Privacy and Disclaimer

Privacy and Disclaimer

This page explains the current privacy model, data handling boundaries, and disclaimer notes for UACRAgent.

Privacy Overview

UACRAgent stores most of its working data locally.

Depending on configuration, it may also send prompts and retrieved document excerpts to external AI providers.

What Stays Local

By default, the app stores local working data such as:

• session state
• selected file lists
• copied workspace uploads
• generated outputs
• local Chroma vector indexes
• local embedding model cache
• logs

These are stored in:

• the app data directory
• the active workspace’s .uacragent bundle

What May Be Sent to External Providers

If you use a cloud LLM or cloud embedding provider, the app may send:

• user prompts
• system prompt context
• retrieved document excerpts
• selected course metadata
• generation requests

Potential providers include:

• Google Gemini
• OpenAI
• DeepSeek

Provider Privacy Policies

External providers may apply their own:

• privacy policies
• retention practices
• terms of service

You should review the provider you choose before sending sensitive course materials.

Desktop Privacy Notice

The desktop app shows a privacy notice on first launch.

You can reopen that notice later from App Settings.

The desktop app also includes provider-specific privacy reminders in settings when relevant.

API Keys

API keys are intentionally not written into saved session files.

Desktop behavior:

• keys can be entered in the running app
• keys entered there are kept in process memory only

Source-install environment behavior:

• desktop GUI and CLI read <app_data_dir>/.env first
• then fall back to current working directory .env

API behavior:

• the API server currently reads the working-directory .env

Local Embeddings

Local embeddings avoid sending document text to a cloud embedding provider.

Source-install behavior:

• local embeddings use the sentence-transformers path

Frozen build behavior:

• local embeddings use the ONNX local path
• current standalone builds support all-MiniLM-L6-v2 for free local embeddings

API File Access Boundary

The current FastAPI interface is intended for local trusted use only.

If UACRAGENT_ALLOWED_BASE_DIR is not set:

• the API accepts any absolute existing file path on the host machine

If UACRAGENT_ALLOWED_BASE_DIR is set:

• request file paths must resolve under that directory

This is why the API should not be treated as a public or multi-user service in the current design.

Logs

Logs are written under:

• <app_data_dir>/logs/uacragent.log

Current logging behavior:

• warnings and errors are logged
• routine operations are mostly not logged at default settings
• API keys and message content are not written to the log

Disclaimer

UACRAgent is an independent open-source project.

It is not affiliated with:

• OpenAI
• Google
• DeepSeek
• any educational institution

Educational Use

UACRAgent is an educational study-assistance tool.

Generated content may be helpful, but it can still be incomplete, outdated, or wrong.

Always verify important results against:

• official course materials
• instructor guidance
• assignment instructions
• exam rules

Sensitive Material Guidance

Be especially careful when working with:

• unpublished assignments
• private lecture notes
• personal student data
• institutional documents with distribution limits

If you are unsure whether material can be sent to a cloud provider:

• use local embeddings where appropriate
• review the selected provider’s privacy policy
• avoid sending material you are not permitted to share

Related Pages

• Workspaces and Data
• API Guide
• Troubleshooting