Menu

Local draft for review

Your ideas and your privacy

A local policy draft that describes implemented boundaries and identifies the facts still required before publication.

Who can see a canvas?

Boards begin private to their owner. Invited membership and shared links expand access only while the owner enables them and retains an eligible plan.

How is content processed?

Image palettes use deterministic histograms and document extraction runs locally. Optional hosted operations are bounded and disclosed: OCR runs only after an explicit request, while default-on smart tagging adds generated tags to each eligible new capture from that item’s saved content.

How are smart tags handled?

When configured, Rail Cove sends one item’s title, up to 8,000 characters of saved text, current tags and an optional metadata-free stored-image thumbnail up to 512 pixels to Mistral AI through OpenRouter. Requests require the dedicated Mistral Zero Data Retention route, deny provider data collection and disable fallback. No whole-library scan or source-link fetch is part of tagging.

Your smart-tag choice

Automatic smart tags are on by default for new captures. Turn them off in Settings → Notifications before saving content you do not want sent for tagging. Turning them off stops queued tagging and discards results from requests already in flight; a request already sent cannot be recalled. Turning them back on does not scan older items. Successful tags are added automatically and can be edited or removed immediately.

What zero retention covers

The inference routing requirement does not remove your saved items, generated tags, legacy stored suggestions, job history or provenance from Rail Cove. It also does not eliminate provider billing and operational metadata, in-memory caching or optional OpenRouter account prompt logging. The operator must keep prompt logging disabled. Hosted OCR is a separate operation with provider disclosure and explicit consent. These implementation boundaries were reviewed September 13, 2026.

Before public launch

The operator identity, retention periods, subprocessors, governing region and contact channel still require confirmation.

Explore the documentation