Where your data goes
Understand the data path before deciding what to record and share.
Chat and identity
Your Agent client and model service process your conversation and tool results. Choose what to provide using that service’s settings. Sign-in uses an identity provider; this service receives an identity identifier, name and email. Sign-in does not send asset balances.
Records held by this service
Cloudflare services hold household records, membership permissions, asset snapshots, report versions and operational audits. This service computes amounts. An authorized Agent can read records you are permitted to access. Private accounts in the book are visible to their owner; household reports exclude them by default. If you explicitly generate a report including private accounts in chat and share it, recipients can see that content.
Sharing and exports
Anyone with a share link can view that report version without signing in. Set a 1–90 day lifetime or revoke it early. Revocation blocks later access; it cannot retrieve screenshots or files already saved by a recipient. You control exported files, which contain records you are permitted to export.
Retention, deletion and recovery
Household records are retained; 24/600 months are report viewing windows, not automatic deletion deadlines. A deleted household can be restored within 30 days; scheduled cleanup then removes it from the active service. Backups and exported copies have separate retention boundaries. Restoring a book does not reuse old sign-in and connection credentials; sign in and reconnect.
Page resources
Reports currently load third-party fonts, chart and animation resources over the network. Providers may receive network and browser information. Third-party scripts run in the page and are part of its trust boundary. Responses do not send referrer URLs. Charts are not the source of asset records.
中文 · Back to home