Data handling

Data classes, expected locations, retention rules, deletion behavior, and telemetry requirements.

Classify data before choosing storage

Storage policy follows data class rather than convenience. Conversation bodies, payment metadata, operational telemetry, public source material, and configuration changes have different sensitivity, durability, and audit requirements.

Retention classes and enforcement points

Local-first still needs lifecycle controls

Local storage reduces server-side concentration but does not make data invulnerable. The client should expose clear session, persist, export, and delete choices, and it should explain whether browser storage is encrypted, synchronized, backed up, or available to other scripts on the same origin.

High-sensitivity deployments should separate the documentation origin, application origin, and untrusted content rendering origin. Content Security Policy, dependency review, and extension risk guidance matter because the private transcript exists before any network routing control can protect it.

Observe the service without collecting the conversation

Operational events should contain typed fields such as route identifier, status class, latency bucket, cost, network, adapter version, and opaque request identifier. They should not contain prompt text, result text, source page content, wallet labels, or a stable cross-session user fingerprint.