Back to Ecosystem

Privacy Policy

Last updated: August 2026 • Platform Version 2.0

GDPR, CCPA & Local-First Compliant

1. Authentication & Identity Data

Bolt Corps utilizes Google OAuth and verified email credentials for authentication. When you sign in, we process only essential identity attributes to provision your profile and session:

  • EMAIL ADDRESSPrimary Google / Verified Email
  • PUBLIC IDENTITYName, Avatar & Bio
  • IDENTIFIERUnique Firebase UID

Authentication tokens are managed via secure, encrypted session tokens. We never store plain-text passwords.

2. AI Studio 2.0 & BYOK (Bring Your Own Key) Architecture

In Corpsian AI Studio 2.0, we enforce a strict zero-knowledge API key policy for external providers (OpenAI, Google Gemini, Anthropic Claude, Groq, OpenRouter, Mistral, DeepSeek, Ollama):

Local-Only API Key Persistence

Your personal API keys are encrypted client-side and saved exclusively in your browser’s localStorage. They are never transmitted to, logged on, or retained by Bolt Corps backend servers.

Direct-to-Provider Communication

When you run prompts, model arena benchmarks, or artifact code generators, your browser communicates directly with the designated provider’s official API endpoints. Your conversational prompts and generated artifacts are not stored in our central databases.

Offline Browser-Native WebGPU Inference

When utilizing local WebGPU models (such as WebLLM Qwen2), model weights and inference execute 100% locally inside your device’s GPU memory and WebAssembly sandbox. Zero prompt data is dispatched across any network.

3. LiveWire IDE, WASM Lab & Code Execution Privacy

LiveWire IDE and WASM Lab operate using browser-isolated client-side runtimes (Pyodide for Python, JSCPP/WASM for C++, php-wasm for PHP, and sandboxed iframes for React & HTML):

  • Your source code, scripts, and console output run entirely within your local browser memory space.
  • Files created or imported in LiveWire IDE are stored in client-side storage (IndexedDB / localStorage) and are never sent to external servers unless explicitly shared.
  • WebAssembly modules execute in safe sandbox environments with no unauthorized access to your operating system.

4. Developer Tools, NovaBoard & NovaSchema

A founding architectural pillar of Bolt Corps is local computation. Our 26+ developer tools process data directly on your hardware:

NovaBoard & NovaSchema

Whiteboards, wireframes, and database ERD schemas are held in browser memory and local storage. Schemas export to SQL/JSON client-side.

QR Code Studio & Scanner

QR decoding uses jsQR in-memory canvas analysis. Images and scans never leave your device.

JSON Studio, JWT & Security Tools

JWT tokens, JSON payloads, passwords, and cryptographic hashes are analyzed strictly within client memory.

Code Snaps & 3D Dev Badges

Rendered via HTML5 Canvas and WebGL. Badges encode metadata into URL hashes or download directly as PNG/SVG.

5. FlowForge Zero-Knowledge Workspace Encryption

FlowForge projects are protected by client-side AES-256 encryption. Before any board item or card is synchronized over Supabase:

  • All card details, task columns, and member notes are encrypted in the browser into ciphertext blobs.
  • Encryption keys are derived from your private workspace invite passphrase and are never sent to Supabase or Bolt Corps.
  • The server only ever stores encrypted ciphertext blobs, ensuring zero-knowledge privacy.

6. Cypher & LiveWire Peer-to-Peer Video Conferencing

Cypher and LiveWire video rooms use serverless peer-to-peer WebRTC connections established via BitTorrent DHT signaling (Trystero):

  • Audio, video, screen shares, and in-call chat streams travel directly peer-to-peer between participating browsers.
  • No video or audio frames are recorded, monitored, intercepted, or archived on our servers.
  • Room identifiers are hashed cryptographically to avoid channel exposure in signaling trackers.

7. Community Forum, Publications & Firebase Synchronization

To enable public community engagement across the Bolt Corps ecosystem, Firebase Firestore stores:

  • Developer Forum: Public discussions, threads, replies, tags, upvotes/downvotes, and moderation status flags.
  • Community Blogs & RSVPs: Technical articles, likes, comments, and event registration listings.
  • Public Profiles: Chosen developer usernames, bios, GitHub links, and showcased achievements.

8. Cookies, Session Storage & Lightweight Telemetry

We do not use third-party advertising trackers or sell telemetry data to third parties. We collect minimal operational metrics:

  • Essential Session Tokens: Secure OAuth tokens for authentication state.
  • Local Storage Cache: Saved preferences, theme modes, offline tools cache, and BYOK API keys.
  • Anonymous Route Telemetry: Route popularity counters stored in Firestore page_stats via atomic increments. Uses a 30-minute sessionStorage de-duplication window. No personal identity or IP logs are tied to page view counters.

9. Data Rights, Account Deletion & Contact

Under GDPR and CCPA, you maintain the right to access, export, or permanently delete your user profile, forum contributions, and associated records. To initiate a data request, please email:

boltcorpsfullstack@gmail.com