Privacy Policy
How we protect your privacy, handle local browser caching, and ensure zero telemetry under the General Data Protection Regulation (GDPR).
1. Introduction & Zero-Telemetry Commitment
This Privacy Policy explains how César Caldeira (“we”, “us”, or “our”) protects your personal data when you visit our website. We are strictly committed to user privacy in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and international data privacy frameworks.
Our platform is architected around a Local-First, Zero-Telemetry paradigm: heavy compute operations—including on-device LLM reasoning, speech synthesis, statistical calculations, and cryptographic decryption—are executed exclusively inside your web browser.
Last updated: 20 August 2026
2. Data Controller
Governance
Data Protection Office
- Organisation: César Caldeira
- Contact:
privacy@caldeira.cc - Jurisdiction: Lisbon, Portugal (European Union)
3. Local-First & On-Device Processing Disclosures
Detailed Technical Breakdown of On-Device Systems
Click below to review client sandbox isolation and memory bounds.
- WebLLM SmolLM2: Model parameters are loaded into local IndexedDB and executed on client WebGPU shaders. No prompt telemetry is transmitted.
- Web Crypto AES-256-GCM: Document encryption and PBKDF2 key derivation occur strictly in browser memory.
- Web Speech Synthesis: Audio synthesis uses OS-level offline text-to-speech without remote API calls.
3.1 On-Device WebLLM AI Companion
- Execution Model: When you interact with the AI Research Companion, open-weight model parameters (SmolLM2-360M-Instruct) run directly on your device via WebGPU and WebAssembly.
- Storage: Model weights are cached locally inside your browser’s IndexedDB / Cache Storage.
- Data Guarantee: Your prompts, questions, and RAG contextual answers are processed locally and are never transmitted to any external server or telemetry service.
3.2 Web Speech API Text-to-Speech (TTS)
- Execution Model: The “Listen to this article” and AI Chat Read-Aloud functions utilize your browser’s native
window.speechSynthesisinterface. - Data Guarantee: Text is converted to audio entirely on your local operating system. No audio data is uploaded or recorded.
3.3 Client-Side Web Crypto API Decryption
- Execution Model: Password-protected documents use the native
window.crypto.subtleAPI to derive keys via PBKDF2-SHA256 (100,000 iterations) and decrypt authenticated AES-256-GCM payloads in memory. - Data Guarantee: Passwords and decrypted content are never sent across the network.
4. Cookies & Local Storage
| Category | Storage Type | Purpose | Can Be Disabled? |
|---|---|---|---|
| Essential | localStorage | Theme preferences (carbon_theme), language selection, AI avatar preference (carbon_ai_avatar_type), and cookie consent states (carbon_cookie_consent). | No |
| On-Device AI Cache | IndexedDB / Cache API | Cached open-weight model parameters for zero-latency local loading. | Yes (cleared via browser cache) |
| Analytics | Cookies | Anonymised traffic metrics to improve platform documentation (only if consented). | Yes |
| Advertising | Cookies | Optional third-party advertising partners (e.g. Google Ads) if enabled by site operator and consented by user. | Yes |