Your workspace, your browser, your choices

Visual Nerve is created by Johan Caripson. This page explains the product’s current data flows and the choices that control them. Security boundaries · Storage and backup instructions .

The workspace is stored locally

Visual Nerve stores diagrams, objects, connections, owners, metadata, preferences, geometry, drawing layers, source analyses and related records in IndexedDB in your browser profile. Original CSV cells, simulation models and bounded results, named history snapshots, storyboard scenes and reviewed app specifications are included where used.

Website → application files → your browser → IndexedDB

Ordinary editing does not upload that content to the static host, S3, CloudFront or a cloud database. No account is required. Other visitors to the same website do not see your browser’s workspace. Saved means a local transaction has committed.

The browser may temporarily hold unsaved working state in memory. Keep the tab open when saving reports an error or conflict, and resolve it before closing.

Optional realtime collaboration

When a collaboration relay is configured, you can choose to share one diagram with approved devices through the Collaboration panel. Ordinary editing and other diagrams remain local; there is no automatic account-wide synchronization or cloud backup.

The shared graph is carried in MLS (RFC 9420) encrypted application messages. The configured Cloudflare relay receives ciphertext, request/IP metadata, room and public device/membership identifiers, connection state, message sizes and timing. It does not receive your vault password or recovery key. Approved participants decrypt the shared content, and may save or copy it. This feature is not anonymous communication and the integration has not been independently audited.

Default sharing includes titles, descriptions, relationships, geometry, styles, annotations, storyboard/presentation configuration, process assumptions and document work: participant profiles (names, colors and pictures), comments, tasks and activity. Document work is included even when optional metadata or responsibility/owner profiles are not disclosed. Optional independent choices add metadata/source evidence, referenced owner profiles or original CSV datasets/analysis configuration. Labels and grouped values can already reveal customer names, paths or other sensitive information while these options are off. Unreferenced owner profiles, camera/view preferences, folders, favorites and local timestamps remain local.

Local private CRDT/room associations are encrypted in IndexedDB and excluded from native diagram exports and all workspace backups. MLS ratchets/private signing keys remain only in the unlocked live tab’s memory. Reconnect may reuse that live device; reload or lock/unlock requires new device approval and owner reload requires a new room. A backup restores diagram content, including document work, not room membership keys. The local acting-profile selection is excluded from backups. Pictures uploaded through the UI are locally resized and re-encoded to remove source image metadata. Document/API raster inputs have separate type and size validation; imported content remains the sender’s responsibility. External image URLs are rejected.

Invitations are private admission capabilities. The owner approves a device as Editor or Viewer; a display name is not enterprise identity verification. Removing a member or closing a room affects future delivery after the membership change. It cannot erase content already received, downloaded, copied or photographed. Review the scope and recipients before sharing, and treat the receiving devices as part of your data boundary.

Collaboration guide · API/MCP restrictions · Security model

Encryption on the dedicated app surface

Workspace address: the encrypted editor is https://app.visualnerve.com/. The public website’s old /app path redirects there, and /app on the app origin returns 404. Routing changes never read, transfer or delete older browser records. Encryption on the app origin does not retroactively protect readable records or backups created elsewhere.

The dedicated app surface at app.visualnerve.com requires a password and stores workspace records in an AES-256-GCM encrypted IndexedDB backend. This includes source rows, history, preferences and simulation archives, with protected lookup metadata. UI, API and MCP operations use the same revocable unlocked session; no readable persistent workspace shadow is created.

A small vault header and session-control record retain cryptographic setup and revocation metadata, without readable work, passwords or recovery keys. App/voice caches hold ordinary static assets. Their small coordination marker contains no workspace content and lets the app clear its own caches safely; clearing app cache preserves the vault and does not erase the entire browser HTTP cache.

Two technical display preferences remain readable outside private workspace encryption: the Appearance choice and an allowlisted app-language identifier. The locked screen needs these before a password is entered. They contain no work, credentials or keys, are not transferred in backups, and do not unlock the workspace or renew a session. App-language changes use bundled local translation files, with no remote translation service; authored diagram content and the narrator voice stay unchanged. Help and API documentation remain in English.

