Default
Local first, not hosted first
Core review and cockpit workflows are described as local product behavior. Hosted accounts, SSO, and organization membership are separate product concerns.
Security and privacy
Local-first trust, stated plainly.
FactionOS starts on the operator machine and treats external transfer as explicit.
No hosted account is required for the core local workflow. Optional services are described as separate choices rather than silent defaults.
- Defaultlocal-first
- Accountnot required
- Analyticsabsent
This site does not ask for prompts, local paths, credentials, terminal output, or source code.
Trust manifesto
Useful security copy starts with the boundary.
FactionOS is designed around local visibility for AI-assisted development work. The default path keeps hook events, mission context, and cockpit state on the machine running the local product.
That default does not turn sensitive development data into low-risk data. Prompts, file paths, terminal output, credentials, replay state, demo payloads, and user-provided code remain sensitive and need explicit boundaries before any transfer.
Exit
Transfers are named
War Room, outbound adapters, provider calls, demo, and docs links are treated as optional or separate surfaces with clear user action.
Telemetry
No silent analytics
The launch site has no analytics by default. Future analytics work must be opt-in, scrubbed, documented, and blocked from sensitive payload classes.
Limits
Clear limits
Security copy stays tied to the current product posture and does not stand in for certification or legal policy.
Local-first is a default operating posture, not a formal security certification or a promise that every future surface is proven.
Event lifecycle
Where data sits at each step.
Every lifecycle step shows its default posture and operator boundary.
- Hook event
Work starts as local development signals.
Claude Code hooks, Codex CLI hooks, or compatible producers can emit structured workflow events for the local product. Compatible producers can use the generic event API shape.
Default Product hook data starts in the user's local development context.
Prompts, transcripts, command bodies, credentials, and broad local paths are blocked from public-site materials.
- Local ingest
The local server normalizes reviewable state.
A local ingest path can turn events into structured mission, timeline, diagnostic, and review records for the local cockpit.
Default The baseline does not require Supabase, hosted persistence, public replay, or a cloud account.
External provider transfer remains disabled unless explicitly configured and separately allowed.
- Cockpit display
Operators review state in a local browser surface.
The cockpit can display missions, lanes, status, replay, settings, and diagnostics when the local runtime is active.
Default Browser preferences and replay state stay in the local product context.
Public examples are previews, not connected workspace state.
- Optional transfer
External exits are deliberate surfaces.
War Room collaboration is optional and separate from the local baseline. Discord, Telegram, and generic HTTPS adapters are optional outbound paths. Provider analysis, the public demo, and public docs are separate from the default local path.
Default A configured external surface is required before transfer can happen, and sensitive categories stay blocked or redacted.
Optional transfer is separate from hosted identity, production auditability, and default analytics.
- Cleanup limits
Cleanup exists by boundary.
Browser reset, local file deletion, Worker room cleanup, backup pruning, and archive removal are different authority boundaries.
Default Each cleanup path needs its own authority, confirmation, and verification.
Manual cleanup and scoped deletion are not presented as one proven end-to-end erasure workflow.
Local data classes
Sensitive data stays sensitive.
Website posture, product posture, and blocked transfers are listed per data class.
