What is implemented, and what is not.

Plans belong to a workspace and are readable only by its members. Every route that loads a plan checks the workspace membership of the signed-in user before it reads anything.

The PDF export renders the same authenticated route you see in the browser, using your own session — it is not a privileged path around authorisation, and the preview is exactly what the reader receives.

A share link is a random token, can be given an expiry, and can be revoked. View tracking records a salted SHA-256 hash of the viewer's address rather than the address itself, so the read analytics work without us holding a log of who read your plan from where.

Generation runs against the Anthropic API. Content sent through the API is not used to train models. The only per-plan content sent is what the generator needs for the section being written; the long system prompt that precedes it carries no customer data.

With no API key configured the product falls back to a deterministic generator that composes prose from engine output alone, which is how the demo and the test suite run with no external call at all.

The free calculators, the homepage demo and the scenario switcher all run the financial engine locally. Nothing typed into a calculator is transmitted anywhere — there is no request to send it in.