Local-first does not mean data-free.
The CLI, engine, worker, and Workbench have no telemetry, update checks, crash reporting, or hosted Irrevon service. Runtime records stay in the operator's PostgreSQL deployment. This static website has a separate, disclosed measurement boundary.
Website measurement
Two separate data paths exist. First, requesting any hosted page necessarily sends connection and request metadata to the hosting provider, such as an IP address, requested path, user agent, and timing data. Browser-side query scrubbing cannot prevent or erase that hosting request.
When the owner enables them on a Vercel production deployment, this site loads Vercel Web Analytics and Speed Insights from same-origin paths. They are cookie-free, aggregated telemetry, but Vercel still processes the measurements. Depending on the product, that can include a timestamp, cleaned page URL, referrer, coarse geography, browser, device and operating-system information, plus Web Vitals. See Vercel's Web Analytics privacy documentationand Speed Insights documentation.
Separately, before optional browser telemetry sends an event, the site removes every query parameter from the event URL. This protects the telemetry payload; it does not scrub the original request already received by the host. A separately gated build may retain only the five validated lowercase UTM parameters. Custom conversion events are also disabled by default; when explicitly enabled on a compatible plan, they carry only a fixed event name and fixed placement value. No event includes effect IDs, stable IDs, API payloads, search text, email addresses, credentials, user IDs, or free text.
Measurement preference on this browser
This local preference blocks future Web Analytics and Speed Insights events from this browser. It cannot retract a pageview or performance event sent before you changed it, and it does not alter runtime Irrevon data because runtime components never use this telemetry.
Reading this browser's preference…
Workbench boundary
irrevon serve binds only to 127.0.0.1, validates the Host header, accepts GET/HEAD only, and connects through a SELECT-only database role. Stable upstream identifier keys remain visible, while values are represented as deterministic SHA-256 digests. Raw values require the explicit local CLI inspect --reveal option.
What the ledger stores
The ledger stores intent metadata, request parameters needed for recovery, digests, transitions, receipts, probes, and findings. Request parameters can contain personal or confidential data when an integrator puts it there. Digests are not anonymization, especially for low-entropy values.
Operator responsibilities
- Minimize provider payloads and keep credentials outside configuration files.
- Set retention, backup, access-control, and deletion policy for the deployment.
- Treat evidence exports, screenshots, logs, and backups as potentially sensitive.
- Never submit production records, keys, or private identifiers to public issues.
Security reports use the private path on the Security page.