Privacy & Security¶

Your data privacy and security are fundamental to ChronoScope's design. This page explains how your information is handled.

Core Privacy Principles¶

🏠 Local-First Architecture¶

All processing happens on your machine:

• ✅ Documents are processed locally
• ✅ Timeline data stored on your computer
• ✅ No cloud storage of your documents
• ✅ You control your data completely

The only external communication:

• OpenAI API calls for event extraction (your choice)
• Optional: Analytics (can be disabled)

What Data Leaves Your Computer?¶

OpenAI API Calls¶

What is sent:

Document text content → OpenAI API

What is NOT sent:

• ❌ File names or metadata
• ❌ Your identity or account info
• ❌ Timeline data or notes
• ❌ Usage patterns

How it's processed:

1. Document text extracted locally
2. Text sent via HTTPS to OpenAI
3. Events returned to your machine
4. Original text discarded by OpenAI (per their policy)

OpenAI's Data Usage Policy:

• API data not used for model training (as of 2023)
• Data retained for 30 days for abuse monitoring
• No human review unless flagged for safety

Read OpenAI's Data Policy →

Data Storage¶

Where Your Data Lives¶

chronoscope/
├── .streamlit/
│   └── secrets.toml          # ⚠️ API key (keep private!)
├── data/
│   ├── timeline_events.json  # 💾 Your timeline data
│   └── user_notes.json       # 📝 Your personal notes
└── test-documents/           # 📄 Your uploaded docs

File Permissions¶

Recommended security:

# Protect your API key
chmod 600 .streamlit/secrets.toml

# Protect timeline data
chmod 600 data/timeline_events.json
chmod 600 data/user_notes.json

Data Persistence¶

• Timeline events: Stored in JSON (plain text)
• User notes: Stored in JSON (plain text)
• Uploaded files: Remain in upload directory
• No encryption at rest (use OS-level encryption if needed)

API Key Security¶

Protecting Your OpenAI Key¶

Your API key is sensitive:

• 💳 Linked to your billing account
• 🔑 Grants access to OpenAI services
• 💰 Usage charges to your account

Security best practices:

# ✅ DO:
1. Store in .streamlit/secrets.toml (gitignored by default)
2. Never commit to version control
3. Use environment variables for shared setups
4. Rotate keys periodically
5. Monitor usage at platform.openai.com

# ❌ DON'T:
1. Hard-code in application files
2. Share in screenshots or demos
3. Store in cloud sync folders (Dropbox, Google Drive)
4. Use the same key across many projects
5. Give API key to others

Key Rotation¶

How to rotate your API key:

1. Generate new key at platform.openai.com
2. Update .streamlit/secrets.toml:

   OPENAI_API_KEY = "sk-new-key-here"
   

3. Restart ChronoScope
4. Delete old key from OpenAI dashboard

Version Control Safety¶

Git Ignore Patterns¶

ChronoScope includes .gitignore to protect sensitive files:

# API Keys and Secrets
.streamlit/secrets.toml
.env
*.key

# Personal Data
data/timeline_events.json
data/user_notes.json
test-documents/personal/

# Virtual Environment
.venv/
venv/

Verify your setup:

# Check what would be committed
git status

# Should NOT see:
# - .streamlit/secrets.toml
# - data/timeline_events.json
# - test-documents/personal/

Network Security¶

HTTPS Encryption¶

All external communication is encrypted:

• OpenAI API: TLS 1.2+ (HTTPS)
• Documentation site: HTTPS only
• No unencrypted data transmission

Firewall Considerations¶

Required outbound connections:

api.openai.com:443       # AI extraction
platform.openai.com:443  # Dashboard (optional)

No inbound connections required

Compliance & Regulations¶

GDPR Compliance (EU Users)¶

Your rights:

• ✅ Right to access: All data stored locally, you have full access
• ✅ Right to erasure: Delete data files anytime
• ✅ Right to portability: JSON format, easily exportable
• ✅ Right to rectification: Edit events directly

