Security and data flows
Your chat is processed in your browser. This table explains the other data flows, including services that need an internet connection.
飛航模式測試：先開啟頁面一次，關閉網路，再製作 PDF。因為不會上傳對話檔案、訊息或附件，所以仍可正常運作。請保持分頁開啟；離線時重新整理或重新開啟頁面並不受支援。
首次造訪與離線準備、付款、授權啟用與重新驗證，以及選用的 AI 功能需要網路連線；請等準備完成後再中斷網路。
| What data | Where it goes | Why | Retention |
|---|---|---|---|
| Chat files, messages, redactions, PDFs and hashes | Your browser tab only | Parse, preview and export; no chat file or attachment is uploaded | In memory until the tab closes; downloaded files stay on your device |
| Settings, wizard choices, signed license token, random install ID; license key and device instanceId stored in plaintext in localStorage convokeep.license-device | Browser storage | Remember settings and offline entitlement; manage devices; no chat content | Until cleared; license key and instanceId until you remove the license on the License panel or clear browser data; wizard state until the tab closes |
| IP, browser, URL, referrer and connection metadata | Cloudflare hosting | Deliver site files, samples and self-hosted fonts | Cloudflare policy; platform logging settings are not verified |
| Page, referrer, country, browser and performance | Cloudflare Web Analytics | Cookieless aggregate statistics; no chat content or query strings | Unsampled: 7 days; aggregates visible for 6 months |
| Allowed event names and enum/count properties; IP received at the network level | PostHog (US), when enabled | Cookieless usage counts; no chat content or session replay | Project retention unverified; IP-discard dashboard setting requires verification |
| Payment details, email, billing data and order | Polar checkout (live provider) | Payment; chat content is never sent | Polar policy |
| License key and random install ID | Cloudflare entitlement function → Polar license API | Activate a license; activation needs a connection | Signed token stored locally until removed; provider records follow Polar policy; platform logs unverified |
| Product, amount, currency and sales totals; no buyer fields | Cloudflare payment function → Telegram operator alerts | Sale/refund notifications | Telegram policy; no deletion period controlled by us |
| Support sender address, message and any attachments | Cloudflare Email Routing → owner’s Gmail (US) | Answer support requests. Do not send chat content | Until the owner deletes the email |
| IP, browser and requested model path; never chat content | Hugging Face and model CDNs (opt-in) | Download optional search/transcription models; inference stays local | Host log policy; downloaded models cached in browser until cleared |
| Dodo payment/license data; checkout return may briefly contain key and email | Dodo and Cloudflare (built, inactive with Polar) | Alternative checkout/license service; return parameters removed before analytics | Dodo policy; platform request metadata outside our control |
| Country code from Cloudflare request headers; selected currency | Same-origin region function → browser (Dodo only; inactive with Polar) | Show local prices; no GPS or IP returned, stored or forwarded by the region function | No server retention; currency stored in browser until cleared |
| Peppered key/IP hashes and activation/rate counters; webhook IDs | Cloudflare D1 / KV (built, not yet active) | Day Pass windows, rate limiting and deduplication | Rate rows older than 24 h cleaned on new windows plus weekly cleanup; activation windows indefinite; KV: 7 days |
| Static app files only: code, PDF fonts, synthetic samples and preview illustration; no chat content | Same-origin files → browser Cache Storage (convokeep-export-<build hash>) | Prepare PDF export for offline use; never caches chat files, attachments, PDFs, redactions, searches or license data | Until a newer app cache activates, browser eviction or clearing this site’s data in browser settings |
Source: data map reviewed 29 October 2026. Unverified retention and platform settings are marked above. Planned support AI and email sending are not live. Payment, license activation, first-time asset/model downloads and analytics require a connection; chat processing stays local.