Clear about what we keep.
Careful about who can see it.
This private portfolio application uses fictional property, resident, vendor, repair, evidence, approval, and invoice records. Do not enter real resident information. Your verified ChatGPT identity owns a separate sandbox. The role selector previews fictional participants in that sandbox; it does not grant access to another person’s data or act as a real production membership system.
What is stored and who can access it
Maintenance details, consent, estimates, approval decisions, proposed time windows, completion files, invoice comparisons, drafts, and audit events are saved in Cloudflare D1 and private R2 storage. The server derives sandbox ownership from the Sites identity. Resident views are restricted to C-204, vendors to their assigned work, and management views to the current sandbox. Search and exports use the same authorization. Files require authorized work order access.
Protection in practice
The hosted Site uses HTTPS and the Sites sign-in boundary. Cloudflare documents encryption at rest for D1 and R2. The application uses parameterized queries, revision checks, rate limits, private/no-store API responses, same-origin write checks, secure response headers, and restricted image uploads with file signature checks. No malware scanner, independent penetration test, certification, MFA policy, or end-to-end encryption is claimed. The backend can read the data. Content Security Policy permits inline framework scripts and styles; other sources are restricted.
AI and human decisions
Free guided navigation is deterministic and clearly separated from premium reasoning. Authenticated visitors can explicitly select GPT-6 Astra, grounded in the current authorized records and a versioned Hearthstone playbook. It offers advice and choices; it cannot perform workflow actions. Requests use high reasoning effort, a12000-byte context cap,4096 output/reasoning tokens, no tools, store:false and no automatic retry or downgrade. Four premium reasoning requests are reserved across the lifetime of this Site and two per workspace. Failure or unknown results retain the reservation. The owner’s paid-intelligence and global pauses apply. Historical lower-cost drafts remain records, but that generation route is retired. OpenAI provider retention follows account terms; store:false is not a zero-retention guarantee.
GPT-Transcribe is a separate optional speech-to-text path: record locally or choose mono16kHz16-bit PCM WAV, stop, explicitly upload for transcription, review editable text, then Send separately. Server limits audio to20seconds and four lifetime Site requests/two per workspace. Browser speech recognition remains distinctly labeled; it is not OpenAI transcription. No automatic recording or transcript sending occurs. Stop/cancel/navigation release microphone capture. Canceling after submission cannot guarantee a provider reservation was not consumed. No audio is saved by this application.
ElevenLabs Matilda is selected as Hearthstone’s warm professional concierge voice, with an existing provider sample available for opt-in listening. One bounded development synthesis and opt-in playback were verified with the configured Matilda voice and model. New synthesis requires private authorization, explicit opt-in, owner-enabled paid intelligence and an available reserved lifetime slot. The owner currently keeps paid intelligence paused. Multilingual voice quality has not been verified. No voice cloning is used.
Search, calendars, and communications
Search queries only authorized saved records. The maintenance calendar contains local proposals with a stored UTC time and America/Denver display, conflict checks, and revision protection. A proposal does not confirm a vendor visit or create an external event. Email, calendar, and Twilio operations are disabled live. Clearly labeled fixtures can simulate failure, retry, acceptance, delivery, and duplicate/replay handling. Nothing sends real messages, dispatches trades, or moves money. Provider acceptance and delivery are distinct records.
Owner controls and recovery
The owner can pause queues, change the manager’s spending authority, correct unit/vendor records, inspect audit and provider histories, disable simulated integration execution, retry escalated work, and export a JSON report. Intake drafts can be saved explicitly and resumed from the same private workspace. The most recent 100 access-attempt entries per workspace are retained without search terms, file names, or request bodies; the owner can inspect the latest 50. Records remain until the Site owner arranges deletion; automatic retention expiry, self-service deletion, backup scheduling, and a restore interface are not implemented. Provider-managed database recovery may be available to the hosting operator, but a full hosted restore has not been exercised here. A separate offline rehearsal restored the synthetic business JSON into a fresh disposable local database with matching record checksums. A later quarantine step preserved the supported identity and paid-permit row snapshots and restored all three linked completion images with matching checksums. Provider sessions and secrets, a transactionally consistent budget snapshot, unreferenced uploads and generated private speech remain outside that partial recovery check. Execution stayed disabled. This is not a complete account backup. Exports support review and archiving; an import/restore operation is not currently offered. Unattached uploaded files may remain until operator cleanup.
Identity and future connections
App-specific Clerk development sign-in, dual-proof owner linking, approved Resident and Manager access, revocation and logout recovery were tested. Every development private request also requires the original verified Sites workspace. Production Clerk, generalized real-user enrollment and custom-domain cutover remain deferred; the registered domain is not connected here. Live providers need separately approved accounts, scoped mappings, OAuth where supported, verified webhook registration, and spending authorization. No mailbox passwords are requested. Runtime secrets remain server-side and are omitted from exports.
Questions and reporting
Report demonstration issues to Rodney in the originating Codex chat. Hearthstone is fictional and has no real resident support or security-response service. No response-time or incident-recovery guarantee is offered.
Return to the workspace →The operations agent
An owner can enable rules-based operational reviews. While an owner or manager workspace is open and visible, a review runs approximately every five minutes, with manual review also available. An owner-authorized linked Site cloud task can also perform reviews while the browser is closed. Background access and the agent/global pause controls are checked independently on every request. Reviews prepare due maintenance requests, classify intake, and track exceptions. Generated requests never grant entry consent or approve spending. Preventive plans, inspections, deadlines, resident preferences, and run histories use the same private workspace storage and authorization. Communication preference is separate from entry consent; email and SMS remain disconnected.
Preparing your own service connections
Owners can save provider choices and resource mappings without connecting accounts. Google and Microsoft authorization flows, and encrypted Buildium/Twilio credential storage with read-only tests, are implemented but require administrator OAuth registration and a separate server encryption key before use. Nothing is connected automatically. Other partner-specific providers retain preparation profiles and require their approved interface contract before a live adapter can be completed. Tokens are encrypted with AES-GCM, random nonces and workspace/provider binding; versioned envelopes support a controlled key migration. The encryption key must be kept separately in runtime secrets and backed up by the administrator before rotation. Losing it prevents recovery of stored provider tokens; reconnecting the provider is the recovery path. Local disconnect deletes credentials but may require provider-side revocation too.
Your contextual guide and voice
The Hearthstone guide uses prepared guidance and the authorized workspace context shown on your page. Its chat does not call a paid AI provider. Saving a request draft requires review and confirmation, and success is shown only after the backend responds. The guide cannot dispatch work, send messages, or make payments.
The microphone starts only when you press Microphone. Browser speech recognition depends on browser support and permission and may process audio through the browser provider. Stop ends recognition; Send is a separate step. No audio file is stored by this application. Typing remains available. Closing the panel cancels listening. Unsent guide input remains in memory. Private unsaved text and record answers clear when the authenticated role context is lost or changes; save a reviewed request draft explicitly to retain it on the server. Assistant answers are not stored in browser session storage. Review confirmation resets after navigation.
The legacy paid status-draft generation route is retired. Current premium reasoning, transcription and synthesis use separate bounded allowances: four lifetime Site slots and at most two per workspace for each operation. Failed or unknown attempts retain their reservations. Public visitors cannot invoke paid routes. Language switching and deterministic translated guidance never make a paid translation, reasoning or voice request. Internal deadlines and proposed calendar windows do not create external appointments or reminders.