Privacy

A copy of a 352-transaction synthetic ledger, generated for this project and belonging to nobody. It is created the first time you ask the agent something or open the dashboard, not when you load a page, so visiting costs nothing. You are signed in anonymously to hold it. There are no accounts here and no way to make one.

• Your copy of the ledger, and anything you change in it.
• Your conversation with the agent, so a reload picks the thread up rather than starting a second one.
• A trace of every model call and tool call in that conversation: what was asked, which tools ran, what they returned, and what it cost.
• An approximate city-level location derived from your request’s IP address, for operational analytics. No browser location prompt is ever shown, and nothing about the site behaves differently because of it. The lookup runs on this server against a database on its own disk. Your address is not sent to a geolocation service, or to anyone. The database is DB-IP’s free city file, used under CC BY 4.0.
• A salted hash of your IP address, used to count messages per day against the site’s cost ceiling. The address itself is never written down.

The operator can. Traces contain the arguments and results of every tool call, which means a trace of your conversation contains the contents of your ledger: the merchants, the amounts, the dates. An operator reading a trace to debug the agent is reading your data. That is a real consequence of building the thing this way, and it is stated here rather than buried in the architecture.

Nothing is shared with anyone else. Prompts and tool results go to Google’s Gemini API to be answered, and to nowhere else.

You may, and the raw CSV is never written to disk or to the database. It is parsed in memory and only the derived rows are stored. Those rows are deleted with everything else after 24 hours. Given the paragraph above about traces, importing a real statement is not advised.