Data controller: You (the user) control your data

Data processor: OpenAI (for API calls) - see their DPA

CCPA Compliance (California Users)¶

California privacy rights:

• Know what personal information is collected
• Delete personal information
• Opt-out of sale (N/A - we don't sell data)

ChronoScope's stance:

• We don't collect personal information centrally
• All data remains on your device
• No data sale or sharing

HIPAA (Healthcare Data)¶

⚠️ ChronoScope is NOT HIPAA compliant

Do NOT use for:

• Protected Health Information (PHI)
• Medical records or histories
• Patient data processing

Best Practices¶

For Individual Users¶

# ✅ Recommended Setup

# 1. Use OS-level encryption
# macOS: FileVault
# Windows: BitLocker
# Linux: LUKS/dm-crypt

# 2. Secure your environment
chmod 700 /path/to/chronoscope
chmod 600 .streamlit/secrets.toml

# 3. Regular backups (encrypted)
tar -czf timeline_backup.tar.gz data/
gpg -c timeline_backup.tar.gz

# 4. Monitor API usage
# Check platform.openai.com/usage regularly

For Teams/Organizations¶

Shared deployment considerations:

1. Separate API keys per user

   # User-specific config
   cp .streamlit/secrets.toml.example .streamlit/secrets.toml
   # Each user adds their own key
   

2. Data isolation

   # User-specific data directories
   data/user1/timeline_events.json
   data/user2/timeline_events.json
   

3. Access control

   # Restrict application directory
   chown -R chronoscope:chronoscope /opt/chronoscope
   chmod 750 /opt/chronoscope
   

Data Retention¶

Automatic Cleanup¶

ChronoScope does NOT auto-delete:

• Timeline events persist indefinitely
• Notes saved until manually deleted
• Uploaded documents remain in folder

Manual cleanup:

# Clear all timeline data
rm data/timeline_events.json

# Clear user notes
rm data/user_notes.json

# Remove uploaded documents
rm -rf test-documents/personal/*

Backup Recommendations¶

Regular backups:

# Weekly backup script
#!/bin/bash
BACKUP_DIR=~/chronoscope-backups
DATE=$(date +%Y%m%d)

mkdir -p $BACKUP_DIR
cp data/timeline_events.json $BACKUP_DIR/timeline_$DATE.json
cp data/user_notes.json $BACKUP_DIR/notes_$DATE.json

# Encrypt backup
tar -czf $BACKUP_DIR/backup_$DATE.tar.gz $BACKUP_DIR/*_$DATE.json
gpg -c $BACKUP_DIR/backup_$DATE.tar.gz
rm $BACKUP_DIR/*.json $BACKUP_DIR/*.tar.gz

Security Incident Response¶

If Your API Key is Compromised¶

Immediate actions:

1. Revoke key at OpenAI:
2. Go to platform.openai.com/api-keys
3. Find compromised key

4. Click "Revoke"

5. Generate new key

6. Update ChronoScope:

   # Update secrets.toml with new key
   echo 'OPENAI_API_KEY = "sk-new-key"' > .streamlit/secrets.toml
   

7. Monitor usage:

8. Check OpenAI usage dashboard
9. Review unexpected charges
10. Contact OpenAI support if needed

Reporting Security Issues¶

Found a security vulnerability?

1. Do NOT open a public GitHub issue
2. Email: security@chronoscope.dev (or project contact)
3. Include:
4. Description of vulnerability
5. Steps to reproduce
6. Potential impact
7. Suggested fix (if any)

We commit to:

• Acknowledge within 48 hours
• Provide timeline for fix
• Credit researcher (if desired)
• Responsible disclosure

Privacy FAQs¶

# Delete all ChronoScope data
rm -rf data/
rm .streamlit/secrets.toml
rm -rf test-documents/

Additional Resources¶

• 📜 OpenAI Privacy Policy
• 📜 OpenAI API Data Usage
• 🔒 OWASP Security Guidelines
• 🛡️ Python Security Best Practices

Questions or concerns about privacy?

• 📧 Contact Us
• 💬 Community Discussions
• 🐛 Report Security Issues