Password setup, unlock, recovery and session-limit changes happen in the browser. No server reset, mandatory account, backend or SSO receives these credentials. Store the recovery key separately. An API/MCP client cannot unlock or change the security policy; it can receive safe versioned GET /workspace/security status while connected, explicitly lock through POST /workspace/lock with fresh Read + write authorization, and receive content permitted after human unlock and a separate grant. An existing connection retained during lock carries only restricted control, not private records; cold locked pages do not connect automatically, and explicit Off closes the transport.

After an encrypted-session unlock, access starts Off. The human must choose a new Read only or Read + write grant; a previous tool grant is not restored automatically.

Automatic session lock is on by default and can be unchecked at startup or in Settings to disable both inactivity and maximum-session expiration. Reloading or closing a tab still drops its memory-only key; manual lock and cross-tab revocation remain active. With the timer enabled, only human app interaction renews the inactivity session. Requests and background work do not. Lock revokes in-flight operations, cancels jobs and clears working plaintext; old requests remain revoked after another unlock. Tabs sharing the vault observe lock, and each tab needs its own unlock.

This encrypted origin is separate from existing legacy, staging and local origins. Their old records and readable backups do not become encrypted or move automatically. Use Export encrypted transfer on the source, then Transfer existing workspace on the encrypted destination. This preserves identifiers and archives, disables API/MCP access and verifies the complete saved copy before reopening the editor. The original workspace stays in place. Manage remaining readable copies yourself. Transfer steps .

The encrypted app’s downloaded workspace backup is encrypted. Changing its live password does not rewrite old backup files, which retain their original password/recovery credentials. Authorized API/MCP reads—including the readable semantic GET /workspace/export—and ordinary diagram exports intentionally release readable content. Encryption cannot control the receiving client or protect an already-unlocked app from malicious browser code or a compromised device. Security and recovery details .

Password changes preserve the content key. If an encryption key or an older backup with its credential may have been exposed, the browser’s separate content-key rotation replaces the key protecting all current records after full verification. It does not upload those records or recall older files.

Required local storage is separate from optional analytics

Before the editor opens, you must explicitly acknowledge and accept local browser storage and offline app caching. These are required for the workspace to work. Without acceptance, the editor remains closed; the public pages and Help remain readable.

Acceptance is kept in this browser profile, excluded from backups and removed when all local workspace data is deleted. Offline app caching starts after acceptance. The browser may independently cache ordinary downloaded HTTP files.

The isolated app prepares editor files, Help, API reference and primary notices for offline use. Other individual dependency notices are downloaded and cached when opened online. These are public application files; these requests contain no diagram or narration content.

This workspace acceptance does not grant permission for Google Analytics. Analytics has a separate optional choice on public information pages.

A different browser or domain has different data

The workspace belongs to the exact origin—scheme, hostname and port—and browser profile where you created it. Another device, browser, private window or origin has separate storage. There is no automatic workspace-wide synchronization; optional collaboration shares only an approved diagram session.

A move to a new website domain does not transfer diagrams. For the dedicated encrypted app, use the complete, verified transfer described above. Other browser-to-browser backup imports still use the reviewed Restore backup flow. A different path within the same origin, such as moving the editor to /app/, does not itself create a new browser-storage origin.

Private browsing, clearing site data, resetting a profile, browser eviction or device loss can remove local work. A browser retention request may reduce automatic eviction, but does not prevent manual deletion or guarantee recovery.

Keep a recovery copy and control its location

Settings → Data & Privacy → Export all data downloads a complete workspace backup. It includes diagrams, connections, owners, portable preferences, templates, datasets, supported simulation content and history. It excludes storage acceptance, integration tokens/grants, local identity and the browser’s import-size preference.

