Your account and private history.
CarbonShift uses Supabase authentication with the configured Google and GitHub providers. Your account identity connects you to private reviewed activity inputs, time windows, energy assumptions, source snapshots, schedules and append-only reports/results.
Server ownership checks and database row policies restrict access to your records. Sign-out ends your session. Private deletion removes eligible private schedules and reports; account deletion removes the CarbonShift account and private history. Your Google or GitHub account itself is kept.
Destructive actions need a recent confirmation.
Account settings require a new provider exchange for the same identity before protected deletion. The confirmation lasts ten minutes. A provider may reuse its own existing session; CarbonShift still requires that new exchange.
Optional assistance has its own consent.
When you explicitly consent, the description you submit is sent to the configured Gemini or Groq provider, including an eligible fallback. Leave out personal, sensitive or confidential details. The interpreter proposes editable fields; it cannot save, publish, operate equipment or make authoritative energy claims.
Ordinary application logs retain bounded request, outcome and quota metadata rather than raw prompts or extraction outputs. Explanation caching contains validated reason codes bound to your account and the relevant plan/context. Your own description is not a durable chat history.
Free Gemini access may involve provider product-improvement processing and human review under the applicable regional terms. Provider retention is separate from this app’s metadata retention. Public deployment eligibility and model access remain separate configuration decisions.
Manual entry remains available when assistance is disabled, exhausted or unavailable. Choosing not to use assistance does not prevent deterministic simulation, comparison or private saving.
Simulation stays separate from saving.
Reviewed simulation inputs are sent to the authenticated calculation endpoint and remain in page state. Calculating an estimate does not create an accepted plan, start equipment or publish a receipt.
If you explicitly carry an activity into the planner, reviewed activity fields can be stored temporarily in the same tab’s session storage for up to thirty minutes. The handoff excludes credentials and raw AI text, is revalidated against the signed-in account, and is cleared on successful use or sign-out.
Editing an activity can invalidate a displayed result. A new confirmed calculation can fetch the applicable source window; accepted plans keep their original snapshot rather than inheriting those later changes.
Publication makes timing inspectable.
Before publication, an exact preview shows the fields that will become public. A public copy needs enough detail to reproduce its calculation. Generic task names remove private custom labels, but schedule timing and availability can still disclose a routine.
- What a public copy can contain
- Generic aliases and activity categories; usual/selected times; availability and blocked periods; energy inputs; grid factors; method/search details; and separately consented result snapshots.
- What the export leaves out
- Private custom names, account identifiers, raw descriptions and credentials. Sanitizing these fields does not make the disclosed timing anonymous in every context.
- What deletion cannot recall
- Consented public copies, downloaded files and on-chain digests can remain after account or private-plan deletion. Private account links are removed. External copies cannot be erased.
Unsigned queued work is stopped during deletion where applicable. Already-signed or broadcast transactions cannot reliably be recalled and may still confirm. Correcting a private report does not automatically disclose the correction; each public result has its own review and consent.
Cookies and limited operational records.
Session cookies support sign-in. A signed browser identifier and bounded quota metadata support login and public-reading limits. Raw IPs, login codes and credentials are not copied into AI prompts or exposed in page content.
Unpublished private plans and their reports become eligible for cleanup after 30 days. Unaccepted comparisons become eligible after 24 hours. You can delete eligible private records earlier through the account controls. Private request-idempotency and AI task keys have bounded retention, while routine AI run metadata is pruned after seven days through maintenance. Quota/abuse-prevention metadata can remain de-identified until its relevant window expires; deleting an account does not refund shared provider quotas.
Consented public evidence is retained. The daily deployment maintenance job processes eligible cleanup in bounded batches when configured and running. Local development uses the explicit retention command. The separate ledger worker must be running for queued delivery. A local process does not establish always-on hosting or immediate removal from every external provider.
Chosen proof files are checked locally.
The local verifier reads and processes your selected proof bundle in this browser. Selecting a file does not upload it. The calculation can be inspected without an RPC connection.
An optional operator chain lookup sends the receipt identifier to the configured service. You are trusting that service for its chain observations. You can instead supply a bounded observation file from a source you trust. Embedded transaction links alone are not independent chain evidence.
Operator contact and release status.
Contact the operator
lovejeet1225@gmail.com
This page describes the implemented application boundaries. A working local prototype does not imply an independently certified privacy programme or a public production deployment.