Privacy-first by design.

Privacy boundaries

Local Workspace, Watch, and Reminder Center

Saved readiness plans, Standards Watch review status, and the returning-session flag are stored in browser storage in the current version. Reminder Center reads open actions from the same local Workspace. These records are not uploaded by the application unless a future synchronized service is explicitly introduced and disclosed. Clearing site data or switching browsers or devices can remove access to them.

AI workflow builder: the twelve ready-made workflows

Text you type into the ready-made workflows, your saved prompt shelf, your recent AI workflows with their step progress, and a short history of which workflows you copied (used for the daily pick and the last-7-days view) are stored only in browser storage. The ready-made workflows never send text to a server or to any AI service; you copy a prompt and paste it yourself into a tool your organization has approved, and that tool’s own terms then apply. Aggregate analytics, where enabled, record only that a prompt was copied, saved or reused and which workflow it came from. The confidentiality check is a heuristic reminder and cannot guarantee that a prompt is free of confidential information.

AI workflow builder: the live builder (optional)

The API key is held only as a server-side environment variable and is never sent to your browser. The server function processes your text in memory to build the request and does not intentionally store or log it; the hosting platform and OpenRouter may keep their own logs under their own policies. To limit abuse, the function keeps a salted hash of your network address in memory for a short time to count requests, then discards it. Before anything is sent, the same confidentiality check described above runs in your browser and again on the server, and sending is blocked if text looks like an identifier, email address, phone number, confidentiality marking or key. That check is a heuristic and cannot catch everything. The workflow that comes back is an unvalidated AI draft; check it against your approved study documents before acting on it. If live AI is not switched on, nothing leaves your browser and the ready-made workflows are used instead.

Blog (The Readiness Brief)

The blog is plain static pages. Which briefs you have opened, and on which day, is stored only in this browser (local storage key cdrn.blog.v1) to show your reading streak and mark briefs as read; your answer to the one-question check is not stored. The RSS feed, the sitemap and the daily calendar reminder contain no information about you, and subscribing needs no account or email address. Where the site operator has switched on aggregate measurement, one anonymous event can be counted when a brief is opened, carrying only its format (for example “Lock Room”). Clearing site data in your browser removes the reading record.

Handbook reading and search

The Handbook is plain static pages. Your reading progress (which chapters you opened, how far you scrolled, whether you marked a chapter as read), the number of searches you ran, and how many times you opened a template or a linked tool are stored only in this browser (local storage key cdrn.handbook.v1). What you type into the Handbook search box is matched in your browser and is not stored or sent. You can export or clear this record at any time from the “My reading” panel on the Handbook home page. Where the site operator has switched on aggregate measurement, a few anonymous event names can be counted by the first-party endpoint: a chapter was opened, a template was downloaded, a linked tool was opened, and whether a search found anything. These carry a chapter number, never text you typed, and the Do Not Track setting is respected. There is no registration, no paywall and no tracking across other sites.

Contribution, feedback, and review forms

When the site is deployed on a PHP-enabled host, practitioner feedback and Practitioner Review Panel interest can be sent to a first-party CDRN endpoint. Accepted submissions are assigned an evidence ID and stored in a server-side file protected from public web access. General feedback fields for organization, country, and contact email are optional. The review-interest form requests a name and email so the project can respond; submitting it is voluntary and does not establish reviewer status or endorsement. The server-side handler does not intentionally store an IP address in the feedback record. If the endpoint is unavailable, the browser exports a local text copy instead.

External media

A small number of contextual photographs are currently served from the Pexels image CDN. Requests to that CDN can expose standard connection information such as IP address to the image provider. Images use a no-referrer policy where supported. Before launch, these photographs can be self-hosted if minimizing third-party requests is preferred.

Usage measurement

CDRN includes a first-party aggregate event endpoint for meaningful product actions such as analysis generation, readiness-plan generation, calendar or briefing export, standards-source review, playbook opening, resource and template download, Handbook chapter opening, and returning-session status. It is designed to store daily aggregate counts rather than user-level browsing histories and does not intentionally store names, email addresses, Workspace labels, free-text study context, or persistent user identifiers. Review-interest contact details are handled only through the separate feedback endpoint described above. A browser-local boolean may be used only to distinguish a first visit from a returning session. Do Not Track is respected by the client-side event sender. Standard hosting access logs may still contain connection information according to the hosting provider's configuration.

AI features

The Navigator, Scenario Simulator, Capacity Estimator and Readiness Intelligence use deterministic readiness logic in the browser and do not call an external AI service. The only feature that does is the optional live builder on the AI workflow builder page, described above. It sits behind a server-side layer that keeps the key out of the browser, uses only free models, caps input length, blocks identifier-like text and rate limits each visitor. Do not use it for confidential study content.