Privacy & Data Security Policy

1. Architecture & Local Data Storage

PreviewList is engineered with privacy as a foundational technical requirement rather than an afterthought. Unlike traditional web bookmarking utilities that synchronize every keystroke to centralized databases, our client architecture processes and retains state locally.

• Local-First Persistence: All board layouts, folder structures, item rankings, and preferences are committed to your device's localStorage database under the key focused_kepler_data.
• Zero Central Account Requirement: You can construct, categorize, and maintain rich link boards without providing an email address, phone number, or identity credentials.
• Voluntary Account System: If you choose to log in to maintain personalized profiles (`Hi Username`), authentication tokens are managed securely through browser session storage without exposing personal identifiable information (PII).

2. Link Previews & Metadata Fetching

When you insert a URL into PreviewList, the application retrieves Open Graph (OG) metadata - such as page titles, description snippets, and representative preview images - to construct your visual cards.

Technical Flow of Metadata Requests

Because web browsers enforce Cross-Origin Resource Sharing (CORS) security restrictions, direct client-to-server requests for HTML metadata are often restricted by destination websites. To resolve this cleanly while protecting your privacy:

• Stateless Edge Processing: Metadata requests may pass through our stateless Cloudflare Workers / Edge middleware or secure fallback preview proxies (e.g., Microlink API).
• No Query Profiling: Our edge workers process the destination URL solely to extract <meta> tags and return clean JSON to your browser. We maintain no persistent access logs associating specific IP addresses with queried target URLs.

3. Shared Lists & Read-Only URLs

PreviewList empowers you to publish any folder or board as a shareable Read-Only link. Understanding how data moves during sharing is critical for total transparency:

• On-Demand Cloud Snapshot: When you click "Share list (Copy Read-Only URL)", an exact JSON snapshot of your current board structure is serialized and transmitted securely to our cloud object storage (powered by JSONBin / Cloudflare KV).
• Cryptographic Identifiers: Each shared list receives a unique alphanumeric identifier (`binId`). Anyone possessing this exact link can view the read-only rendering of those links.
• Revocation & Expiry: If you wish to purge a shared snapshot, you can clear your local board or generate a new independent snapshot at any time without altering previously archived personal files on your device.

4. Backups, Exports & Portability

True data sovereignty requires zero lock-in. PreviewList provides complete bidirectional control over your data assets:

Using the Export recovery backup (JSON) button in the settings drawer immediately compiles your complete database structure into a standard, unencrypted JSON file downloaded to your local file system. Conversely, the Import backup (JSON) mechanism parses structured JSON files locally within your browser sandbox, instantly rebuilding your board without server-side validation checks.

5. Security & Reading/Lock Mode

To protect against accidental modifications or unauthorized visual tampering when sharing your screen in professional environments, PreviewList includes a hardware-accelerated Lock Board (Reading Mode) feature.

Engaging Lock Mode immediately suppresses all modification interfaces (addition modals, drag-and-drop handles, edit drawers, and deletion actions) directly within the DOM layout. In sensitive configurations, View Mode 4 (Masked/Password Mode) conceals link titles and preview thumbnails until explicit user hover or interaction.

6. Contact & Policy Modifications

As our universal preview engine evolves with additional advanced capabilities (such as end-to-end encrypted peer sharing or offline service workers), this document will be updated with precise architectural changelogs.

If you have technical inquiries, security disclosures, or questions regarding client-side data handling, please reach out via our community repository or direct developer channels.