Know what stays local.
Know what goes online.

Not every local memory store has the same account boundary.

Structured field gameplay memory is stored locally in a database derived from the signed-in player ID and is not shared between accounts. General conversation and companion relationship memory remains local to the Windows profile and is separated by companion namespace, not completely by ScrapLink account.

Shared game knowledge does not absorb private messages, raw screenshots, microphone audio, account fields, inventory, routes, or conversation history. Supported memories can be reviewed, corrected, exported, or deleted in the app.

Online features receive the inputs needed for the request.

• Hosted conversation can receive the current prompt or local speech transcript plus bounded relevant history, memory facts, game context, and source context.
• Research can send the named or detected game and factual question to the hosted service and public web-search tools.
• Vision can send one JPEG of the current game window after consent, or while separately enabled automatic awareness is active.
• After initial account-gated download of the offline speech pack bound to the signed manifest, normal microphone transcription and companion speech synthesis can run on-device. ScrapLink reuses the verified local pack and downloads again only after a verified pack update. If hosted voice is selected, generated response text can instead be sent to that configured voice service.

ScrapLink does not write raw screenshots or microphone audio into player memory or shared game knowledge. The hosted assistant receives transcript text rather than raw microphone audio on the normal local speech path. That is different from promising that every network provider retains nothing; no provider-retention guarantee is published for this alpha.

Retained July 23 promotion QA records six hosted 24 kHz companion cues verified. Current source and packaged diagnostics map all six intended hosted voice routes, but this is not a fresh provider probe and does not prove current availability, retention behavior, or playback on every tester PC.

Combat evidence and personal player notes stay local.

FPS Operations stores confirmed visible counters, evidence labels, manual corrections, and blacklist notes on the device. The blacklist store is isolated by a one-way hash derived from the signed-in account identity; it is excluded from general conversation, Field, and Continuity memory.

Blacklist entries are private reminders, not shared moderation records or verified claims about another player. Ambiguous screen events are not counted automatically.

Accepted-friend access is not end-to-end encryption.

Friend requests must be accepted before presence, direct messages, attachments, or another player’s Feed posts are shared. Messages, attachment data, Feed post text and media, comments, Like or Dislike reactions, and saved-post markers are stored by the ScrapLink service so the relevant views can be delivered and retrieved. Service code can process that content; the messages are not end-to-end encrypted.

A Feed post is visible to its author and accepted friends unless either account has blocked the other. Comments and reactions follow the same post-access check. Saved-post state is returned to the player who saved it rather than exposed as a public list.

Invisible mode hides online and current-game presence from friends. Blocking and reporting controls are available. Exact messages sent by a companion command are not copied into companion memory.

Current communication features have narrower guarantees.

Channel views are local settings that broadcast prefixed direct messages to accepted contacts; they are not a server-owned group-chat system. Crew voice relays authenticated 16 kHz mono PCM over HTTP in server memory, prunes frames after roughly eight seconds, and does not write those frames to the service database in the current implementation.

The Crew voice alpha does not use WebRTC, is not end-to-end encrypted, and has no published production-quality or retention guarantee beyond the implementation described above.

The current deployment uses several service layers.

Project configuration identifies OpenAI-hosted AI and voice services, a ScrapLink alpha API hosted on Render, OpenAI Sites and Cloudflare infrastructure for the website and protected installer storage, and public web sources for current-game research. Those providers process data needed for their part of the requested feature.

The private alpha does not yet publish contractual provider-retention periods or a complete subprocessor register. Do not treat this page as a promise that provider-side copies disappear immediately.

Passwords are not stored in browser page code.

The website sends account credentials over HTTPS to the ScrapLink service. Passwords are salted and hashed by the service. The browser receives an HttpOnly, Secure, SameSite=Lax session cookie with a maximum age of 30 days; signing out clears the browser cookie and requests server-side session revocation.

The Windows client protects its saved session token with Windows DPAPI. Passwords and invite codes are not saved by the desktop session cache.

Some data lasts until you delete it.

Local settings and memory remain on the Windows profile until app controls or local file removal delete them. Account, friendship, message, attachment, Feed post, post-media, comment, reaction, saved-post, event, RSVP, block, report, and usage records remain in the alpha service database until account deletion or an applicable service cleanup.

The project does not currently publish a backup-purge timetable, a per-message expiry period, or a guaranteed hosted-provider deletion window. Those policies must be defined before the alpha expands beyond personally invited testers.

Service deletion and local deletion are separate actions.

The app supports account-data export, sign-out, session revocation, and password-confirmed account deletion. Deleting the service account removes associated primary-database records through the current account relationship model.

Deleting the service account does not itself promise removal of separate local settings or memory files on the PC, infrastructure backups, or provider-side processing records. Use the app’s local memory controls separately and contact the invite issuer for an alpha privacy request.

No child-directed or age-verification flow is implemented.

The current service is limited to personally invited testers and does not implement age verification or parental-consent tooling. Do not submit a child’s personal information or issue an invite to a minor until ScrapLink publishes and implements a formal age policy.

The private alpha is owner-supported.

No public support email or ticket system is configured in the project. Testers should contact the ScrapLink owner through the same direct channel that delivered their invite for account, deletion, safety, or privacy help. A public contact method must be published before wider access.

Protected delivery, not a claim of zero risk.

The alpha uses HTTPS, strict browser security headers, account-gated downloads, protected immutable installer and offline-model objects, hashed service sessions, signed installer-update and offline-speech manifests, trusted-host checks, increasing release sequences, package-size checks, per-file model allowlists, and SHA-256 verification.

The Windows installer is not advertised as Authenticode-signed, direct messages are not end-to-end encrypted, and ongoing testing is not proof that any system is risk-free.