Privacy
Most of anphuni.com is static marketing. /session is a separate capped hosted alpha lab (up to five seats). Session stores a display name, salted passphrase hash, session cookie, and workspace files on the host, and sends relevant chat/tool context to OpenRouter for model inference. It is not Mechanicall core (the local CURRENT + preflight protocol) and not open multi-tenant SaaS.
What this site does
- Serves HTML, CSS, and related static files
- Optional walkthrough demo and live compare chats (no accounts; compare uses a short-lived server proxy to a free model — messages are not kept as a user database)
- Optional Protocol page — authority protocol literacy
- Optional Session lab — capped hosted alpha (≤5 seats, server workspaces)
- May receive normal web-server / CDN access logs (IP, user-agent, path) from the host and Cloudflare — not an application user profile
Session (private seats · max 5)
- Hard cap of 5 seats on this host. Each seat is a separate workspace directory — files are not shared between seats.
- You claim a seat with a display name + passphrase (salted hash on server). HttpOnly cookie for session. Not open unlimited signup.
- Coding agent (Grok Build–style tools: read/list/grep/edit/allowlisted bash) runs only inside your seat folder.
- Chat text is sent to OpenRouter (default
openrouter/pareto-code) via a server proxy. The API key never ships to the browser. - Seat files live under the host data directory configured for Session (durable only if the host mounts a disk). No cross-seat reads.
- The model must not self-approve Domain decisions; CURRENT.md remains human-owned plan text.
- Sign out clears the session cookie. Operator can wipe seat data by deleting the data directory.
What this site does not do
- No unlimited multi-tenant SaaS / club-scale hosting
- No open registration beyond the 5-seat cap
- No contact form that writes your message to our app disk (email only if you choose to write)
- No silent whole-disk access — agent tools are jailed per seat workspace
- The old parked pipeline API is not the Session product
Project tools
Session and any local Mechanicall tools keep authority in files you own. They are not multi-tenant accounts on this domain.
History note
An earlier experimental pipeline API on this domain could store operator accounts on a private disk. That service is parked and must not be redeployed as the public apex without a separate privacy review. Production disk data from that experiment should be wiped by the operator at cutover.