What this site measures

Pages are static and served from Firebase Hosting. There are no advertising trackers, no third-party embeds beyond the ones named here, and no cookies set by this site itself.

Mixpanel is loaded and records page views. Session recording is off and autocapture is off, so clicks, keystrokes and form contents are not collected, and text is masked at the library level as a second line of defence. It records the page you are on, a randomly assigned identifier, and what your browser reports about itself. It honours Do Not Track.

Fonts come from Google Fonts, which sees your address when a font is fetched.

The agent at /ask/ runs as a separate service and is shown here in a frame. What you type goes to that service, to Google's Gemini on Vertex AI, and to the Hammer world your question is answered from. Conversations are stored so that a follow-up can refer to the question before it.

It sets one cookie for a guest identity, and a second, encrypted, if you sign in. The encrypted one carries your access token to the world; the service keeps no copy of it. Both are marked Secure and partitioned, so the copy set inside this page's frame is separate from the one set on the agent's own address.

Do not paste anything about a patient into it. It is a demonstration over published records and carries no agreement covering personal health information.

Sign-in is handled by WorkOS AuthKit, which holds your account and issues the token the agent forwards. This site never sees a password. The number of questions you have asked is counted against your account identifier so a daily limit can be applied.

Write to hello@hammer.ai and say which address you signed in with. Conversations and counters tied to it will be sent to you or deleted.

The plugin's own privacy note, covering what the installed world receives, is in the plugin repository.