Privacy and data handling

A technical description of the current development surface.

This page explains the implementation’s current data boundaries. Faceful is a development project; this is not a claim of certification or a substitute for terms agreed before real customer data is used.

Public documentation and discovery

The public pages, OpenAPI specification and discovery API contain product information and setup guidance. They do not require a token and do not return private workspace objects. HTTP requests necessarily reach the hosting provider, which may process request metadata under its own service configuration. This project has not published a verified retention period for hosting logs.

Studio and local examples

The private studio is designed to use authenticated access through the configured Supabase project. The separately labelled development fixture can keep example edits in browser storage so they survive refresh. Those examples are not a durable production database, generated video or publishing receipt. Use fictional or approved material when exploring development surfaces, especially on a shared device.

Credentials and external providers

Public discovery and the repository CLI do not request credentials. Local plan validation reads a file on your machine and sends no plan content to a server. Real rendering and publishing will require authorized provider integrations; their processing, delivery access, retention and deletion behavior must be confirmed before production use. Do not paste service-role keys, downstream publisher tokens or browser session cookies into an agent setup command.

Access and authorization

The release contract requires tenant-scoped object access, private uploads, separate human and agent credentials and server-verified publication authority. Those requirements need integration and denial-test evidence; a public audit score does not prove their enforcement. The current status response identifies unavailable engine capabilities.

Questions and correction

Use the contact guidance to raise a data-handling question without exposing the data itself. No universal retention guarantee, automatic provider deletion or completed data-rights workflow is claimed while these services remain under development.