05 / PRIVACY

Clear about your input.

Local tools and explicit AI requests have different data flows. This page describes the implemented handling and configuration gates.

Application handling reviewed 3 October 2026. Provider/account and host settings require verification before public AI activation.

01 / LOCAL TOOLS

Search and safe commands

Search filters the published-content index in your browser. Ordinary terminal commands stay local. Queries and command history are not saved to URLs, localStorage or application analytics. An explicit enabled ask command uses the same disclosure, backend and quotas as Mira.

02 / EXPLICIT SUBMISSION

Chat, job comparison and explanations

Only deliberate submission sends your message, job text or technical topic to the portfolio server. Model-required requests send the text and relevant approved public evidence to Groq. Casual chat and technical explanations do not use portfolio retrieval. Personal factual questions use relevant public records; simple facts can be answered locally. No automatic inference occurs on typing, scrolling or opening Lab.

Remove confidential and personal information before submitting. The Matcher requires your acknowledgement. It compares against reviewed public CV sections and approved portfolio sources; the original resume remains publicly available. No visitor resume upload or job URL fetch is provided.

03 / RETENTION

Memory-only application text

The application does not store questions, job descriptions, answers or transcripts in a database. They are processed transiently and displayed in current-session memory. Mira sends up to six prior messages for short follow-ups; prior messages are not trusted evidence. Only a versioned provider-disclosure acceptance and a Light/Dark preference are saved in localStorage. Conversation text is never saved there. Clear or reload removes the local view; it cannot recall information already sent to a provider or erase infrastructure records. Application request bodies and model output are excluded from logs.

A signed, HttpOnly session cookie identifies an anonymous visitor for separate feature allowances. It contains no conversation text. Redis holds daily HMAC identifiers, request counts, reserved token amounts, short leases and cooldowns only. No raw IP or submitted text is stored there. Retention is at most 48 hours; generation leases last 30 seconds. Hosting and network providers may independently process IP and operational metadata.

04 / PROVIDER CONTROLS

Verified settings before activation

The server requires the operator’s explicit privacy-verification flag before model access. For Groq, verify Zero Data Retention in the organization’s Data Controls settings first. Groq documents inference reliability/abuse retention exceptions up to 30 days when ZDR is not enabled, and always retains usage metadata. The application cannot inspect those account settings or guarantee infrastructure retention.

A provider change requires an updated disclosure and a new explicit submission. A rejected Groq model configuration can use one verified alternative model on the same provider. No provider or account cycling, prompt caching, batch processing or fine-tuning is configured. If keys, privacy verification, tokenizer compatibility or the shared quota store are unavailable, model calls remain unavailable and public source pages stay readable.

Groq data documentation ↗
05 / CANCELLATION

Stopping updates is not recalling a request

Cancel and Clear abort the browser request and reject stale updates. Server cancellation is best effort; a provider may already have started processing and consumed quota. Progress indicators represent observable operations, never private model reasoning.