Privacy and local data

The application is designed to work without an account or upload, and without any runtime API for the work you do in it. This site counts page visits through Cloudflare: it sets no cookie, it cannot follow you from here to another site, and nothing from your work is part of the count. Billing is the single exception: opening the Premium page, buying a subscription or restoring one contacts RevenueCat and Stripe, and the studio itself makes one entitlement check. No script text, cue, take note, filename, header observation or export is part of that exchange.

What stays local

Script text, cue records, take notes, filenames, pickup rounds, header metadata, and delivery freezes are stored in the current browser profile through IndexedDB. Audio bytes and paths are not stored.

Network posture

The packaged application requires no ads, remote fonts or remote AI, and no project-data API for your work. Its content security policy blocks every connection except the billing hosts, which only the Premium page, the Restore page and one entitlement check may reach, and Cloudflare's cookie-free page-view count. A hosting provider may still log ordinary web requests for static files.

Backups and deletion

Browser storage can be cleared by the browser, operating system, or user. Download checkpoints regularly. Archiving is recoverable; explicitly removing an unreadable record is not.

Worked example

Load the Orchard Signal evaluation with the browser network panel open and work all nine stations, including the audio preflight over a folder of local files, and the panel records nothing after the initial page and module loads, apart from Cloudflare's cookie-free page-view count and at most one entitlement check every twelve hours if you hold a subscription. There is no remote font, no error beacon and no upload, because the packaged content policy blocks every connection except the billing hosts and Cloudflare's cookie-free page-view count, and the runtime contains no code that would send your work anywhere.

The preflight is the case worth understanding. You choose local files, the browser reads a bounded slice from the front of each one, and the observation is kept only if you asked for scan results to be retained. The audio bytes are never stored and neither is the file path.

Method

Script text, cue records, take notes, filenames, pickup rounds, header observations and delivery freezes live in IndexedDB in the current browser profile, with a session-only fallback when that storage cannot open. There is no account, no sign-in and no server-side copy of your work. A Premium subscription is recorded against an anonymous purchase identifier held in this browser, not against a profile.

A static host can still log ordinary web requests for the files that make up the application, in the same way it logs any request for any static page. That is outside the application, and it never carries your project data.

What this does not do

• Browser storage can be cleared by the browser, the operating system or the user without warning.
• The application cannot protect a shared device, an unencrypted disk or a device backup service.
• Archiving a record is recoverable; explicitly removing an unreadable record is not.

Do this in the app

Treat checkpoints as the durable copy and browser storage as the working copy.

1. Open station 09 Projects and download a checkpoint before a long session.
2. Keep script and audio source files under your own control, separately.
3. Remove projects you no longer need rather than leaving them in the profile.

Open the local workspace at station 09 Projects

Related reading

• Security posture
• Formats, browsers and limits
• Product limitations

Try the free workflow