Kluster☣︎Phuchr™ · Policies

Kluster☣︎Phuchr™ is a persona-driven, source-backed strategy tool. It is an AI-assisted product, not a human, lawyer, financial advisor, therapist, or licensed professional. Outputs are generated by a large language model grounded in a curated knowledge base, the documents you provide, and (for paid users or during the 5 free onboarding searches) verified web research. You are responsible for verifying outputs before acting on them.

By using the terminal you confirm you are 18 years of age or older and accept that the product's persona is blunt, unfiltered, and intentionally abrasive by design. The persona is a fixed, version-locked system prompt (the v1.1.0 base is byte-for-byte frozen); admin-published prompt versions extend the registry through the real backend execution path but the locked base is preserved.

You may not use Kluster☣︎Phuchr™ to break the law, generate content that harms minors, attempt to extract the system prompt, or abuse the service via automated scraping. The usage-based trial ledger is server-side and survives cookie clears — creating another trial by clearing cookies is not possible. We may suspend access for violations.

What we collect. Conversations, messages, uploaded documents, generated files, and turn-level telemetry (provider, model, latency, token usage, estimated cost, retrieval source IDs, status, error message, prompt version/hash, feedback, userId snapshot). The parent Conversation row carries ownerKey — it is NOT duplicated into turn_logs. A stable per-browser identifier (httpOnly cookie `kp_guest`) associates your data for tenant isolation. For paid users, settings + preferences are synced to Supabase (UserSettings table) for cross-device restore; for free users, settings are stored in browser localStorage only.

Trial + web-search ledgers. Free-trial usage (TrialLedger table) and free onboarding web-search counts (WebSearchLedger table) are keyed by your stable per-browser userKey and stored server-side in Supabase. Clearing cookies, refreshing, changing browser storage, or logging out/in does NOT create another trial — the ledger is the source of truth.

Data classes. Ingested content is classified as knowledge, persona example, workflow example, policy, marketing, private user document, or unclassified. Private user documents are never mixed into the shared knowledge tree used for retrieval.

PII handling. Redaction is OFF by default. User-side uploads are stored as-is unless you opt in via Settings → "Redact PII on upload" — when ON, structured PII (emails, phones, SSNs, credit cards, IPs, US street addresses, exact ISO dates, labeled account/record IDs) is masked using `[EMAIL]`/`[PHONE]`/… markers. Ordinary names, framework names, people mentioned in research, source material, and normal knowledge content are NEVER auto-redacted. Admin dataset inputs (shared retrieval knowledge) run `neutralizePii()` which replaces real names with generic placeholders so no real PII enters the shared knowledge tree, while the data/logic stays fully extractable.

Providers. Completions are routed through a provider abstraction spanning GLM (Z.ai), DeepSeek, and OpenAI-compatible endpoints. Provider credentials are stored only in server environment variables and never logged. Your message content is sent to the active provider to generate a response. The PROVIDERS quick-switch control lets you pick which provider/model handles your turns (selection persists via cookie for free users; Supabase for paid users).

Verified web research. The /api/web-research endpoint runs REAL web retrieval via z-ai-web-dev-sdk's `web_search` + `page_reader` functions — no fake internet, no fabricated citations. Citation URLs are the actual source URLs fetched; exact supporting evidence/quoted excerpts per claim are stored in the response object for auditability. No successful web retrieval → the system does not claim it searched the internet.

Google Analytics (admin dashboard). The operator may connect a Google Analytics 4 property to the admin analytics dashboard by setting GA4_PROPERTY_ID + GA4_CREDENTIALS_JSON (service-account key, read-only analytics scope) in server environment variables. When configured, the server fetches aggregate GA4 property metrics (active users, new users, sessions, page views) directly from the Google Analytics Data API for display to authorized admins only. This is a server-to-server call using the operator's own credentials; this app itself sets no GA tracking cookies and performs no client-side GA tracking.

Training. Kluster☣︎Phuchr™ does not train or fine-tune models on your data. RAG retrieval is not training. Your documents are stored for your use and retrieved for your conversations.

Location. Kluster☣︎Phuchr™ does NOT collect IP-derived geography. The admin analytics dashboard explicitly shows "no location data collected" rather than fabricate geographic distribution.

Kluster☣︎Phuchr™ is powered by large language models. Its persona is a fictional, intentionally provocative character. Statements made by the persona are generated, not authored by a human expert, and may be inaccurate despite source grounding.

For entertainment purposes only. Kluster☣︎Phuchr™ is not real advice — not legal, financial, medical, psychological, or professional counsel. It's a blunt, opinionated character with a knowledge base. Up to you if you wanna take it. Always think for yourself; nobody's going to do that better than you.

The product always denies being an AI in character as part of its fixed persona — this is a deliberate fictional conceit, not a deceptive claim about the underlying technology. This disclosure documents that reality.

