ANDR privacy

Useful signals, without server-side transcript storage.

ANDR uses the question you submit and the recent signed conversation state to produce a response. Model requests are sent without provider-side storage. Avoid sharing sensitive or confidential information.

Chat continuity in your browser

ANDR saves recent chat history, your draft and signed conversation context in this tab’s session storage so a refresh does not clear your chat. This is not encrypted storage; avoid sharing sensitive information. The saved chat expires with the current access scope—within 24 hours in Limited Mode or eight hours with approved access—and is cleared by Start over. It is not restored into a different session or access level, and interrupted questions are never automatically resent. Closing the tab normally ends this storage; browser session restoration may retain it until expiry. If browser storage is unavailable, chat still works without refresh continuity.

Aggregate measurement

When aggregate measurement is enabled, ANDR records operational counts such as request outcomes, response modes, broad latency and message-count bands, model usage, approximate sessions, credential-request opens/submissions, delivery outcomes, and credential upgrades. It also records daily controlled aggregates for question topic, response outcome and evidence, evidence gaps, interview relevance, and approved project or source evidence used by a response.

Access-code usage

When measurement is enabled, owner-issued access codes also record the first and last successful redemption time, redemption count, chat response counts by mode, failed chat requests, and last chat activity time. These totals are linked to the code’s private reference label and can be associated with the recipient Andreas issued it to. A shared code does not identify who actually used it. Opening an access link counts as a redemption; returning with an existing session does not. The shared site key is measured only in aggregate.

Contact and credential requests

If you submit a Contact or Request access form, your name, email address and message are emailed to Andreas at hello@andreasfd.com only after you confirm the form’s privacy notice. The submitted email address is included in the message so Andreas can compose a reply manually; it is not used as the technical sender or reply address. The message is used only to reply, assess the request and, where appropriate, issue a credential manually. It is kept in Andreas’ mailbox only as long as needed for that exchange and access administration, normally no longer than 90 days. The request@andr.world and contact@andr.world addresses remain available when you choose to send a manual email instead.

What is not collected

Questions are classified in request memory, but question or answer wording is not stored in the measurement data. Contact and credential-request contents are never copied into measurement data. Broad topic and evidence aggregates contain no visitor or session identifier that can join them back to a person or conversation. Per-code totals link only to the issued code and its private label. Measurement excludes conversation state, IP addresses, browser fingerprints, user-agent details, and email addresses, and is not used for advertising or session replay.

Retention and access

Operational aggregates expire after 60 days. Daily controlled insight aggregates expire after 366 days. Per-code usage totals expire 366 days after the code expires. Only Andreas can access the private insights page through a separate owner session. Measurement failures never prevent valid access or a valid conversation.

Returning-browser measurement and optional sharing of exact question wording are disabled. Either would require a separate disclosure and consent decision before activation.