Privacy and Security

MVP privacy and security statement for review prior to launch.

This page explains how the KSAWorks MVP handles identity, basic telemetry, and local configuration. It is written for MVP review and will be refined before production release.

Information we collect

  • Google account identifiers when you sign in: your email address and basic profile information provided by Google/Firebase.
  • Authentication metadata managed by Firebase Authentication (for example, session state and security tokens).
  • Limited client-side configuration stored in your browser (for example, link destinations configured on the Settings page).

Information we do not collect in this MVP

  • No learner transcripts, course history, or credential records are collected by the portal itself.
  • No payment information is collected.
  • No sensitive personal data is intentionally collected by the portal.

How information is used

  • Access control for secured pages (dashboard and settings) using an administrator allow-list.
  • Continuity of experience so sign-in status is consistent across the portal pages.
  • MVP validation of navigation flows and suite framing.

Browser storage

The portal stores a small amount of configuration in your browser using localStorage to remember link destinations for Composer, GuidEZ, and GuidEX. You can clear this at any time by clearing your browser site data.

Analytics

Firebase may be configured to provide basic analytics events depending on project settings. In this MVP, analytics is not used to profile users or sell data. If analytics is enabled, it is intended for aggregate product improvement.

Sharing and disclosure

This MVP does not sell personal information. Information may be processed by Google/Firebase as the identity provider and hosting platform. AcademyOne, Inc. may access authentication logs and configuration necessary to operate and secure the Service.

Security practices

  • Authentication is handled by Firebase Authentication using Google sign-in.
  • Restricted routes are enforced by client-side checks for the MVP and are intended to be reinforced server-side as the system matures.
  • Least data principle is applied: the portal is designed to avoid storing learner records and to keep the portal lightweight.

Your choices

  • You can sign out at any time from the portal header.
  • You can clear site storage in your browser to remove locally stored link settings.
  • If you believe your account should be added to or removed from the MVP allow-list, contact the MVP administrator.

The GoldSeam MCP service

GoldSeam (https://goldseam.ksaworks.com/mcp) is a free service that answers AI agents’ questions about postsecondary organizations serving teaching, training and learning — their programs, checklists and courses, the published rules for transferring between them, industry certifications, the occupations they lead to, and the KSA Dictionary’s shared vocabulary. It serves the same answer to every caller, creates no account, and holds no personal records. Connecting asks nothing of you: there is no authentication.

  • What a tool call logs: a timestamp, the tool name, the query arguments as sent, a derived caller identifier (for anonymous callers, a one-way hash of the connecting address — raw IP addresses are never stored; for keyed callers, a hashed key identifier and the registered organization name), whether the answer was a hit or a miss, and the result count. A query argument here is a search word, a school, a code — the question, not a person.
  • The services that accept your own documents keep nothing. When you hand GoldSeam transcripts, a resume, certifications, military records or life experiences written in your own words, that evidence produces the answer and is retained by nothing here. Your AI holds the resulting package; GoldSeam stores no copy, and there is no record to come back to later. For those services the usage log holds counts only — how many files arrived in each slot, their total size, how many statements were made, and whether a package was sent — never the documents, never their text, never a name. If you want the package tomorrow, keep it yourself; we cannot retrieve it for you.
  • Retention: raw log entries are deleted after 90 days. Aggregates kept beyond that (calls per organization per month, miss counts, unmatched search phrases) carry no caller-linked detail.
  • Free keys are authorization, not authentication: nothing is required to connect. Anonymous use carries a daily allowance; a key raises it and names your organization in the usage record. It grants no additional data — every caller gets the same answer. Requesting one asks for an email address and organization name, used only to issue the key, name the organization in the usage record, and follow up about service use. The end user an AI agent acts for is never visible to the service and is never contacted.
  • No sale or sharing: usage records are not sold and are not shared outside AcademyOne, Inc.; misses guide what public data is gathered next.

Changes to this statement

This statement may evolve as the MVP becomes a production service and as additional capabilities are introduced.

Contact

Questions about privacy and security — for the portal or the GoldSeam MCP service — may be directed to AcademyOne, Inc. at guidedbyacademyone@gmail.com.