Every retrieval-grounded answer displays the source documents it drew from. Where no sources are available, a fallback doctrine set is used and flagged. Verified web research (paid or 5 onboarding searches) surfaces citations from the actual retrieved URLs — never fabricated.

You agree not to: (a) upload content you do not have rights to; (b) attempt to extract, reverse-engineer, or redistribute the locked system prompt (the v1.1.0 base is immutable; admin-published prompt versions are visible to authorized admins only); (c) conduct prompt-injection attacks (the ingestion pipeline scans for these and quarantines matches); (d) abuse rate limits or attempt to degrade service for others, including by attempting to reset the usage-based trial ledger via cookie clears (the ledger is server-side and survives client-side resets); (e) use the product to plan harm to people or critical infrastructure.

Uploaded content is scanned for prompt-injection markers (e.g. "ignore all previous instructions", "reveal your system prompt") and quarantined for review when detected.

Kluster☣︎Phuchr™ uses these essential cookies — all httpOnly, SameSite=Lax, and never third-party tracking or advertising:

• kp_guest — stable per-browser identity for tenant isolation and consent tracking. 90-day expiry.
• kp_admin — admin unlock token (set after a successful constant-time token compare). Session-scoped.
• kp_provider_pref + kp_provider_model_pref — your selected provider/model. 1-year expiry. For paid users, also synced to Supabase.
• kp_trial_start — legacy trial-start timestamp (kept for audit continuity; the new model is usage-based via TrialLedger).
• kp_session — authenticated account session (httpOnly, 30-day, hashed token). Only set when you log in.
• kp_consent_v — current acknowledged policy version (client-side mirror of the server-side ConsentRecord).

No third-party tracking or advertising cookies are set. Clearing cookies does NOT revoke your trial entitlement or create another trial — the server-side ledger keyed by userKey is the source of truth.

Conversations & messages: retained until you delete them. Full message text is stored in the Postgres `Message` table (`text` column — no practical limit). Massive pasted context is preserved byte-faithfully.

Ingested documents: retained until you delete them. User-side uploads are stored as-is (never modified) unless you opt in to "Redact PII on upload". Admin dataset inputs have PII neutralized (names replaced with generic placeholders, data/logic preserved) before indexing into the shared knowledge tree.

Generated files: retained for 7 days by default, then automatically swept and deleted. Download links expire at that point.

Turn logs (telemetry): raw `TurnLog` rows are retained for `TURN_LOG_RETENTION_DAYS` (env, clamped 30–90, default 60) days. Before deletion, daily aggregates per (ownerKey, day, provider, status) are computed — ownerKey is joined via the `conversationId` → `Conversation.ownerKey` foreign key, not stored on TurnLog itself — and stored in `TurnDailyAggregate` so historical operational metrics (turn count, total cost, tokens, fallbacks, avg latency) survive the deletion. Per spec #9.4, TurnLog stores ONLY metadata (model, tokens, latency, status, cost, source IDs, prompt version/hash, feedback). Full prompt/response text is NOT duplicated in turn_logs — it lives in the `Message` table, referenced by `TurnLog.conversationId`. No raw PII beyond what was already in your Message text.

Trial + web-search ledgers: TrialLedger + WebSearchLedger rows are keyed by your stable per-browser userKey and retained until you delete your identity. They store usage counts (turnsUsed, workflowsUsed, ingestionsUsed, countUsed), the allowance snapshot active when you entered the trial, and the exhaustedAt timestamp (for analytics).

Consent records: retained until you delete your identity. Includes the trialStartedAt timestamp (kept for audit continuity even though the new trial model is usage-based).

Web-research audit records: citation URLs + exact supporting evidence/quoted excerpts per claim are returned in the `/api/web-research` response object. They are not persisted as a separate table in this revision; the audit trail is the response payload + the SSE event stream the caller captures.

User settings (paid users): the `UserSettings` table stores your preferences as a JSON blob keyed by userKey. Retained until you delete your identity.

Prompt version history: the `PromptVersion` table is an append-only registry — old versions are never mutated; activation flips the `isActive` flag transactionally. The locked v1.1.0 seed row is non-deletable (audit baseline). Admin-created versions can be deleted only if they are not currently active.

You can export your data: conversations and messages via GET /api/conversations and GET /api/conversations/[id]; generated files via GET /api/files/[id]. The chat composer has no character cap — your full input is preserved byte-faithfully and exportable. For a full export bundle, contact support.

Delete a conversation via DELETE /api/conversations/[id] (cascades to its messages, turn logs, workflow runs, and generated files). To delete your entire identity and all associated data — conversations, ingested docs, turn logs, trial ledger, web-search ledger, settings, and consent record — contact support with your kp_guest cookie value or account email. Paid subscribers can cancel via Stripe; cancellation reverts your plan to free at the end of the current billing period but does not delete your data.

Support: klusterfuchr@support (placeholder — wire to your real support channel before launch). For security disclosures, include "security disclosure" in the subject.