Read this before you trust us
Where your words go. Exactly.
Your decision text goes to two places: this device, and — only when you seal a question — the people you chose, plus the model that drafts the attempt. Below is every service we use and precisely what each one sees.
Anthropic (or OpenRouter as fallback)
The decision text you type, when you run the attempt — sent to draft it, streamed back, not stored by us. The attempt is shown once and not saved.
Neon (our database)
Only what you seal to a panel: the framed question exactly as you previewed it, seat names, blind answers, your ritual marks. Never your notes, stakes, or the names you screened out — those stay on your device.
Clerk
Your email, only if you seal a question to others — that's how we tell you when the answers are in. Answering a panel never needs an account.
Resend
The emails we send: invites (carrying the framed question), one reminder, the unseal notice, and the one follow-up note you asked for. No open or click tracking — our emails contain no pixels.
PostHog (self-proxied)
Step names only — 'an attempt was run', 'a panel was sealed', 'a seat answered'. Counts and booleans; never the words of anyone's decision. Cookieless.
Inngest / Upstash / Vercel
Plumbing: room ids and timers (when to unseal, when to remind — once), rate-limit counters keyed to a hashed address, and the hosting itself.
And the standing rules
Nothing is sold. Nothing you write trains any AI model. Blind answers can be edited until the unseal and are shown to everyone at once — anonymity of order, not of identity. A seat link is a credential: we store only its fingerprint, never log it, and it expires. No streaks, no guilt-trip messages, no third reminder — there is no second one either.
This page is versioned in public. If a commitment on it weakens, the diff will show it.