Transparency
How my data travels
A direct, plain answer to: where does my data actually go.
What stays on your hardware
- Your Personal track (journal entries, personal commitments, Personal Truth Reports) — never leaves the database except to render in your own browser.
- Triage classify-tier work — when configured with local Ollama, runs on your machine. The text never leaves the box.
- Auth secrets — session tokens, OpenClaw tokens (sha256-hashed), VAPID keys. Owner-only RLS at the DB.
What reaches LLM providers (and which one)
See /status for live cost rollup and which provider handled each call.
- Anthropic Opus — strategic decisions: goal→project, mission_kit, daily_summary, weekly_review, Truth Report headlines. Always Anthropic; never substitutable.
- Anthropic Sonnet / HuggingFace Llama-70B — synthesis: ad-hoc AI tasks, advisor reasoning. Whichever provider answers first wins.
- HuggingFace Llama-8B / Anthropic Haiku / Ollama — extraction: proof cleaning, thread summaries, lesson cards. Cheapest provider with capacity.
- Local Ollama — classification + reranking. Stays on the Mac Mini.
What's never sent anywhere
- Personal journal entries (visible_to_agents=FALSE by default).
- Sensitive-topic content (H6 redirects to a human path before any LLM sees it).
- Real names from team playroom output (H7 PII scrubber runs before render).
- Auth tokens, API keys, billing card details.
What you can verify yourself
- /status — every LLM call logged with provider, tier, cost, latency.
- /me/privacy — coach consent toggles + quiet hours + delete-my-data.
- /improvements — every parameter the system has learned, with rollback.
- /incidents — every operational issue, with rollback hint.
If you find a gap between this page and what actually happens, that's a bug. Open an issue.