Privacy.

The hosted edition stores your account under your own name: your Book, Compass, and Playbook (the documents you write during the intake), the roles you evaluate and their scores, applications, companies, people, calibrations, and a ledger of AI usage. It all lives in a Postgres database hosted by Neon, in the United States. Nothing is sold, shared, or used for advertising.

When you score a posting or generate materials, the posting text and your source documents are sent to Anthropic’s API to produce the result. That is the entire loop. Under Anthropic’s commercial API terms, that data is not used to train their models.

Sign-in links and access-request notifications are sent through Resend. Your address is used to sign you in and to answer your request for access, and for nothing else. There is no mailing list.

The app sets the cookies sign-in requires and nothing more. The public pages (the landing, the tour, and the sign-in surfaces) use Plausible, a cookie-less analytics service that counts visits without identifying visitors. There is no tracking once you are signed in.

If you add your own Anthropic key in Settings, it is encrypted at rest with AES-256-GCM, used only for your account’s calls, never included in exports, and removable at any time.

Settings has two buttons that matter here. Export downloads everything you own as one JSON file, any time. Delete removes your account immediately and completely: every document, role, score, and record, including your original access request. There is no grace period, no retention window, and no way for me to undo it. Coming back later means requesting access again.

If you run Possible Futures on your own machine, everything stays there in a SQLite file you own. The only data that leaves is the AI calls you make with your own key or your own local model, which may leave nothing at all.

This page describes the whole system, but if anything is unclear, write to hello@possible-futures.life and a person answers.