GLYPHAbout this policy
This draft describes the current GLYPH website and Skill Builder: a private research workspace for defining, testing and exporting Web3 research skills. It covers GLYPH’s application behavior, not the separate practices of AI, data or hosting providers.
Operator details, contact information and deployment-specific legal disclosures are not included in this draft. They must be completed before this is used as a final public privacy notice.
What is processed
- Skill content: task descriptions, names, networks, research windows, workflow steps, source instructions, examples and expected behavior.
- Research evidence: token addresses, protocol identifiers, retrieved public records and evidence you supply. Public wallet or blockchain data may still relate to identifiable people.
- Run information: generated methods, reports, evaluations, timestamps, model identifiers, token usage and operational errors.
- Connection information: provider API keys supplied for a session, selected models, and workspace-password verification.
- Technical information: a session identifier, request metadata and the network information necessarily processed by the server and infrastructure providers.
The current product has no user-registration, payment-card collection, advertising or marketing-analytics integration. Do not submit private keys, seed phrases, credentials in research fields, or personal information you are not entitled to use.
When data leaves your browser
| Action | Processing |
|---|---|
| Edit, save or export a skill | Editing and file generation happen in the browser. Save draft writes to this browser’s IndexedDB database. Import, duplicate and version restoration also happen locally. |
| Verify a connection | The key goes to the GLYPH server and the selected provider to check access. The application does not return the secret key to the browser. |
| Fetch selected data | The draft is sent to the GLYPH server. The enabled data providers receive the chain, token contract or protocol identifier needed for the request. No AI request is made. |
| Generate methodology | The draft, including evidence entered in its fields, is sent through the server to the selected AI provider. |
| Run research | The draft and collected evidence are sent to the AI provider for analysis. The report, evidence and expected behavior are sent again for evaluation. |
These actions support the requested research workflow, connection verification, operation and access protection. This draft does not assert a universal legal basis for every jurisdiction; applicable legal bases and operator obligations must be assessed for the public deployment.
Third-party services
- OpenRouter and routed model providers: when selected, receive prompts and evidence. Routing, retention and training practices depend on the account settings, model provider and applicable terms. GLYPH does not currently enforce zero-data-retention routing.
- OpenAI: when selected directly, receives API requests. GLYPH requests that Responses API objects are not stored, but this is not a promise of zero retention by the provider.
- DEX Screener and DefiLlama: receive the public identifiers needed to retrieve selected records.
- Hosting: a hosted installation, including one deployed on Railway, processes requests through its hosting infrastructure. Provider logs and their retention are separate from GLYPH’s in-memory run storage.
- Google Fonts: current styles request fonts from Google, which receives ordinary network request information, including your IP address.
Providers may process data in other countries. No specific residency region or international-transfer arrangement is promised by this draft. Review OpenRouter’s privacy policy, OpenAI’s privacy policy, and the terms of the providers you choose before sending sensitive material.
Storage and retention
| Location | Current behavior |
|---|---|
| Browser storage | IndexedDB stores My Skills, up to 30 snapshots per skill, and research history including reports, evidence, usage and the input needed for reruns. These remain until you clear this site’s storage or your browser removes it. Local storage keeps the active skill identifier and any legacy draft used during migration. New skill does not erase saved history. |
| Browser session storage | Run identifiers support restoring the latest run in the same tab. They normally persist for the tab session. |
| Session cookie | An HttpOnly, SameSite=Strict cookie identifies the workspace session. Hosted HTTPS configurations mark it Secure. It is a session cookie; browser restore behavior can vary. |
| Server memory | Runs and their inputs/results are removed after approximately one hour from creation once no longer running. Inactive sessions, including session keys, expire after approximately one hour without API activity. Restarting the server clears this memory. |
| Environment credentials | Keys configured by the operator remain in the deployment environment until changed or removed there. Disconnect session key does not delete an environment key. |
| Downloads | Exported files remain on your device until you delete them. |
These periods describe application storage only, not third-party retention, infrastructure logs or copies you export. The current application does not intentionally persist research content to a server database.
Your choices and rights
You can edit a draft before sending it, use manual editing without an AI connection, disable data connectors, disconnect a session key and export your work. To remove local drafts and snapshots, clear this site’s browser storage; export anything you need first. Cancelling a run does not retract data already sent to a provider or guarantee deletion from provider systems.
Depending on the law applicable to you and the operator, you may have rights to access, correct, erase or restrict processing of personal data, request portability, object to certain uses, withdraw consent where consent is relied on, and complain to a supervisory authority. This draft does not provide an operational contact channel for those requests yet.
Security and changes
GLYPH uses server-side provider requests, session isolation, request verification and a workspace password for public hosting. These measures do not guarantee that data cannot be lost or accessed without authorization. Use HTTPS for hosting, keep your keys private and avoid sensitive evidence where possible.
The service is intended for adults. It is not designed to collect children’s information. Changes to product behavior or providers should be reflected here before the changed processing is introduced. The revision date appears at the top of this page.