What you provide
The demo can process records you type or import, relationships you create, and queries you save. Those operations take place in your browser. No data-upload endpoint, advertising pixel, or third-party analytics script is included in this build.
What is stored locally
The full demo stores its workspace under solarflaredb.demo.workspace.v1 and its query preferences under solarflaredb.demo.preferences.v1 in localStorage when the browser permits it. The workspace includes the model, source snapshots, records, relationships, and retained revisions.
The interactive homepage sample does not write to localStorage and does not share data with the full demo workspace. Reloading the page resets that preview.
How to remove local data
Use the demo’s workspace controls to replace the current workspace with an empty one, or remove the site’s browser storage to clear both workspace data and query preferences. Clearing data is irreversible unless you exported a backup. A downloaded backup remains on your device until you delete it.
What the host receives
When this site is served online, your browser requests the website’s HTML, scripts, styles, and other assets from the hosting service. That creates ordinary website traffic separate from the dataset you work with inside the demo. Request logging and retention depend on the host’s configuration and are not represented by the demo’s local storage settings.
Sign-in, sessions, and anti-abuse
The Sign in destination on this site is Platform Identity. It verifies a Google OpenID Connect ID token using the openid and email scopes only, and a Cloudflare Turnstile challenge bound to hostname solarflaredb.com and action signup. Accounts are resolved from the verified Google issuer and subject, not from a password database or a caller-supplied account identifier.
Successful sign-in creates or resumes a pending account in this environment. A pending account has no tenant membership, product capability, internal-billing privilege, paid entitlement, or provider-execution authority. Signing in does not start a paid subscription.
The service keeps an opaque server-side session. The browser receives Secure, HttpOnly session cookies on this host and a separate readable CSRF cookie that does not contain the session secret. Google access tokens, refresh tokens, ID tokens, and authorization codes are verified transiently and are not retained in application tables. Logout invalidates the server session rather than only clearing the page.
This section describes the identity, session, and anti-abuse behavior actually exposed on solarflaredb.com. It is not a complete paid-service privacy policy, and the local-demo storage rules above do not cover hosted account records.
Use non-sensitive data
Do not use credentials, private customer records, incident evidence, or other sensitive material in a public demonstration workspace. Local application views are not security boundaries and do not hide data from someone controlling the browser.
For more detail, read Data handling and boundaries or History and sources.