Privacy, plainly.

Local-first case files

Your case files and workspace preferences are stored in your browser's localStorage on the device you are using. They are not synced to your WormGPT account. The account itself holds only your username, role, session metadata and license state.

Clearing your browser's site data removes this local information. You can also export or delete everything from Settings → Data.

What leaves your browser

WormGPT V4 requests

When you send a message, the text is sent over HTTPS to WormGPT's own route to generate the response. It is not forwarded to a third-party AI provider. The prompt is processed in memory and is not written to a database.

No provider keys

WormGPT V4 is the current model. WormGPT V3 is a legacy model and is not available for purchase. There are no external provider accounts, API keys or model-routing integrations to connect.

Your account

Creating an account requires only a username and a password. We store a bcrypt hash of the password — never the password itself. Sessions use a random token, stored hashed in the database and sent as an HttpOnly cookie. We do not ask for an email address and there is no email verification step. License records keep the minimum needed to prove the access window.

What we do not use

• No advertising trackers or third-party analytics in this build.
• No sale of personal data.
• No training on your case files.
• No behavioural profiling or contact lists.

Cookies and storage

WormGPT uses a single session cookie to keep you logged in, plus localStorage for workspace preferences and case files. It does not rely on advertising cookies. Hosting infrastructure may process standard request metadata such as IP address and user agent for security, reliability and abuse prevention.

Security work and client data

Security engagements often involve confidential material. Do not paste client data, credentials, private keys or personal information into any AI tool unless your engagement policy and the data owner allow it. The local-first design reduces exposure, but it does not make an unauthorised disclosure acceptable.

Your choices

• Export all local case files as JSON from Settings → Data.
• Delete individual case files from the sidebar.
• Clear all local data with one action in Settings → Data.

Contact

Questions about this policy can be sent to hello@wormgpt.app. This page describes the behaviour of the open deployment in this repository; a production operator should review and adapt it for their own jurisdiction and practices.