This page describes the software in this installation. A public service must also identify its operator, hosting location, retention policy, and contact details.
Your data lives with this installation
Accounts, project memberships, designs, comments, agent conversations, and activity are stored in a SQLite database in the app’s data directory. The default location is .data/workspace.sqlite in the repository. Proximaforma does not upload those designs to a Proximaforma cloud service.
Browser storage keeps you connected
The app uses an HTTP-only session cookie to connect your browser to your account or the existing local workspace. Sessions expire after seven days. The advanced editor also stores your most recently opened project in browser local storage. This build does not include advertising, marketing analytics, or third-party tracking scripts.
Agents receive the information they request
A connected agent can access only the canvases and actions permitted by its key and account membership. Data it reads may be sent to the provider you use for that agent. That provider’s data handling and charges apply. Review and revoke agent connections in the app’s Connect agent panel.
Forma uses OpenAI for text and voice
When you use the native design agent, chat messages and the canvas information its tools read are sent to OpenAI. Starting a voice conversation also sends microphone audio to OpenAI until you end it or close the window. The app saves conversation text in the workspace database; it does not save audio recordings. Choose New conversation to clear the saved chat. The workspace host configures a server-side OpenAI key; the browser receives only a short-lived voice credential. OpenAI’s data handling and API charges apply.
Credentials stay separate from design exports
Passwords use salted scrypt hashes; session tokens, recovery codes, invitation tokens, and named API keys are stored as hashes. Recovery codes replace passwords and revoke prior sessions and keys. The local stdio bridge uses a workspace credential stored in .data/connection.json, with owner-only file permissions. Exported design JSON and SVG do not include agent credentials.
External images make external requests
When you add an image using an HTTPS URL, your browser requests it from that image’s host. That host can receive normal request information, including your IP address. Images remain linked to their original URLs in exported SVG files.
Take a copy, or remove your work
Export a project as JSON or SVG from the workspace. The API supports project deletion. For a complete local backup, stop the app before copying the data directory, or use SQLite’s backup facilities. Deleted content may remain in backups you have made.
This version runs locally
The server binds to your computer’s loopback interface. Browser sessions and agent keys protect application data. Accounts, private canvases, reviewer permissions, and revocable agent connections are included. A public deployment and managed hosting service are not configured.
Help with the local workspace