← WhosWhoZoo

Where your data goes — and where it doesn't

A plain-English map of what lives where, what moves, and what Hans can and cannot see. No promises — architecture.

YOU Your browser Phone or laptop. Nothing stored here. YOUR CLOUDFLARE ACCOUNT Cloudflare Worker Routes all requests. Holds your API keys as secrets. Cloudflare KV Your notes live here. Plain markdown. Your account, your billing. Cloudflare R2 Photos you attach. Your account, your billing. Same credentials as KV. ANTHROPIC API Claude AI reasoning · memory queries. Per-request only. Does not store your notes. OPENAI API Whisper Voice → text (transcription). Per clip. Audio not retained. ELEVENLABS API Voice synthesis Text → spoken audio. Per-request. Not stored. HANS (DEVELOPER) No credentials. No Worker or KV access. No API key visibility. No copy of your notes. question answer reads notes question + notes answer (not stored) voice clip transcript text to speak audio back no access ALL PER-REQUEST — YOUR API KEYS
🏠
Your notes live in your Cloudflare account — they travel to Claude only to answer your question
The only lasting copy of your memory is the one in your own Cloudflare account — notes as plain markdown in your KV, photos in your R2. Not by policy, but because there's no WhosWhoZoo server for a second copy to live on. Ask a question and your notes travel to Claude just long enough to answer it; Anthropic deletes them within 30 days and never trains on them. That round trip is the whole product: everything you've written is in front of the model every time you ask, which is why it doesn't forget.
⚡
Anthropic answers your question — it doesn't become your memory
Your notes travel to the Anthropic API only long enough to answer your question — read, not kept. Under Anthropic's API terms that content isn't used to train models, and both the input and the output are deleted within 30 days. The one copy that lasts is the one in your own Cloudflare account: yours to own, edit, export and delete.
🎙️
Voice input — two engines, and they go to different places
Whisper sends your audio clip from your Worker to OpenAI for transcription. Their API terms carry no abuse-monitoring retention for transcription specifically, so the clip is processed and not kept. Auto, the default, is different: it uses speech recognition built into your browser, which on Chrome and Edge means the clip goes to Google's speech service and never passes through your Worker at all. That is the one path in this diagram that leaves your own infrastructure by a route we don't control, so if you speak confidential details aloud, switch to Whisper in Settings → Voice input. Full detail on the privacy page →
🔊
ElevenLabs — text goes in, voice comes back (and it's off by default)
Voice is entirely optional, and the default engine (OpenAI) carries the same no-training API terms as Claude and Whisper. If you switch to an ElevenLabs voice, the reply text is sent there to synthesize audio — and its terms are the one exception in this stack: they allow training on customer data unless you opt out in your ElevenLabs account settings. That's exactly why ElevenLabs ships off by default. Turn it on only if you want it, and you can turn voice off entirely in settings whenever you like.
✕
Hans cannot see your notes — structurally, not by policy
The setup wizard runs in your browser and deploys a Worker and KV namespace to your Cloudflare account. Your Cloudflare token and API keys pass through a same-origin relay that forwards them straight to Cloudflare's and each provider's own servers; the relay can technically see them in transit, and stores none of them. Your memory files are never sent to us at all — there is no WhosWhoZoo memory database and no analytics pipeline. If Hans were subpoenaed for your notes, he couldn't produce them. Not “won't.” Can't. What he does keep is one line per install — your purchase email, licence key and a hashed account ID — itemised on the privacy page.
Your API keys are encrypted secrets inside your Worker — not in your browser, not on any shared server. The keys for Anthropic, OpenAI, and ElevenLabs are all stored in your Cloudflare infrastructure. Hans cannot read them. Full install guide →
← Back to WhosWhoZoo  ·  Privacy & Security