Privacy and data handling

Stack Audit Requests

The stack builder sends the current audit input to `POST /api/v1/audit/validate` as fields change so the UI can show whether the structure is ready. Choosing Run Audit sends the entered scenario to `POST /api/v1/audit/evaluate` so the deterministic receipt can be generated.

The Stack Audit flow does not create an account, write stack details to a product database, use `localStorage`, use `sessionStorage`, or set browser cookies in application code.

If a user types brand or product names, those names are part of the audit request sent to the validation and evaluation endpoints. The current public build does not write those names to a public named-product catalog or use them to publish a product listing.

Application Telemetry

Audit API telemetry log lines may include a timestamp, log level, event name, route, status, product count, label-fact count, context-term count, outcome count, whether a considered purchase is present, audit API schema version, engine version, and non-sensitive error code and field.

Application telemetry is not allowed to include raw request bodies, product or brand names, label text, ingredient names or IDs, outcome IDs, rule IDs, evidence IDs, context terms, generated decisions, receipts, fingerprints, catalog details, or private provenance.

This page describes Eonic application behavior. It does not promise that hosting infrastructure creates no transient logs before a request reaches application code.

Photo-Assisted Preview

The `/stack` label-photo intake lets the browser display a selected image with an object URL. In the current build the image stays in the tab, is not uploaded by Eonic application code, and is cleared when the preview is reset. The suggestions shown in that mode are deterministic examples, not extracted from the selected image.

Edge Processing

Requests to the public site pass through hosting and edge infrastructure before reaching application code. Eonic's application layer stays stateless for the audit API. Rate limiting is intended to be enforced at the edge through deployment configuration rather than by storing request-derived identifiers in the app.

Current Limits

The current public Stack Audit is informational decision support for an entered scenario. It is not a medical-care channel, an emergency channel, or a place to send sensitive details by email. The corrections mailbox is for public-page review requests, not private stack review or individual advice. The Terms page remains pre-launch pending a separate legal-identity and terms review.