Data handling & subprocessors

This page is for security and procurement reviewers. It describes exactly what data flows out of Feynman and to whom, in the hosted deployment.

Data flows

• In-browser tutor (course pages): the model runs inside the learner's browser on their own device. Messages and replies never leave the device. Starting it the first time downloads static model files (about 1 GB) from Hugging Face and the model runtime from GitHub; those hosts see the device's IP address and standard request data, never learner messages. The browser caches the files, so later visits download nothing.
• Opt-in web search (only when you click “Search the web”): your query is sent to an external search service; results are filtered to academic domains (.edu and arXiv) before being shown.
• Request handling (hosted only): your IP address and standard request metadata are processed to rate-limit and protect the Service.

Academy interest forms (separate from learning)

When configured, same-origin form endpoints validate submitted contact information and send a notification email to the operator through Resend. The operator’s inbox is the record of the inquiry; there is no application database or account. Submitted data is not included in analytics events.

Optional marketing analytics cover only the homepage, programs, partner, and community pages. Query strings are removed from recorded page URLs, and custom event properties are restricted to predefined program and interest categories. No learning-route analytics are installed.

[Operator: confirm inbox retention, access controls, deletion procedures, and provider settings before enabling forms or marketing analytics.]

Subprocessors

The specific third parties depend on how the operator configures this instance. Operators should keep this list current for their deployment.

• Model host - local Ollama by default (no third party). If the operator points the tutor at a remote model host, that host becomes a subprocessor and must be listed here. [Operator: name it.]
• Search provider - used only for opt-in web search. The default scrapes a public search endpoint; production operators should use a contracted search API and list it here. [Operator: name it.]
• Hugging Face and GitHub (model file downloads) - serve the in-browser tutor's model files and runtime. They receive the device's IP address and standard request data when the files are first downloaded; no learner messages. [Operator: confirm with counsel.]
• Hosting / CDN provider - the platform the operator deploys to (e.g., their cloud host). [Operator: name it and link its DPA.]

• Resend (optional marketing forms) — receives submitted inquiry fields and contact details to deliver email to the operator. [Operator: confirm the sending domain, recipient, agreement, region, and retention.]
• Vercel Web Analytics (optional marketing pages) — receives marketing page views and predefined action events, never form content or learning activity. [Operator: confirm enablement, plan, agreement, and retention.]

What is not collected

• No accounts, names, or contact details are required to use the tutor.
• No advertising, analytics, or cross-site tracking cookies are set by Feynman.
• User messages are not used to train models by default.

Security controls (summary)

• Strict security headers and a content-security policy on every response.
• Per-client rate limiting and request-size caps on the tutor endpoints.
• Server-side input validation and role coercion so client input cannot override the tutor's safety instructions.
• Layered content moderation (deterministic rules plus an optional model classifier).