Sandbox privacy notice

What is stored

Your account, profile facts, uploaded documents, family permissions, applications, consent receipts and activity records are stored by the application. Mock provider connections return seeded records. Sensitive fact values are encrypted; the local database and file storage still require production hardening.

Sharing with an institution

• You see the requested fields, purpose and retention period before approval. Optional fields can be excluded.
• A fresh OTP or passkey confirmation creates a consent receipt and a signed payload containing the approved fields and document fingerprints.
• Connections lets you inspect and revoke consent. Revocation blocks further ApplyOnce access and sends a signed webhook to the partner. It cannot remotely erase copies already held by an external institution.

Family access

Minor profiles can be managed by their guardian. Adults approve a scoped invite using their own phone login. Delegated access expires or can be removed. Age and guardian identity checks in this demo are not a substitute for production identity verification.

Optional AI explanations

The readiness score is computed locally. Without an AI key, the guide also runs locally. When configured, OpenAI receives field labels and derived next-step guidance, without profile values, names, documents or user identifiers. Requests use store: false; account and provider policies still govern service-side processing.

Your controls

• Edit facts in your Profile; re-verify source-asserted values instead of silently replacing them.
• Export compressed JSON and schedule or cancel account deletion in Settings. Document files are downloaded separately.
• Account deletion has a 30-day grace period. Cancel explicitly before processing. Recent active applications can place the request on hold.
• Use the data-request form for a request that needs operator review. It appears in the admin request queue.

Retention and deployment

Consent expiry prevents new payload access. Automated deletion of every historical payload, backup retention, object-store cleanup and jurisdiction-specific legal policies require a production lifecycle plan. The repository documents these remaining launch requirements.