Privacy for the public demo

Effective September 3, 2026

Ribband does not create user accounts, set cookies, request payment information, or store origin selections, searches, taste and intent, recommendations, activity itineraries, vacation packages, purchase reviews, approved selections, or generated briefs in an application database. The primary Challenge workspace remains stateless. The personalized gift planner lets a visitor explicitly save one gift-recipient profile in IndexedDB on that visitor's device. Use once is the default. The date planner is use-once only and does not save either participant's context on the device or in a Worker database. The vacation planner is also use-once only and does not save its selected memories, past trips, or preferences on the device or in a Worker database. The unified decision agent at `/decide` is request-only and never reads or writes the optional on-device gift profile. It can separately store a self-profile outcome memory in its own IndexedDB database only after the visitor reviews and approves the exact text and allowed decision types.

Infrastructure data

Cloudflare hosts the application and may process standard request, URL, security, log, and trace metadata needed to deliver, monitor, and protect the service. Application records contain a random request correlation id, route path, response status, duration, adapter timing, response byte count, normalized failure category, stable error code, and retryability. They do not contain search terms, taste and intent fields, profile facts, memory signals, request bodies, upstream response bodies, tokens, or cookies. Personal context uses a no-store request and is never placed in the request URL. There are no third-party analytics identifiers. Do not enter confidential information into the public demo.

On-device profiles and approved memory

The gift workspace can store the recipient label, age band, interests, compact memory signal, avoid field, and local timestamps in the browser's IndexedDB only after the visitor selects Save on this device and submits the decision. The Worker receives only the facts shown in the decision context panel. The saved profile can be deleted from the same page. The date workspace sends only the two-person context shown in its context panel for the current request and does not write that context to IndexedDB. The vacation workspace follows the same request-only boundary and never reads or saves the on-device gift profile. The unified decision workspace keeps only the current decision id in page memory so a visible revision can identify its predecessor. A refresh removes that page state. Every revision submits the complete visible context again and does not modify a stored record.

After a date or vacation result, the visitor may report a selected, completed, or negative outcome and provide a reason. `POST /api/profile-updates/propose` returns a tentative add proposal with no persistence. The proposal shows its exact text, fact type, self-profile subject, allowed uses, and approval state. Nothing is saved until the visitor clicks Approve and save on this device. The visitor may edit the text before approval, correct a saved fact later, or delete it through a separate confirmation step. Saved outcome memories are never selected automatically. The visitor must check each fact before it enters a later decision request. Gift-recipient outcomes remain decision-only in this unified self-profile loop.

Clearing browser site data removes both local databases. This local browser storage is not an account, is not synchronized between devices, and is not end-to-end encryption. Ribband does not send approval, correction, or deletion operations to the Worker.

Offer data

The Worker reads only exact HTTPS hostnames and product or service paths declared in its validated origin manifests. Runtime access stops at each origin's authorization review date, before another upstream request is made. The default origin is agentic-webmcp-origin.somnora.workers.dev, a first-party controlled public marketplace with original guitar listings and no external images. A separate `/services/*` scope on that controlled hostname contains twenty original fixtures: 5 activities, 1 wellness, 1 home service, 3 lodging, 2 dining, 2 transportation, and 6 professional services. Its JSON and HTML responses are fetched live and clearly labeled as controlled demonstration data. The secondary Shopify development store can use a read-only Storefront token, public products JSON, or a clearly labeled research-only bundled snapshot. Fallback and stale Offers cannot create a purchase review. Search terms do not include a Ribband visitor identity.

Agent tools

The primary workspace registers ten WebMCP tools that read origins, Offers, ranked recommendations, stripped page content, and planning-only activity itineraries. A recommendation may ask one refinement question when eligible options have competing evidence. The gift workspace registers one additional read-only recommend_gift tool on its own page. That tool uses only context supplied in its call and never reads or saves the on-device profile. The date workspace separately registers one read-only plan_personalized_date tool. It uses only the supplied two-person context, filters hard dislikes before scoring, and does not save a profile, reserve a service, confirm live availability, measure travel time, contact a provider, book, or pay. The vacation workspace registers one read-only plan_personalized_vacation tool. It uses only the supplied request context, filters hard dislikes before scoring, and returns planning-only packages with published prices, a separate contingency, and explicit unknown costs. The unified decision workspace registers one read-only plan_decision tool. Its required vertical selects a fixed shopping, gift, date, vacation, or staffing strategy and authorized evidence origin. General shopping is self-directed; gifts may include recipient, occasion, and deadline context. It returns the selected strategy, exact context projection, evidence state, and linked revision id in one no-store envelope. The WebMCP tool cannot approve or save memory. Outcome proposal, approval, correction, and deletion remain visible human page controls. Staffing plans verified provider crews using controlled provider Offers with typed credentials, quote accounting, and planning travel radii. Opening a provider source requires explicit, visible two-step human review with destination and transmitted-information disclosures. None of these tools can save a profile, reserve lodging or transport, contact a provider, request a quote, book, contract, or pay. create_activity_itinerary uses the submitted date, party size, budget, pace, and day hours to propose a source-linked schedule. It does not reserve a service, confirm live availability, measure travel time, contact a provider, or pay. propose_add_to_cart stages a goods purchase review but does not create an order. Only the human approval button can create an in-page decision record after the Worker confirms the reviewed Quote still matches current facts. No tool exposes booking, provider messaging, checkout, payment, account, order, customer, billing, or merchant mutation capability.

Decision dossier

The Download dossier button creates a Markdown file in the browser from the visible research activity, taste and intent, refinement question and answer, source URLs, evidence state, selection, and human decision. The dossier is downloaded directly to the visitor's device. It is not uploaded to or stored by Ribband.

Contact and source

Questions may be sent to support@somnora.app. The complete public implementation is available on GitHub.