Understand your data and privacy

Your workspace data

Conversations, projects, assistants, files and memory notes belong to your account in the application. Routes check ownership before returning or changing them. Administrators can manage users and service settings without a default interface for reading private conversations or provider keys.

The operator still controls the host. A person with access to the database, filesystem and application key may access stored data. Max Harness is not end-to-end encrypted, and you should choose an operator you trust.

Provider requests

A chat request can include earlier messages, project instructions, assistant instructions, enabled memories and the files needed for context. The server decrypts the selected provider key to authenticate the request. It does not send saved keys to the browser.

Switching providers sends the conversation context to the new provider. Provider retention and training settings are controlled by that provider and your account agreement. Max Harness cannot infer those policies from the name of a model.

Optional services

Web search sends the query to the configured search service. Page reading connects to the requested public website. Social login and transactional email use their configured services. The default frontend uses bundled assets and does not load remote fonts or analytics.

Memory controls

Memory starts disabled. Enable it only if you want stored notes included in future conversations. View, edit or delete those notes in settings. A proposed memory from an agent requires approval. Turning memory off stops sending the notes; it does not automatically delete them.

Export and deletion

Export creates a JSON file containing your account details, conversations, projects, assistants, memories and provider connection metadata. API keys, passwords and recovery secrets are excluded. Download uploaded and generated files separately if you want to retain their bytes.

Delete individual records or use account deletion to remove your account's application records and files. Ask the site operator about backup retention. Data already received by external providers is subject to their separate deletion controls.