From 09855b75573b8d42690eed3db138f32d62be6710 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 31 Oct 2026 02:19:35 +0000 Subject: [PATCH 1/3] Privacy: the account service's request counts and the Omni preview's logs Two disclosures for MasterMind RFC 0004 (P5a), ahead of the features they describe: the sign-in and account service counts its requests and errors by route and app, identifying no one, for three months; and the Omni preview's server keeps Cloudflare request logs (method, URL, status, timing and the IP address Cloudflare sees) for up to 7 days, with no canvas content or question text. The lede is unchanged. Last updated 31 October 2026. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01VHrJ4hmTtR1RFNpc215EK7 --- privacy/index.html | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/privacy/index.html b/privacy/index.html index b796153..49c4ffd 100644 --- a/privacy/index.html +++ b/privacy/index.html @@ -52,10 +52,11 @@

What this site does with your data.

Video
The RISE demo page embeds a video from YouTube using its privacy-enhanced domain (youtube-nocookie.com). Nothing loads from YouTube until you press play on that video. The site’s own demo video is served from syberlabs.io.
Email
Contact links open your email app. SyberLabs receives only what you choose to send and uses it to reply to you.
Private app backups
Signed-in people can explicitly save a private backup from Omni, RISE or Sketch to their account. We store the selected document or canvas content, its name, app and save time in Cloudflare D1, linked to the account. There is no automatic upload: existing local work stays in the browser until you choose Save to account. The apps can retrieve only their own app’s backups for that signed-in account. Backups stay until you ask us to remove them; use the contact below to request removal. Each account can store up to 50 backups, with a 1 MB limit each and 10 MB total. These backups do not carry model API credentials or grant application permissions.
-
Staff sign-in
People SyberLabs adds can sign in with GitHub, and can add Google. We receive the account’s numeric id and username from GitHub and keep them, with the roles we grant and sign-in times, in a Cloudflare database. For Google, we receive the account’s id and email address. Sessions and admin actions are recorded with a shortened IP address and the browser name. We never keep Google or GitHub access tokens. Starting a sign-in sets a 10-minute cookie on syberlabs.io; signing in sets a session cookie that expires after 13 hours, and the session itself ends after 12. Nothing is set for visitors who don’t start a sign-in, nothing is recorded about people who are refused, and the session cookie stays on syberlabs.io. Omni, RISE and Sketch can check that session through a restricted account service. Records are kept for about 400 days. Staff accounts are turned off, not deleted, when access ends; ask us and we will remove your details. Processors: GitHub, Google, Cloudflare.
+
Staff sign-in
People SyberLabs adds can sign in with GitHub, and can add Google. We receive the account’s numeric id and username from GitHub and keep them, with the roles we grant and sign-in times, in a Cloudflare database. For Google, we receive the account’s id and email address. Sessions and admin actions are recorded with a shortened IP address and the browser name. We never keep Google or GitHub access tokens. Starting a sign-in sets a 10-minute cookie on syberlabs.io; signing in sets a session cookie that expires after 13 hours, and the session itself ends after 12. Nothing is set for visitors who don’t start a sign-in, nothing is recorded about people who are refused, and the session cookie stays on syberlabs.io. Omni, RISE and Sketch can check that session through a restricted account service. Records are kept for about 400 days. The sign-in and account service counts its requests and errors by route and app, without identifying anyone, and keeps those counts for three months. Staff accounts are turned off, not deleted, when access ends; ask us and we will remove your details. Processors: GitHub, Google, Cloudflare.
+
Omni preview
The server behind the Omni preview at omni.syberlabs.io keeps Cloudflare request logs for up to 7 days to diagnose faults: each request’s method, URL, status and timing, and the IP address Cloudflare sees. No canvas content or question text is logged.
Other sites
Links to GitHub, LinkedIn, TypeSafe AI and other sites follow those sites’ own policies. The RISE reading app has its own RISE privacy policy.
-

Last updated 8 October 2026. Questions: hello.mateorobles@gmail.com

+

Last updated 31 October 2026. Questions: hello.mateorobles@gmail.com