queried when you fetch or search public Reddit posts. Reddit receives subreddit names, public post URLs, and search queries without an OpenMates user identifier."
-            }
+          description: {
+            text: "Every external image, favicon, or preview shown in the app is fetched through our own preview.openmates.org proxy \u2014 the originating website never sees your IP address. The only third-party script the web app loads is the Stripe payment SDK needed to process a purchase, and only when you explicitly open the payment flow. There is no ad network, tag manager, CDN font loader, or third-party analytics library."
+          }
+        },
+        cli_no_credential_prompts: {
+          heading: {
+            text: "The command-line tool never asks for your password"
           },
-          bluesky: {
-            heading: {
-              text: "Bluesky (public posts and profile feeds)"
-            },
-            description: {
-              text: "Bluesky is queried when you fetch or search public Bluesky posts. Bluesky receives handles and search queries without an OpenMates user identifier."
-            }
+          description: {
+            text: "The OpenMates CLI never prompts you for your email, password, 2FA code, or any other login credential. Authentication uses a browser-based pair-auth handshake: the CLI shows a QR code and URL, you approve the session in your logged-in web browser, and you type a short 6-character binding PIN back into the CLI to confirm. Your credentials never pass through the terminal."
+          }
+        },
+        open_source_transparency: {
+          heading: {
+            text: "Every claim on this page is independently auditable"
           },
-          mastodon: {
-            heading: {
-              text: "Mastodon (public profile posts)"
-            },
-            description: {
-              text: "Mastodon is queried when you fetch public Mastodon profile posts. The relevant Mastodon server receives profile identifiers or public profile URLs without an OpenMates user identifier."
-            }
+          description: {
+            text: "OpenMates is open source. Every promise above is backed by code you can read, tests you can run, and architecture documents you can audit in our public repository. Our privacy-promises registry links each claim to the exact files that enforce it."
           }
         }
       },