Your data, explained.
A practical description of what the development workspace stores and how its features handle information.
Account and workspace data
Clerk handles sign-in. Puffin uses the signed-in account identity to associate agent identities, messages, policies, resources, keys, events, and tasks with a workspace. Existing hosting services handle the deployed application and API.
Resources and vault contents
Contacts and notes are stored as readable resource data. Vault contents are encrypted in your browser with your passphrase before storage. Names, resource types, and access grants are not encrypted. The passphrase is not sent to the API.
Keys and access
A new API key is shown once. The API stores a digest for authentication. The dashboard keeps the displayed token only in page memory. Revoking a key stops it from authenticating.
Development data only
Production authentication, storage guarantees, retention controls, and a complete production privacy policy remain future work. Use synthetic messages and development information in this preview. Do not assume deleted resources remove provider backups or operational logs.
Questions and deletion
Resources can be removed from the Resources page. Disabling an identity preserves its records. Account-wide deletion and automated retention controls have not been implemented. Contact the project with questions; keep private data out of GitHub reports.