Privacy and data handling

Core browser and local tools

Files selected at deepbom.org and files read by the CLI or local MCP are analyzed on the user's device. The core audit does not upload model bytes, tensor values, inputs, outputs, or generated reports to the DEEPBOM service.

ChatGPT integration

A file attached to ChatGPT is already handled by ChatGPT under the user's OpenAI terms and settings. The DEEPBOM component obtains a temporary, plugin-authorized download URL and reads the attachment inside the ChatGPT browser sandbox. The DEEPBOM service does not fetch or retain the file. The component sends a bounded analysis result through the DEEPBOM MCP endpoint for schema validation and returns a bounded result to the conversation. That result can contain the filename, file and evidence hashes, artifact format and byte length, bounded operation or storage names, dtypes and shapes, predecessor references, tensor or operator counts, encoding and quantization summaries, findings, and evidence boundaries. It does not contain model bytes or raw tensor values.

The component also generates Model IR diagrams, Word-ready bundles, CycloneDX evidence, and SPDX inventories in the browser. Send PNG to chat explicitly shares a selected derived image with ChatGPT. Save via ChatGPT uploads the selected generated export to ChatGPT to obtain a download link, and Send link to chat requests a reply containing that link. These actions do not upload the original model artifact to DEEPBOM. Retention and deletion of generated files in ChatGPT follow the user's OpenAI conversation and workspace controls.

Use the local CLI or local MCP instead when those result fields must not enter a ChatGPT conversation.

Data used and purposes

The ChatGPT plugin does not require a DEEPBOM account and does not use advertising cookies or cross-site tracking. The MCP service processes the bounded result only to validate its documented structure and return it to the requesting conversation. Application code does not intentionally write attachment URLs, request bodies, filenames, artifact hashes, model facts, or analysis results to server logs.

Cloudflare hosts the public site and MCP endpoint and processes ordinary request and security metadata needed to deliver and protect the service, such as request time, method, path, response status, network and approximate location metadata, and provider-generated request or trace identifiers. DEEPBOM uses that operational metadata only for availability, abuse prevention, security investigation, and fault diagnosis.

DEEPBOM also keeps daily aggregate MCP request, protocol-error, and tool-report counts, grouped by supported artifact format where available. These counters have no browser identifier and include tests and retries. They help monitor service use and reliability; they are not counts of people or independently verified analyses.

Optional ChatGPT and website usage statistics

Sharing is off by default. In the ChatGPT component or website analyzer's Optional usage statistics controls, you may choose to share counts for the current analysis and future visits. Analysis and exports work without this choice. After consent, the component creates a random browser key, retained in browser storage for up to 90 days. DEEPBOM receives that key over HTTPS and stores a keyed hash, rather than the key itself, alongside a random analysis-session ID, consent version, browser-or-session scope, the collection channel (ChatGPT or Web), and your public-use or test-use choice. Consent and random browser keys are separate for each channel; DEEPBOM does not link identities across channels. This is pseudonymous information, not a verified identity.

Allowed events are analysis start, completion or failure, report request, visualization view rendered, export prepared, and generated-file upload accepted by ChatGPT. Event records include the server receipt time, supported artifact format (or unknown), and an export type or visualization view where applicable. They exclude model bytes, filenames, artifact hashes, tensor values, download URLs, conversation text, names, email addresses, and IP addresses. No fingerprinting, website account identifier, or ChatGPT account identifier is used. Cloudflare may temporarily use network information to rate-limit requests; it is not a browser-identity input to these statistics.

We use these records to understand feature use, failures, adoption, and repeat visits. Administrators can view aggregate dashboards and export aggregate snapshots; we may publish aggregate adoption statistics without browser or session identifiers. Browser estimates cover consenting browsers only. Storage restrictions, multiple devices, deleted storage, opt-outs, and automated traffic affect estimates. Runs without persistent browser storage are excluded from unique- and returning-browser counts.

Sharing and sale

DEEPBOM does not sell personal data or analysis results and does not share them for advertising. OpenAI processes the attachment, temporary download authorization, conversation, and returned result under the user's OpenAI terms and controls. Cloudflare hosts the MCP service and usage database and processes operational metadata as the hosting and security provider. Apart from aggregate adoption statistics described above, DEEPBOM does not disclose plugin data to other third parties except when required by law or necessary to investigate abuse or security incidents.

Retention

Model bytes are not stored by the DEEPBOM service. Bounded analysis results are held only for the request needed to validate and return them and are not written to the DEEPBOM database. Their retention in ChatGPT follows the user's OpenAI conversation and workspace settings.

Cloudflare Workers invocation logs and traces can retain request and response metadata and errors for no more than seven days under the configured Cloudflare plan. Aggregated service metrics that do not contain model bytes or analysis results may be retained for up to three months. DEEPBOM does not export these logs to a separate analytics or advertising provider.

Usage sessions and linked events expire from dashboards after 90 days and are removed by a daily cleanup job. Physical deletion may take up to one additional day. The browser key expires after 90 days and requires renewed consent. Aggregate snapshots exported or published by DEEPBOM may remain available longer; they contain no browser or session identifiers and cannot be linked back for individual deletion.

User choices and controls

Users control whether to attach a file, invoke the plugin, download a generated export, or share it with ChatGPT. They can avoid placing model-derived metadata or images in ChatGPT by using the local CLI or local MCP and remove attachments or conversations using OpenAI's controls.

Uncheck Share usage statistics to stop future usage sharing. Delete my usage also deletes retained sessions and events associated with this channel’s browser key and removes the local key after the server confirms deletion. If deletion fails, sharing stays off and the control can be retried. Use deletion before clearing browser storage: without the key, DEEPBOM cannot identify your pseudonymous records and they expire under the retention schedule. Service-wide counters and already exported aggregate snapshots are not linked to a browser and are unaffected. The testing checkbox can reclassify this browser's retained usage so it is excluded from the public-use dashboard. Contact the support page for other privacy requests.

Package distribution statistics

The administrator dashboard can retrieve publicly available daily download counts for the deepbom npm package. Requests contain the package name and date range only, never model or browser identifiers. These counts can include automated downloads and local MCP installations; they are not people or CLI execution counts. CLI and local MCP do not transmit usage telemetry. Claude execution is not included in these usage statistics.

Optional DEEPBOM website services

Account, report-fingerprint registration, controlled research modules, and explicitly consented structural benchmark features on the separate DEEPBOM website are not used by the ChatGPT plugin. Their screens identify what is sent and the applicable control before the user proceeds. Core artifact analysis does not require them.

Contact

Privacy or security questions can be reported through the repository contact path listed on the support page.