Privacy
Authentication and data handling.
The public site avoids personal infrastructure details. Private areas require sign-in and server-side authorization checks.
What this version collects
Public pages do not ask visitors for credentials or registration. The protected portal uses the Sites-supported ChatGPT sign-in flow and receives the authenticated email and optional display name from secure request headers.
Sessions
Sign-in sessions are handled by the hosting platform. The app does not store passwords, password hashes, local service credentials, API keys, private IP addresses, or filesystem paths in the browser bundle.
Future private services
Future integrations should use server-side gateways, allowlisted upstream services, CSRF protection where relevant, and restrictive security headers. Browser clients should never receive private-service administrative credentials.