Privacy & security
Proof without publication.
Remember is private by construction, and the site reader treats the public internet as hostile input.
Private keepsakes
Every Remember pack is private. Its chain commitment is keccak256(salt || canonicalManifest) with a fresh 32-byte salt. The owner receives the salt and owner token; neither appears on the public page or chain. Strangers can verify seal status without learning the manifest.
Unlisted, private, and published
Celebrate and Launch packs are unlisted by default: their capability-like /k link can be shared, but they do not enter the Gallery automatically. Remember packs are private by default and their public page contains provenance only. Gallery publication is always an explicit owner action.
A Remember owner does not “turn the private pack public.” Occestra creates a separate showcase with a new id and seal, a redacted public title, and only the artifacts the owner selected. Private source ids, sources, uploads, and management capabilities never enter the public response. Gallery withdrawal removes discoverability without rewriting provenance.
Uploads and deletion
Images are size-capped, decoded with pixel limits, re-encoded through Sharp, and written without EXIF or GPS. Signed links expire. DELETE /projects/:id requires the owner token and removes the pack, artifacts, and linked uploads. Abandoned private uploads are purged by retention policy.
The site reader
URLs are resolved before access. Private, loopback, link-local, metadata, benchmarking, and file ranges are blocked; redirects are checked again. Crawled text is wrapped as untrusted data and may never become model instructions.