| Data class | Website posture | Product posture | Blocked transfer |
|---|---|---|---|
| PromptsMission prompts and summaries can describe sensitive work intent. | This site does not request prompts. | Prompt text stays local by default and is minimized before optional provider transfer. | Raw prompt bodies are blocked from public docs, diagnostics, logs, exports, and analytics. |
| File pathsPaths, cwd values, repo names, and transcript paths can expose local structure. | This site cannot inspect local filesystem paths. | Local product surfaces redact broad paths before broad exposure. | Full local paths are blocked from website analytics, hosted diagnostics, and public examples. |
| Terminal outputCommand output can contain secrets, paths, hostnames, or source snippets. | This site does not run commands or collect terminal output. | Terminal output is not a default hook payload category and must stay narrow when summarized. | Raw terminal scrollback is blocked from analytics, public docs, and optional federation frames. |
| Local event snapshotsTimeline, diagnostic, and mission snapshots can reveal workflow context. | Public pages do not fetch local events, open WebSockets, or personalize content. | Snapshots remain local runtime state unless a user configures an outbound surface. | Diagnostics must use compact status labels, counts, timestamps, and safe family names. |
| CredentialsTokens, API keys, auth headers, and credential-bearing URLs are high-risk payloads. | This site has no login, hosted form, auth flow, or credential collection path. | Credential-like values are redacted from local logs, diagnostics, exports, and adapter payloads. | Secrets, bearer values, account ids, and credential URLs are blocked at every external boundary. |
| Replay dataReplay state and share fragments can carry local mission history. | This site does not accept replay uploads or public replay state. | Replay state is local browser state unless the user explicitly exports or shares it. | Replay buffers are blocked from Worker catch-up, hosted diagnostics, and analytics payloads. |
| Demo payloadsThe zero-install demo is a guided preview and stays separate from local sessions. | This website links to the separate demo and does not embed a live demo payload. | Demo content stays separate from local runtime state. | Real prompts, paths, scans, exports, logs, and media drafts are not demo payload material. |
| User-provided codeCode snippets and file contents can include proprietary logic or personal data. | This site has no upload, form, CMS, or code submission path. | Codebase analysis requires local user action and optional provider transfer remains two-level opt-in. | File contents and user-provided code are blocked from analytics, public examples, and default adapters. |
Optional boundaries
Transfers are named, never hidden.
Collaboration
Optional War Room
War Room collaboration is optional and separate from the local baseline. Federation is a separate Cloudflare Worker surface for room lifecycle, presence, catch-up, and allowlisted redacted events when configured.
Controls
- User-configured Worker URL before use.
- Schema-validated frame families only.
- Authority tokens stay browser-held request credentials.
Not included
- Hosted account system
- SSO or organization membership
- Public collaboration safety
- Unified erasure policy
Notifications
Outbound adapters
Discord, Telegram, and generic HTTPS adapters are optional outbound paths. Provider-style outputs are optional exits that require explicit configuration and redaction.
Controls
- Outbound formatters redact tokens, paths, URLs, and command previews.
- Provider transfer needs API key configuration plus an allow-transfer flag.
- Failures should stay visible instead of silently dropping operator context.
Not included
- Default upload
- Raw prompt transfer
- Terminal capture
- Silent analytics
Hosted
Future hosted services
Supabase, hosted storage, push, analytics, tunnels, public replay, and remote access remain disabled-default or future review surfaces.
Controls
- A scoped session must add consent, minimization, authorization, abuse controls, tests, and docs.
- Local fallback remains part of the product baseline.
- Hosted operation needs its own validation and launch review.
Not included
- Hosted persistence
- Remote execution
- Inbound command handling
- Hosted production runtime
Demo
Public demo
Zero-install product preview hosted separately from this website. It is useful for inspection but not connected to a user's local workspace.
Controls
- External destination label on links.
- Guided preview posture.
- No workspace import path through this page.
Not included
- Live local session
- Production app shell validation
- Real customer data processing
Docs
Public docs
The GitBook docs are a separate public documentation surface for setup and deeper references, not a hosted product runtime.
Controls
- External destination label on links.
- Docs-owned setup detail.
- No website form or CMS path.
Not included
- Legal policy completion
- Security certification
- Hosted account management
Redaction guardrails
What is scrubbed before anything leaves.
Redaction
Sensitive classes are blocked before broad exposure.
Redaction is boundary-specific, so every external, diagnostic, export, archive, adapter, and future analytics surface needs explicit minimization.
- Payload shapeUse allowlisted labels, counts, statuses, timings, and safe family names instead of raw payload bodies.
- Boundary reviewA transfer that is safe for one local view is not automatically safe for Worker storage, provider calls, logs, or public copy.
Blocked payloads
- prompts
- transcripts
- file contents
- terminal output
- secret values
- full local paths
- PII
- exports
- replay buffers
- logs
- backups
- scan payloads
- media drafts
Consent
External transfer requires explicit user action.
Configured keys, Worker URLs, or destination links are not treated as blanket permission to send sensitive development data.
- Provider callsLLM provider transfer requires both a provider key and an explicit allow-transfer setting before file analysis leaves the machine.
- CollaborationWar Room use requires a configured Worker URL and room action; it does not become default hosted identity.
- External linksDemo and docs links disclose that they leave the website for separate public destinations.
Blocked payloads
- raw authority tokens
- credential-bearing URLs
- account settings
- unrelated local config
- workspace file content
Telemetry
Settings can show posture without recording behavior.
