Where is project information stored?

Stored project content

The working project lives in this browser's storage on this device: the dataset context, the field folios, the value sets, recorded reader reviews, frozen editions and the event history. Imported source rows are not among them; they exist only in memory while parsing and profiling run, and are released when profiling finishes. Nothing from your work is sent anywhere: the shipped content policy lets the studio reach only this site, the billing entitlement check and Cloudflare's cookie-free page-view count.

Integrity and authentication are different

Checkpoints and packet manifests carry SHA-256 digests, and an import is refused outright when a digest does not match the bytes. That detects accidental corruption and deliberate edits, and it is all it detects. A digest is not a signature: it says nothing about who wrote the file, when, or whether anybody approved its contents.

Device and host boundaries

Browser extensions, operating-system backups, sync folders, shared logins and whoever else can unlock the machine all sit outside the product's boundary, and so does anything your browser does with a file after you download it. When the studio is served over the web, the host serving it sees ordinary requests for the page and its assets. Treat the device as part of the threat model, because the product cannot.

Worked example from the sample project

Try the boundary rather than reading about it. Open the browser network panel and work the whole studio on the sample: import a file, author folios, run the review, freeze an edition, export the packet. The panel stays empty apart from the initial page and module loads, because the shipped content policy sets the connect-src directive to none and there is no code that would use a connection if one were permitted.

Then import a checkpoint whose bytes you edited in a text editor. The digest check refuses it, and the project you already had is untouched. That is the same rule the delimited parser applies: an input that cannot be fully validated is refused as a unit, and nothing lands halfway.

What this does not do

• This is not a security audit, an encrypted vault or a secure-deletion system.
• A digest detects modification. It is not a signature and proves nothing about who wrote a file.
• Nothing here protects a shared device, a browser extension, an operating-system backup or a synced download folder.

Do this in the studio

Read what you are about to hand over before you hand it over.

1. Open the Handoff packet station and export the set.
2. Open the CSV and the reader page and confirm what is visible in them.
3. Keep the manifest and checksum list with the files.

Open the studio at the Handoff packet station

Related reading

• Local data privacy boundary
• Why source rows are discarded
• Checkpoints and continuity