Your draft stays in page memory until you run it
State text, question configuration, selected images, and displayed results are held in the current browser page's memory. This application does not save drafts to local storage or provide server-side run history. Refreshing or leaving may lose the draft. Import reads a configuration in the browser without automatically running it; export downloads a file to your device. Exported files include state and questions, but exclude image bytes, credentials, and results.
Example mode displays authored, fixed results and makes no live model request. Loading the supplied illustration fetches a public asset from this site. Ordinary page and asset requests still pass through the hosting infrastructure.
What a live request sends
When live mode is enabled and you run a request, your text or structured state, questions, and optional image are submitted to this site's server. The server validates input, verifies the Turnstile challenge, and reserves quota before requesting Cloudflare Workers AI. The challenge token is used for verification; it is not passed into the model payload.
The application processes model input and output for that request without writing them to a database or a run-history store. Do not interpret that application behavior as a promise about every infrastructure provider's retention. Avoid submitting secrets or personal data that you are not authorized to send.
Services in the request path
The intended deployment uses Vercel to host the application, Cloudflare Workers AI for inference, Cloudflare Turnstile for abuse prevention, and Upstash Redis for quota counters. Which services receive requests depends on the deployment and whether live mode is enabled. Local example mode does not require a provider account.
Vercel handles application traffic when deployed there. Cloudflare handles model inputs and outputs for live inference, and Turnstile processes challenge-related information. Upstash receives pseudonymous quota keys and counters, not the model's state or image. Their service terms and infrastructure logs are separate from this application's storage behavior.
See Vercel privacy, Cloudflare privacy, and Upstash privacy for provider information. See also Workers AI data usage. These links do not establish zero retention for your deployment.
Quotas and operational logs
The server derives an HMAC pseudonym from the trusted client IP. This pseudonym remains stable while the IP and configured HMAC secret remain unchanged. Redis counter keys combine the pseudonym with a minute or UTC-day window, rather than storing the raw IP as the application quota key. This is pseudonymization, not a guarantee of anonymity. Minute and UTC-day counter keys expire; the current implementation's maximum counter lifetime is 24 hours.
Application request logs are limited to a request ID, model, status, and duration. They exclude state, images, full responses, API tokens, raw IPs, and Turnstile tokens. Hosting and security providers can have their own access logs and retention settings, which must be reviewed for the actual deployment. The application does not promise deletion of those third-party logs on the counter-expiry schedule.
Browser events and controls
On the production site, optional Google Analytics measures visits and actions such as opening an example, starting an analysis, or copying code. It loads only after you choose Allow analytics. Choosing No thanks leaves the toolkit fully usable. When analytics is not configured, it remains disabled and no analytics notice is shown.
Analytics events use known page addresses and preset identifiers. The application excludes playground input, question text, images, answers, verification tokens, URL query strings, and credentials from analytics events. Referrers are reduced to their origin. Google still receives ordinary connection information when analytics loads; see Google's privacy policy.
Your analytics choice is saved in browser local storage. If you allow analytics, Google can set first-party analytics cookies; this site's configuration sets their lifetime to 30 days without extending it on each visit. Advertising storage, advertising personalization, and Google Signals are disabled. Use Privacy choices in the footer to withdraw permission for subsequent collection; this also removes this site's accessible Google Analytics cookies. Withdrawal does not erase data already received by Google.
Turnstile is a separate third-party component when live mode is configured, and its own processing is covered by Cloudflare's policies. Declining analytics does not disable abuse prevention.
Close or refresh the page to clear its in-memory draft. Delete exported files on your own device if you no longer need them. There is no account profile or application run-history record to delete. For data handled by a provider, use that provider's documented privacy channels and the deployment operator's applicable process.
Review this page when deployment changes
Saving history, changing providers, or changing logging would change the data flow and requires this notice to be updated. This page describes the application's behavior; availability of live inference and optional analytics depends on the deployed configuration.