Passive settings and readiness copy can explain disabled analytics and hosted-service status without enabling capture.
- Status onlyReadiness helpers report labels, booleans, docs paths, allowed fields, and blocked payload categories.
- No recorderRecorder, heatmap, dashboard, session replay analytics, server ingestion, beacon sender, and SDK import remain absent.
Blocked payloads
- click recordings
- session replay
- console logs
- prompt text
- local paths
- demo session payloads
- user-provided code
Analytics posture
Absent by default, future-gated by guardrails.
The launch site does not ship analytics. Future analytics work needs consent, scrubbing, host controls, and tests.
- Website
- No analytics
- Future provider
- Umami
- Replay
- Blocked
No tracking script, beacon, SDK import, form handler, cookie, or localStorage write is added.
Future Umami work must stay disabled by default or explicitly controllable and self-hostable.
Recorder, heatmap, replay-style inspection, console-log capture, and raw event capture stay off.
Blocked payloads
- prompts
- transcripts
- file contents
- terminal output
- secret values
- full local paths
- PII
- replay data
- demo session payloads
- user-provided code
Future conditions
- Explicit consent or disabled-default controls.
- Payload allowlist and blocked sensitive classes.
- Host and version filtering.
- Tests proving no recorder, heatmap, replay, or sensitive payload capture.
- Docs that distinguish analytics posture from product security policy.
Analytics does not replace hosted identity, production auditability, certification, or erasure policy.
Security FAQ
Practical trust answers.
Does FactionOS require a hosted account?
No for the core workflow. No hosted account is required for the core local workflow.
SSO, organization membership, hosted identity, public collaboration safety, and production auditability are separate product concerns.
Optional hosted or Worker surfaces must be described separately from the local default.
Does this website collect prompts, paths, terminal output, or code?
No. This site has no hosted form, auth flow, analytics script, runtime fetch, WebSocket, command execution, cookie, or localStorage write.
The site can link to the demo and docs, but it does not inspect a local workspace or receive product hook payloads.
External destinations are separate surfaces and use explicit external link treatment.
When can data leave the operator machine?
External transfer requires a configured optional surface, such as War Room, an outbound adapter, or provider analysis that passes the project transfer controls.
Provider analysis is two-level opt-in: credentials alone are not enough; explicit provider transfer must also be allowed.
Default local behavior must not be rewritten as default hosted upload.
What does optional War Room share?
War Room federation is limited to allowlisted redacted room lifecycle, presence, catch-up, and collaboration event families when a Worker URL and room flow are configured.
It must not transfer prompts, file contents, command bodies, terminal output, transcripts, exports, replay buffers, logs, local diagnostics, backups, or raw authority tokens.
Worker-issued room authority is separate from hosted account identity and erasure policy.
Are analytics active?
No. The launch site has no analytics by default.
Future Umami work must be explicitly controllable, scrubbed, documented, tested, and blocked from sensitive payload classes before runtime tracking exists.
Future analytics readiness is not active website or product tracking.
Can FactionOS erase every copy of my data?
Browser reset, local file cleanup, Worker room-state deletion, backup pruning, and archive deletion are separate authority boundaries.
A broad erasure workflow would need dry-run, confirmation, execution, idempotency, partial-failure handling, redacted audit, and verification across every covered surface.
Scoped cleanup is useful, but it is not one proven end-to-end erasure workflow.
How are credentials handled?
This site has no credential collection path. Product code treats bearer values, API keys, auth headers, credential-bearing URLs, and account ids as blocked or redacted data.
War Room raw authority tokens are browser-held request credentials and must not be stored in localStorage, displayed, exported, replayed, logged, or copied into diagnostics.
Credential posture is separate from hosted account, SSO, and certification work.
Are the demo and docs connected to my local workspace?
No. The demo and docs are separate public destinations. The demo uses guided examples, and the GitBook docs hold setup and reference material.
Opening those links does not connect this site to a local FactionOS runtime or import a local workspace session.
External links open separate destinations.
Is this the legal privacy policy or a certification page?
Next trust checks
Inspect the product without changing the boundary.
Zero-install product preview hosted separately from this website. Read the public docs, or follow the product and how-it-works routes to compare local, optional, outbound, and future surfaces.
These links open separate destinations and do not connect this page to a local workspace.