Overview
Pontus De Joung operates https://pontusdejoung.se as a personal portfolio demonstration of governed LLM patterns. The corpus contains only public Swedish government documents. The demo does not hold protected agency data.
Some technical and usage information is processed to deliver the demo, protect access, and keep the service reliable. Details below reflect the actual implementation in this repository.
Privacy by design
This demo is intentionally designed to minimize data collection.
- • No advertising cookies
- • No marketing trackers
- • No cross-site profiling
- • Public government documents only
- • Operational logging only where required for security and reliability
What we collect
- Page views and navigation paths, to understand which demo areas are used (Vercel Web Analytics, aggregated).
- Hashed client IP and security event metadata, for audit logging and abuse detection (7-day Redis buffer, up to 90-day Postgres retention when configured).
- Raw client IP, for per-IP rate limiting when Upstash Redis is configured.
- Invite-code validation events may record the outcome and operational metadata, but the submitted code itself is not stored in full.
- Chat, eval, academy, and agent inputs, transmitted to OpenAI to generate responses. Not stored in this application's database.
- Code Agent investigation data when that demo is used (see Code Agent data below). Browser restore keys: Cookies page.
- Browser preferences and demo UI state: theme, optional agent-cycle metrics, and short-lived session handoffs (see Cookies page).
Why we collect it
- Deliver AI-assisted answers and evaluation features you request.
- Restrict demo access to invited visitors.
- Rate-limit abusive or automated traffic.
- Maintain a minimal security audit trail for gate and API events.
- Measure aggregate usage of the demo surfaces.
- For Code Agent: restore runs after refresh, support human approval, and expire old workspaces and run documents automatically.
Code Agent data
Code Agent persists investigation state for restore, review, and human approval. Synthetic mission repositories, diffs, and workspace projections may be stored while a run is retained. Merge / Deploy is not executed in this demo.
- Stored: run snapshots (lifecycle, events, Repair Plan and related artifacts), workflow checkpoints, verification job records (Oracle worker results), host validation summaries, and temporary workspaces for the mission repository.
- Review Brief is derived from durable run state for display. It is not a separate store.
- Active or leased runs, and rows within the grace window, are not deleted.
- Historical runs expire under the retention windows below. TTLs are configurable via environment variables.
Third-party processors
Always used on the hosted demo
Vercel Hosting
Hosts the Next.js application and platform request logs.
Data involved: HTTP requests, response metadata, server log lines.
Vercel Web Analytics
Cookieless page-view analytics when enabled in the Vercel project.
Data involved: Page path (query strings stripped), referrer, country, device, OS, browser.
OpenAI
Chat, embeddings, eval, grounding, injection screening, Code Agent investigation (when enabled), and optional feature pipelines.
Data involved: User prompts, conversation context, retrieved public corpus excerpts, and Code Agent investigation prompts/context sent per request.
Upstash Vector
Vector retrieval for RAG over the indexed public document corpus.
Data involved: Query embedding vectors and corpus chunk metadata already stored in the index.
Only when explicitly configured
Upstash Redis
Per-IP rate limits and a short rolling audit buffer when credentials are set.
Data involved: Client IP address, rate-limit counters, serialized audit events.
Cohere
Optional multilingual reranking of retrieved chunks.
Data involved: Original user query and public corpus chunk text.
Neon Postgres
Optional durable audit history, redacted email-demo records, and Code Agent run/workflow documents.
Data involved: Hashed IP and event metadata, redacted email fields, and Code Agent run snapshots, workflow checkpoints, validation summaries, and related investigation payloads (may include diffs and file projections from synthetic mission repos). Not raw chat transcripts.
Azure Document Intelligence
Optional OCR and layout analysis for the document-intelligence feature.
Data involved: Uploaded or attached document bytes.
Brevo
Optional inbound webhook and outbound acknowledgement or reply transport.
Data involved: Email addresses, message content, and delivery metadata.
Sentry
Optional server-side error and performance monitoring when enabled.
Data involved: Exception stack traces, route context, sampled performance spans.
Optional processors remain inactive unless the corresponding feature has been enabled in the deployment. When disabled, no data is sent to those providers. The live chat and RAG experience requires OpenAI and Upstash Vector. Code Agent durability requires Neon when restore across restarts is expected.
Retention
- Gate session cookie: 24 hours.
- Audit events in Redis: retained for up to 7 days (maximum 500 events).
- Audit events in Postgres: up to 90 days.
- Redacted email-demo rows in Postgres: up to 30 days.
- Rate-limit counters: short sliding or fixed windows in Redis.
- Chat content: not persisted in the application database. Requests are processed by OpenAI, whose retention policies apply to data processed by their service.
- Eval JSONL run logs: written locally or in CI only. Skipped on Vercel serverless.
- Code Agent Neon (defaults): AwaitingApproval 30 days, Completed 30 days, Failed/Cancelled 14 days, stale unsettled or orphan workflow groups 7 days, grace 1 hour, up to 50 runs per daily job. Active/leased runs and singleton collaboration/promotion/publication/merge snapshots are not deleted as whole documents.
- Code Agent workspaces (defaults): Completed 30 days, Failed/Cancelled 14 days, AwaitingApproval 7 days, abandoned/orphan 7 days, grace 5 minutes. Active runs are never deleted. On Vercel, workspaces live under ephemeral /tmp.
- Scheduled cleanup: daily Vercel Cron → GET /api/ops/retention applies Neon and workspace retention when enabled (plus email/audit purge). Workspace cleanup also runs on process startup and after a run settles. Manual CLIs stay dry-run unless --apply is passed.
Security
- Content Security Policy with per-request nonces and strict-dynamic script policy.
- HttpOnly, Secure (production) gate cookie with SameSite=Lax.
- Salted IP hashing in audit logs. Raw IP only where rate limiting requires it.
- PII redaction on email-triage paths before model calls and database writes.
- Token-gated audit read API. Submitted invite codes are not stored in audit events.
- Code Agent retention uses an advisory lock and batched deletes. Neon cleanup failures do not stop email or audit retention.
How Code Agent works: Transparency.
International transfers
Some third-party providers may process data outside the European Economic Area (EEA), depending on the deployment configuration. Where available, regional endpoints or regional hosting may be used to reduce cross-border data transfers.
Your rights
Under GDPR you may have rights to access, rectify, erase, restrict, or object to processing of personal data, and to data portability where applicable. If you have questions about how your information is processed, or wish to exercise your rights where applicable, please use the contact details below.
For erasure of redacted email-demo records stored by sender hash, or questions about Code Agent run documents when Neon is enabled, contact the operator.
Contact
Privacy questions
Pontus De Joung
Email: pontusdejounge@gmail.com
Additional technical implementation details are available on the Transparency page.
Browser storage and analytics behaviour: Cookies & storage.