Privacy Policy

Privacy Policy

How we protect your privacy, handle local browser caching, and ensure zero telemetry under the General Data Protection Regulation (GDPR).

Published: Aug 20, 2026

Read Time: 3 min

Zero-Telemetry Guarantee

100% of compute operations (LLM reasoning, cryptographic decryption, and audio synthesis) execute locally on your device.

1. Introduction & Zero-Telemetry Commitment

This Privacy Policy explains how César Caldeira (“we”, “us”, or “our”) protects your personal data when you visit our website. We are strictly committed to user privacy in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and international data privacy frameworks.

Our platform is architected around a Local-First, Zero-Telemetry paradigm: heavy compute operations—including on-device LLM reasoning, speech synthesis, statistical calculations, and cryptographic decryption—are executed exclusively inside your web browser.

Last updated: 20 August 2026

2. Data Controller

Organisation: César Caldeira
Contact: privacy@caldeira.cc
Jurisdiction: Lisbon, Portugal (European Union)

3. Local-First & On-Device Processing Disclosures

Detailed Technical Breakdown of On-Device Systems

Click below to review client sandbox isolation and memory bounds.

WebLLM SmolLM2: Model parameters are loaded into local IndexedDB and executed on client WebGPU shaders. No prompt telemetry is transmitted.
Web Crypto AES-256-GCM: Document encryption and PBKDF2 key derivation occur strictly in browser memory.
Web Speech Synthesis: Audio synthesis uses OS-level offline text-to-speech without remote API calls.

3.1 On-Device WebLLM AI Companion

Execution Model: When you interact with the AI Research Companion, open-weight model parameters (SmolLM2-360M-Instruct) run directly on your device via WebGPU and WebAssembly.
Storage: Model weights are cached locally inside your browser’s IndexedDB / Cache Storage.
Data Guarantee: Your prompts, questions, and RAG contextual answers are processed locally and are never transmitted to any external server or telemetry service.

3.2 Web Speech API Text-to-Speech (TTS)

Execution Model: The “Listen to this article” and AI Chat Read-Aloud functions utilize your browser’s native window.speechSynthesis interface.
Data Guarantee: Text is converted to audio entirely on your local operating system. No audio data is uploaded or recorded.

3.3 Client-Side Web Crypto API Decryption

Execution Model: Password-protected documents use the native window.crypto.subtle API to derive keys via PBKDF2-SHA256 (100,000 iterations) and decrypt authenticated AES-256-GCM payloads in memory.
Data Guarantee: Passwords and decrypted content are never sent across the network.

4. Cookies & Local Storage

Storage Categories

Overview of browser storage mechanisms and compliance

Category	Storage Type	Purpose	Can Be Disabled?
Essential	`localStorage`	Theme preferences (`carbon_theme`), language selection, AI avatar preference (`carbon_ai_avatar_type`), and cookie consent states (`carbon_cookie_consent`).	No
On-Device AI Cache	`IndexedDB` / Cache API	Cached open-weight model parameters for zero-latency local loading.	Yes (cleared via browser cache)
Analytics	Cookies	Anonymised traffic metrics to improve platform documentation (only if consented).	Yes
Advertising	Cookies	Optional third-party advertising partners (e.g. Google Ads) if enabled by site operator and consented by user.	Yes