[sdcarlson]

Needs Mateo's handle: this changes a public promise.

What changed

privacy/index.html only:

1. In Staff sign-in, after "Records are kept for about 400 days.": "The sign-in and account service counts its requests and errors by route and app, without identifying anyone, and keeps those counts for three months."
2. A new Omni preview entry (id="omni-preview"), before Other sites: "The server behind the Omni preview at omni.syberlabs.io keeps no request logs: no URLs, request details or IP addresses. Its only logs are event lines from a fixed list, such as which public data source failed and how, kept for up to 7 days to diagnose faults. They hold no IP addresses, canvas content, questions or identifiers."
3. "Last updated 31 October 2026."

The lede ("syberlabs.io is a static website. Visitors get no accounts, forms, cookies or analytics. The one exception is a staff sign-in at /admin/ for people SyberLabs adds.") and the meta descriptions are unchanged. No em dashes; apostrophes match the page.

The second commit replaces an earlier Omni paragraph that described Cloudflare request logs (method, URL, status, timing and IP address). Flyspace's logging change now turns Cloudflare's per-request invocation logs off (observability.logs.invocation_logs: false), so the preview keeps only its allowlisted event lines.

Why

RFC 0004 packet P5a (https://github.com/SyberLabs/MasterMind/pull/68, docs/rfc/RFC-0004-telemetry.md section 5): the page describes the account service's counts and the Omni preview's logs before either is turned on.

Depends on Flyspace #188 carrying the setting

The Omni paragraph is true only while SyberLabs/Flyspace#188 sets observability.logs.invocation_logs: false. When this PR was updated, that PR's pushed head (ce51a51) still had only "observability": { "enabled": true } and its body still described request logs with client addresses. Check its final wrangler.jsonc before merging either. The wrangler 4.152.0 schema it pins describes the setting only as "Set to false to disable invocation logs"; that the remaining event lines carry no request metadata is that PR's claim to confirm.

One wording choice

"The sign-in and account service", not "the account service": site.request counts every response of the staff Function, the /auth/ sign-in pages included, not only /admin/api/v1.

The existing promises stay true

• Lede: counts come only from the staff Function (/auth/*, /admin/*), and no public page calls it today. No page renders the .sy-account control, so src/site/account.js never fetches /admin/api/v1/account (checked in the source and in the live homepage, privacy, Mateo and factory HTML). If that control comes back to the header, its per-page check would become one count per page view, and the lede needs a look first.
• "Nothing is recorded about people who are refused": a refused sign-in adds one anonymous count (route /auth/callback/:provider, 4xx) and nothing about the person.
• Retention: three months is Analytics Engine's platform limit (telemetry.v1); 7 days is the Workers Logs maximum on Workers Paid (3 on Free), which the copy covers as "up to 7 days".

Tests

Re-run after the second commit:

• node scripts/site-chrome.mjs --check: 16 pages up to date.
• pnpm build:site (pnpm 11.25.0 through corepack; Node 22.22.0 here, CI uses 24): exit 0. With the Function built into dist/ as CI does, node scripts/qa.mjs: 24 pages, 0 errors, 0 warnings.
• Not run: screenshots at laptop and phone widths (no Chromium or Playwright here). The change is text inside the page's existing <dt>/<dd> pattern with no CSS change.

Keys and sign-offs

Mateo's handle in Admitted-by. The MasterMind ledger's path policy computes auto for this file (node tools/ledger/cli.mjs floor origin/main...HEAD), but RFC 0004 sections 5 and 7 put every privacy-copy change under Mateo's sign-off.

Merge order

Merge this first. Flyspace's logging PR (SyberLabs/Flyspace#188, Workers Logs on for omni.syberlabs.io, invocation logs off) and the site.request PR (#189) should merge only after this one, so the page describes each feature before it runs. Merging deploys the page.

https://claude.ai/code/session_01VHrJ4hmTtR1RFNpc215EK7

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T02:21:42.919858Z	09855b7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[sdcarlson]

Note for the sign-off on the Omni paragraph: it is true for Flyspace's own logging once SyberLabs/Flyspace#188 deploys (invocation_logs: false, allowlisted event lines only). One part is not yet verified: the framework under Flyspace (vinext and React) can still write its own error lines, some naming a request path, and the runtime records uncaught exceptions. Neither is on the allowlist.

Before this merges, or right after the first Flyspace deploy and before the copy goes live, read one real Flyspace log line in Workers Logs and confirm it holds no URL, query string or address. If framework error lines do appear, the sentence should add that occasional framework error reports name the route that failed. Owner of that check: Seth, as part of the Flyspace deploy.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VHrJ4hmTtR1RFNpc215EK7

---

Generated by Claude Code