PRIVACY.md

Data handling - v5.0.3

This document describes the implementation, not a blanket legal-compliance claim.

Hosted demo

Uploaded files are processed on the Space. Browser sessions have separate temporary corpora. Internal originals are removed after extraction and internal audio after transcription; temporary extracted text/vectors expire with the session. Gradio upload caches expire separately. The platform/operator can access runtime data. Do not upload confidential or restricted material to a public demo. Download links contain program source only.

Local Docker edition

Documents and audio are uploaded from the browser to the container on the user's machine. Embedding and speech inference remain there. Saved extracted course text, embeddings, answers, rubrics and results live in a persistent data volume, separated by local account. Original course files are not saved in the course library; raw recordings are not saved in learning history. Delete saved courses separately from clearing temporary sessions.

In local CPU mode, no course text/answer is sent to a remote inference service. Model files are downloaded from their public repositories on first use. Offline-model mode uses only cached weights; it requires all needed models to have been downloaded beforehand. In remote mode, selected text excerpts, questions, rubrics and answer text are sent to the configured HF Space. Optional supporting explanations send their selected supporting excerpts too. The HF operator/platform can process that payload.

HF tokens are stored encrypted using a key in a separate local volume. The machine administrator can read the key and decrypt tokens. Passwords are salted/hashed. Extracted documents and history are not encrypted at rest. Tokens are passed only for HF client authentication, not as model input or in the download. Developer deployment tokens are neither shipped nor installed as server secrets.

No document/model-training pipeline, automatic cloud synchronization, advertising tracker or learning-data analytics upload is included. This does not assert how a third-party hosting platform processes infrastructure logs.

The default Compose binding is loopback-only. Gradio password auth is a local access layer, not a replacement for reviewed internet-facing identity/security infrastructure. Use HTTPS and additional deployment controls before exposing it beyond localhost. Browser microphone access normally requires HTTPS or localhost.

Backup and retention are the local administrator's responsibility. Keep data and encryption-key volumes together in backups. Deleting a course removes its DB records and snapshots but cannot promise forensic erasure of disk blocks, backups or already sent remote data.