How your data is handled

Private matters and saved AI answers

Only when you choose Save privately does Seekyoo keep the matter title, question, notes, progress and any attached historical answer with its source version in your account. Unsaved question answers remain in the page session. Saving is separate from allowing discovery or contact. You can reopen, export or delete a saved matter. This does not remove a separately approved discovery summary or a completed contribution record.

Ordinary help and optional ongoing help

Ordinary members can share a reviewed, expiring need or offer without creating a node. Eligible verified members see only that summary, the stated exclusions, topic, language and expiry. They do not see private notes or preparation materials. Responses and help notes are stored for the two participants. Each person explicitly chooses any name or email shared after mutual confirmation. Human reception limits are combined across the account; changing or pausing permissions closes unfinished contacts. New social responses use the Contacts page, with no automatic email or push notification. An optional expert-node wizard saves preparation and can publish the reviewed human-help summary. AI service connection, materials, trial answer and publication are separate steps.

Contribution records and optional decoration

A completed personal help note or authorized AI answer produces a private business record for the helping account. AI answers are not counted as the owner personally replying. Completion, requester feedback and reward eligibility are separate; no feedback means unknown. Feedback may be corrected or withdrawn, and no points or payment are offered. Export is available. Account deletion removes owned private records; another helper may retain the minimal completed event with the deleted requester identity removed. Space decoration and a dismissed setup suggestion are optional preferences stored in this browser for your account.

Your account and private nodes

Your email, verified identity and session cookie support sign-in. Google sign-in supplies identity information to Supabase Auth; Seekyoo does not receive your Google password. Creating a node saves its name, introduction, draft and recorded location. It does not authorize matching, share your identity or install software on another device.

Review before sharing

Private conversations and drafts remain separate from the exact structured request you authorize. Review its content, recipient limit, expiry and selected independent nodes. Editing a draft does not change an existing authorization. Revocation blocks future access and result commits but cannot recall delivered information. Legacy expert matching keeps private exclusion rules separate; ordinary discovery shows the exclusions explicitly included in its sharing preview. Both people must agree before identities appear. AI advice does not verify identity, competence, safety or location. Do not enter patient details, passwords, confidential material or another person’s contact information.

Login and business emails

Supabase Auth is configured to send login and verification emails through Brevo. Business notifications use Brevo through a separate process and follow the existing consent and send conditions. Production and staging have independent Brevo accounts; login and business mail share the account within each environment. Introduction review shows the exact two recipients; no extra operator copy is added. Provider acceptance does not prove inbox delivery.

As checked on 10 September 2026, Brevo is configured to keep transactional logs for one month and not store previews of new emails. Per-contact tracking is configured to require recorded consent. Actual business test messages still contained Brevo opening pixels despite withholding per-contact tracking consent. Anonymous open/click statistics may still be processed; these settings do not guarantee pixel-free email. Provider log deletion remains under validation. Brevo has its own processing locations and retention policies.

Processing location and model use

The production database and Auth project are in Frankfurt (Supabase, eu-central-1). The website/model host and configured archive buckets are in Belgium (Google Cloud, europe-west1), as verified in provider configuration on 9 September 2026. A provisioned bucket is not proof of a successful backup. Email delivery and provider administration can involve other locations; this is not a promise that all processing stays in the EU.

The reviewed Ollama route has no automatic cloud-model fallback. Model accounting stores identifiers, purpose, version, token counts and timestamps, not prompts or raw replies. Node location is a setup record; running status needs recent verified contact and is unknown when contact cannot be confirmed. Independent owners control their own files and backups. Literature training and server experiments are not accepted public services.

Optional publication lookup

You can explicitly send a public DOI or ORCID iD to Europe PMC. Selected public passages may be processed by the configured model to suggest fields; the private card and lookup identifier are excluded from that extraction call. Review suggestions before saving. Private source receipts retain citations and excerpts but do not enter the sharing preview. A publication link does not verify identity or contribution. Unattached receipts older than a day are cleaned on your next lookup; card deletion removes its receipts.

Access, retention and recovery

Account permissions separate participants’ records. Privileged operators and infrastructure administrators can still access hosted data; this prototype is not end-to-end encrypted. The operations page excludes private chats and cards. Operational logs should contain status, timing and technical identifiers, never passwords, keys, sign-in tokens or user bodies. Separate processes do not protect against the administrator of the same computer.

Saved records remain until removed through their controls or account deletion. Deletion first revokes access; background cleanup must finish before completion is reported. Minimal deletion records prevent older backups from restoring deleted accounts or private matters. The hosted archive encrypts these records; the local development ledger relies on restricted file access. Platform backup rotation is configured for seven days after verified readback; failed or inactive tasks can delay rotation. Supabase and mail services have their own retention policies. Recovery must use current deletion records and retire old permissions and in-flight work before reopening.

Export, deletion and feedback

The account page exports owned profile, node, card, source, conversation, request, connection, private matter, discovery, helping preparation, contribution and usage records and offers account deletion. Expert-card export, pause and deletion are separate controls. A platform export cannot include private files on another device; export or delete those on that device too. Downloads and messages already received by someone cannot be recalled. Signed-in participants can use workbench support for feedback and help.