You choose where to keep or share that file. Visual Nerve does not upload it or create an automatic cloud backup. Native diagram JSON is a separate restorable copy of one diagram; PNG/PDF/SVG and Markdown serve different sharing purposes.

The legacy workspace also offers Export encrypted transfer with a separate file password and recovery key. Encrypting that download leaves the legacy working database readable. The file does not acquire later password changes or revoke any earlier copies.

Restore backup previews Merge or Replace. Replace requires confirmation and disables imported integration access; restore does not accept storage or grant tools access on your behalf. Invalid data rolls back instead of leaving a partial workspace.

History snapshots may retain earlier objects and original CSV rows after they disappear from the current view. Removing the current source alone does not erase copies held by history or downloaded backups.

Backup, restore and retention procedures

What imported material retains

Imports and pasted source are analyzed locally in bounded, cancellable workers. They are not executed or sent to a remote analysis service during ordinary UI import.

Imported diagram scripts, macros and external relationships are not fetched or executed. Quoted resource names, paths, SQL filter values and user-written descriptions can still be sensitive. Review recognized content and exports before sharing.

Local file imports default to 50 MiB. Settings can raise the limit to 1 GiB with an experimental-use warning; structural limits still apply. This changes neither source privacy nor the bridge’s separate 32 MiB transport envelope.

Narration and video are generated locally

Node descriptions and scene narration are sent to the local speech worker, not uploaded to a speech service. The catalog’s 20 voices use fixed neural model assets across English, Swedish, French, Spanish, Portuguese, Norwegian, Danish, Finnish and German. Alan is the default English voice.

Explicit audio playback, Preload, voice preview or video export with audio can download approximately 60–131 MiB of assets per voice from versioned external model URLs. These requests contain no narration text or diagram payload. The model host can receive ordinary request metadata, including the requested model and client IP.

After loading, synthesis runs locally and can work offline with cached assets. Downloaded models use a separate CacheStorage cache. Clear downloaded voices removes that cache; model binaries and generated audio are excluded from diagram JSON and workspace backups.

Video export renders locally and inserts optional audio without screen capture. Temporary frames, audio and video buffers are not saved in IndexedDB. The finished file downloads through your browser. API/MCP can read export state, but receives no video bytes.

Presentation, voice and video details

Full walkthrough preloading can retain narration beyond its 32 MiB prepared-clip RAM cache in an encrypted temporary CacheStorage cache, up to a 1 GiB aggregate ciphertext ceiling, including IV/tag overhead, subject to browser quota. Its AES-256-GCM key is held only in RAM, separate from the workspace key; persisted entries use random identifiers and contain no readable narration or key. Closing the presentation, content or voice changes and workspace lock revoke the key and clean up the cache. Reload cannot recover it. A crash may leave unusable ciphertext; Clear app cache removes those owned temporary caches. These clips are not part of IndexedDB, diagram exports or workspace backups.

Optional API and MCP access

Integration is Off by default. Choose Read only or Read + write in Settings to grant connected tools access through a separate local bridge process. The browser must remain open.

Your client → local bridge → open browser → local workspace

The bridge forwards commands in memory and has no second diagram database. It binds to loopback and checks trusted origins. Browser commands use the same validation and transactions as UI operations. Read only includes supported exact unsaved previews, exports, questions and comparisons; mutations and run/playback controls need write access.

The tools you connect receive requested content and may handle it under their own hosting, logging or AI settings. An explicit CSV measure-evidence request can return original cells. A local bridge does not guarantee the privacy of a remote client receiving those cells.

The browser keeps an optional integration token for its session, excluding it from backups and copied setup instructions. Turn access Off to disconnect. Public API documentation discovery reads bundled documentation without a browser content grant.

Local MCP architecture and setup · Exact API contract

Optional Lovable handoff

Build with Lovable creates a specification and complete prompt locally. Opening the dialog sends nothing. Open in Lovable opens a separate tab at lovable.dev with the reviewed text in a URL fragment; you then press Send there to start building.

