PRIVACY_POLICY_DRAFT.md

# Privacy policy draft

## Scope

Defensive OSINT Toolkit is a skills-only plugin. It provides instructions to ChatGPT and does not operate a developer-controlled server, user account system, analytics service or external database.

## Developer data collection

The plugin does not transmit conversation content to a server operated by the publisher. The publisher does not receive or retain user prompts, files or outputs through the plugin. ChatGPT processes information under the terms and privacy controls applicable to the user's OpenAI account or workspace.

## Information users should not provide

Users must not provide passwords, API keys, authentication tokens, payment-card data, protected health information, government identifiers, unlawfully obtained personal data or material they are not authorised to share. The plugin instructs ChatGPT to minimise personal data and redact unnecessary identifiers from outputs.

## Intended processing

The plugin is intended to analyse user-supplied security documentation, inventories, configuration summaries, public-source evidence and already-sanitised findings. It is not intended to identify, monitor or profile private individuals.

## Retention and deletion

The publisher retains no plugin data because the plugin has no publisher-operated backend. ChatGPT conversation retention and deletion are controlled through the user's OpenAI account or workspace settings.

## Publisher action before publication

Publish this policy at a stable public HTTPS address, add an effective date and a monitored privacy contact, and verify that it accurately reflects the final released package and support process.