How your data moves through this site.

When you generate a plan, the objective you type and any files you attach are sent to my server and on to OpenAI’s API, which writes the plan. I instruct OpenAI not to store these requests (their store: false API setting), and nothing you type is saved on my servers — there is no database behind this site. Attachments are read in your browser; only their text is sent, and anything that looks like a credential or secret is scrubbed on the server before the model sees it.

If your browser supports on-device summarisation and you choose it, your connected content is processed on your machine and only the summary — which the page shows you verbatim — is sent.

Connecting a source grants read-only access to exactly what you pick: repositories chosen on GitHub’s own installation screen, or Drive folders you tick here. Content is read only while a plan is being generated, passed through a secret-scrubbing filter, summarised, sent to OpenAI to ground the plan, and then discarded. It is never stored on my servers.

What I keep is the permission, not the content: a GitHub installation id, or a Google refresh token. It lives encrypted (AES-256-GCM) in a cookie in your own browser — not in any database of mine — and expires after 30 days. Clearing your cookies genuinely disconnects you.

Google Drive access is limited to reading the folders you select (Docs, Sheets, Slides, and plain-text files, three levels deep) for the sole purpose of grounding the plan you asked for. No Drive content is used for anything else, shared with anyone beyond the processing described here, or retained after generation.

Revoke any time: the Disconnect button here; GitHub → Settings → Applications → Installed GitHub Apps; or myaccount.google.com → Data & privacy → Third-party access.

What you submit — your name, email, company, and what you write — is emailed to me via Resend and lands in my inbox. That is the one place anything you enter persists, because it is the point of the form. It is used to reply to you and for nothing else.

There are no third-party analytics, advertising trackers, or pixels on this site. The only cookie is the encrypted connector grant described above, set only if you connect a source. Your browser’s localStorage holds a generation counter and, if you use the on-device mode, which local model you picked — neither leaves your machine.

• Vercel hosts the site and serves requests.
• OpenAI receives generation requests (your objective, attachment text, and source summaries) with storage disabled.
• Resend delivers application-form email.
• GitHub / Google are called read-only, with your grant, for the sources you selected.

Since nothing from the generator persists server-side, there is usually nothing to delete. If you applied through the form and want that email deleted, or have any question this page does not answer, write to emesdg@gmail.com.