The brief includes your instructions, selected objects, written descriptions, notes, responsibilities, relationships and reviewed requirements. Recognized CSV schema/group summaries, SQL schema/query structure and code contracts may be included. SQL expressions and clauses retain literal values.

Original CSV rows, complete source scripts, arbitrary metadata, owner email addresses and bridge credentials are excluded. Written text and group/schema identifiers can still be sensitive. Review the exact prompt before sharing; Lovable’s own policies govern the copy it receives.

Review the app brief and handoff

Optional analytics on public information pages

When an analytics measurement ID is configured, public marketing and information pages offer a separate Google Analytics choice through a locally bundled Klaro consent manager. Analytics is optional, starts disabled and loads only after a valid, saved opt-in. Rejecting it does not prevent access to the product or documentation. Without a configured ID, no Google Analytics tag loads.

Analytics does not run on /app/, /help/ or /api/docs/, regardless of a prior marketing-page choice. No graph, title, node description, source file, SQL/CSV payload, workspace identifier or diagram action is included in analytics events.

The implementation sends a page-view event for the public page route, using a fixed generic title, without query strings, URL fragments or referrer content. Google may receive ordinary network/device metadata and analytics-cookie identifiers when you opt in. Advertising personalization and Google signals are disabled. The site operator must also keep Enhanced Measurement disabled for this property’s web stream so it does not add automatic interaction events.

The Analytics administrator must disable Enhanced Measurement and avoid Connected Site Tags or custom tags that collect page contents, automatic events or URL parameters. Visual Nerve’s page integration does not provide those data sources.

How the choice and cookies are kept

The explicit analytics choice is stored in localStorage under visualnerve-site-consent-v1, with visualnerve-site-consent-saved-at recording when it was saved. It is treated as valid for 30 days, separately from workspace-storage acceptance, and is excluded from workspace backups.

After opt-in, Google Analytics may set _ga and _ga_<stream> cookies. The configuration requests host-scoped cookies with Path /, a 30-day expiry and no rolling expiry refresh. Actual browser/provider behavior can vary; the requested lifetime is not a universal browser guarantee. These cookie identifiers support analytics, not access to the diagram database.

Change or withdraw consent

Use Cookie settings on a public information page to review or change the choice. Withdrawal saves the new choice first, disables analytics, removes accessible Google Analytics cookies and reloads an active information page to unload the tag. Other open tabs observe the changed preference. A page with no configured analytics explains that no optional analytics is configured.

Withdrawal stops future collection by this site; it cannot retract data already sent to Google. Browser site-data controls can also clear the locally stored choice. This choice does not control the required IndexedDB records used by the workspace.

Ordinary website requests and access logs

Opening pages downloads static application, documentation and image files. The host/CDN can keep ordinary access logs, such as requested file paths and IP addresses. Those file requests do not contain your graph. Optional voice downloads, analytics and explicit external links/handoffs are the separate network flows described above.

Visual Nerve does not use advertising scripts or remote error-reporting payloads containing workspace data.

Contact and information you send

For privacy questions or other private inquiries, email hello@visualnerve.com . Your email address and message are received by Johan Caripson through the email service used to handle the inquiry. This is separate from editing a diagram: the contact link does not attach your workspace or send anything automatically.

Include only the information needed for your question; avoid credentials, real customer data and full backups. Ordinary bug reports belong in GitHub Issues , where descriptions and attachments are public. Security findings should use private vulnerability reporting .

Delete local workspace data

Delete diagram removes one project and its associated local content. Settings → Data & Privacy → Delete all local data requires confirmation and removes workspace records, preferences and storage acceptance. Built-in templates can be reseeded; the application remains available.

Deletion cannot erase backup/export files kept outside the browser, copies already shared with another service, ordinary host logs or analytics already collected. App caches, downloaded voice caches and marketing-consent preferences are separate storage mechanisms; use their respective controls or the browser’s site-data controls when clearing them.

Open the workspace · Manage storage and backups · Security and reporting