Privacy & Data Sovereignty

1. Introduction

This Privacy Policy explains how **Continuum** and its integrated **AI Assistants (e.g. ChatGPT Custom GPT Actions)** collect, process, and protect your data. We respect your privacy and are committed to keeping your personal information secure.

2. Data Collection & Ownership

All your transaction ledger, subscriptions, libraries, notes, and investment data are stored directly inside your personal **Firebase Firestore database**.

• •AES-256-GCM Encryption at Rest: Sensitive financial fields (expense amounts, titles, categories, notes, and investment portfolio assets) are encrypted with authenticated AES-256-GCM prior to database persistence.
• •Ciphertext-Only Caching: Upstash Redis and server process caches store strictly encrypted ciphertext blobs (v1:iv:tag:ciphertext). Decryption occurs ephemerally in-memory only during authorized HTTPS request fulfillment.
• •Zero Admin Master Keys: Database reads and writes execute via the Firestore REST API authenticated exclusively with the caller's personal Firebase ID token. No elevated admin service account key exists on the server.
• •User-Scoped Storage: Every database read and write is strictly isolated under /users/{userId}/** and enforced by path-scoped Firestore security rules.

3. AI Assistant Integration (OAuth & APIs)

When you connect the official Custom GPT or any custom AI Agents:

• •Authentication: We use standard OAuth 2.0. By authorizing the integration, ChatGPT is granted a secure Firebase Refresh Token to act on your behalf.
• •Read/Write Operations: The Assistant only accesses the specific data fields you ask it to (e.g., adding a movie to your watchlist, logging an expense, checking notes).
• •Revocability: You can disconnect the assistant or revoke its tokens at any time, instantly cutting off all API access.

4. Third-Party Integrations

The dashboard queries external public APIs to enrich your lists and valuations:

• •Media Lookup: AniList (anime), Trakt & TVMaze (shows/movies), OMDb (plots), and OpenLibrary (books). No personal identifying details are ever shared with these APIs.
• •Market Valuation: Real-time asset close prices are resolved anonymously from Binance and Yahoo Finance.

5. Cookies & Analytics

We optionally collect anonymous diagnostic metrics using Google Analytics to understand user counts and platform stability. No personally identifiable information (PII) is captured.

6. Security & Cryptographic Measures

Communication between your browser, external AI Assistants (ChatGPT Actions), and our Next.js backend endpoints is strictly encrypted in transit using TLS/HTTPS.

At rest, all financial amounts, titles, and investment assets are protected with versioned AES-256-GCM ciphertexts with dynamic 12-byte initialization vectors and integrity authentication tags. The distributed caching layer retains only ciphertext blobs, preventing plaintext leaks across database backups or caching tiers.