Legal · privacy
Privacy policy
In one line. This site sets no cookie, runs no analytics, keeps no account, stores no message and asks for no personal data. The thing you can choose to send it is a chat sentence, which goes to the model provider you pick, with the key you paste. The only record that touch leaves behind is a rate-limit counter: a salted hash of your network address that expires in minutes and cannot be turned back into the address.
What this website collects
Nothing. The page is a static document with no script on it, so there is nothing that could set a cookie, write to your browser's storage, fingerprint you or count you. That is not a setting that could be switched on later without changing the page: a build that adds a tracking script fails this project's own test suite before it ships.
The site is hosted on Cloudflare Pages, so Cloudflare serves the bytes and, as any host does, processes standard request metadata (address, time, requested path, user agent) under its own privacy policy, for its own security and delivery purposes. This project runs no analytics binding, no log drain and no third-party code of any kind alongside it.
What the chat interface sends, and where it goes
| What | Where it goes |
|---|---|
| The sentence or sentences you type | To this site's endpoint, then to the model provider you selected, with your key. |
| The API key you paste | To the same endpoint in a request header and straight on to that provider. It is not stored, not logged, and not echoed back to you. |
| The provider, model and dials you choose | To the same endpoint, to decide which model answers. The endpoint refuses a provider or model it was not configured with. |
| The model's answer | Back to your browser, and nowhere else. Nothing is sent back to the model as a result of anything it suggested. |
| Your network address | Into a rate-limit counter, as a salted hash and not as an address. It expires in minutes and cannot be reversed. |
So the people who see your words are: you, and the model provider whose key you used. That provider's own terms and privacy policy govern what it does with the prompt and the key — which is worth reading before you paste a key, and is why the interface lets you choose the provider rather than choosing one for you. This project cannot see your key after the request that carried it, and it keeps no transcript to read later.
What the endpoint deliberately does not do
- It stores no message and writes no log line about one.
- It sets no cookie, and the interface's script is held to the same rule:
no cookie, no
localStorage, nosessionStorage, noindexedDB, no beacon, noeval. - It writes nothing to your device: your key and your conversation live in the page's memory and end when you close the tab or reload.
- It talks to no origin but its own endpoint, and that endpoint posts only to the providers the deployment configures — it cannot be made to hand your key to a host of the caller's choosing.
- It fails closed. A missing key, a missing counter, a counter that cannot be read or written: each answers with a refusal naming what is missing, rather than making an unmetered call.
Email to the mailbox
info@enigmaticred.com is forwarded through Cloudflare Email Routing to the operator's own inbox. Writing to it means the operator can see your address and whatever you send, and it is kept for as long as it takes to answer and to keep a record of a security report or a request you made. It is not used for marketing and is not shared. Email is not a confidential channel, so a report should describe a finding rather than carry a live credential.
The beta you install on your own machine
The software that acts is the beta you download and run locally, and it is the opposite of a hosted service: your scope, your audit log, your evidence and your reports stay on your machine, at the paths you configure. Nothing is sent anywhere by simply running a scan.
- Your audit log and evidence stay local. The hash-chained audit log is written where you point it, and evidence is stored with its bytes and hash. The default evidence retention is 90 days, and deleting the folders deletes the data — there is no copy anywhere else.
- The model is the one exception you choose. If you point
the agent at a local model, nothing leaves your network. If you point it at
a hosted provider with your own key, what the agent sends to it (prompts,
tool output it needs summarised, and whatever it is asked to classify) goes
to that provider under that provider's policy. A hosted key in
.envis yours, and this project never receives it. - A scan can hold data about a third party. A report about somebody else's system is a record about their system: keep it where you were authorised to keep it.
What is never done with your data
- No selling, renting or sharing with advertisers, brokers or anyone else.
- No profiling, no advertising, no marketing email, no newsletter.
- No analytics or session recording on this site or in the interface.
- No training of any model on what a visitor types here: this deployment trains nothing, and the provider you chose answers under its own terms.
Your choices and your rights
Because the site stores nothing about you, there is usually nothing to hand over, correct or delete. Where the project does hold something — an email you sent, a report you filed — you can ask for a copy, ask for a correction, or ask for it to be deleted, and the request will be answered. Where the Personal Data (Privacy) Ordinance of Hong Kong or another law that applies to you gives you a right of access, correction or objection, that right is honoured on request rather than argued about. Write to info@enigmaticred.com from any address; state what you want done, and it will be done or refused with the reason.
Under-16s: this is a security research tool, not a service aimed at children. Do not send personal data about a child through the interface or the mailbox.
Changes to this policy
The date at the top of this page changes whenever the policy does, and the version published here is the one in force. The promises above are also pinned by tests in the project's own suite, so a build that starts storing a message, setting a cookie or loading a third party fails before it is deployed.