Entity Scope & Architectural Principles
This Privacy Policy ("Policy") governs all digital touchpoints, services, desktop utilities, web applications, open-source repositories, and developer platforms operated by Bolt Corps("Bolt Corps", "we", "us", or "our"), including:
- LiveWire IDE & Polyglot WASM Lab
- Corpsian AI Studio 2.0 (BYOK Suite)
- FlowForge Encrypted Project Workspaces
- NovaBoard Studio & NovaSchema ERD Designer
- Cypher Serverless WebRTC Video Calls
- 37+ Developer Tools & Data Converters
Unlike legacy SaaS platforms that ingest user files onto centralized computing clusters, Bolt Corps utilizes an Edge & Client-First Architecture. Heavy computational pipelines (syntax compiling, schema migrations, image operations, cryptographic hashes, QR parsing, diff analysis) execute directly inside your browser sandbox via WebAssembly (WASM), Web Workers, and WebGPU shaders.
Legal Bases for Processing (GDPR Article 6)
In compliance with the General Data Protection Regulation (Regulation (EU) 2016/679) and equivalent global data privacy frameworks (UK GDPR, Swiss FADP, Brazilian LGPD), we process personal data strictly pursuant to the following lawful bases:
1. Contractual Necessity (Art. 6(1)(b) GDPR)
Processing necessary to provision your developer account, grant authenticated access to persistent boards, verify login status via Firebase Auth, and provide our software features as agreed upon in our Terms of Service.
2. Legitimate Interests (Art. 6(1)(f) GDPR)
Processing necessary for safeguarding platform integrity, mitigating DDoS attacks, verifying community forum submissions against spam, monitoring aggregate capacity, and diagnosing browser client runtime exceptions.
3. Explicit Consent (Art. 6(1)(a) GDPR)
Where applicable, such as subscribing to technical community newsletters, opting into optional beta telemetry, or submitting community speaker applications.
4. Legal Obligation (Art. 6(1)(c) GDPR)
Fulfillment of statutory accounting obligations, anti-fraud standards, or lawful compliance requests from verified law enforcement authorities.
Data Processing Matrix & Zero-Knowledge Boundary
To provide radical transparency, we differentiate between data transmitted to cloud storage versus data that remains strictly confined to your client device:
| Data Category | Processing Location | Storage Engine | Encryption Status |
|---|---|---|---|
| OAuth Profile (Name, Email, Avatar) | Cloud Server | Firebase Auth / Firestore | TLS 1.3 & AES-256 (At-Rest) |
| LiveWire Source Code & Files | Client-Side Device Only | IndexedDB / Browser Memory | Never Transmitted to Cloud |
| FlowForge Project Boards & Cards | Client + Cloud Sync | Supabase (Encrypted Blobs) | Zero-Knowledge AES-256-GCM |
| BYOK AI Provider API Keys | Client-Side Device Only | Browser localStorage | Never Logged by Bolt Corps |
| NovaBoard Sketches & NovaSchema ERDs | Client-Side Device Only | HTML5 Canvas / Local Storage | Never Transmitted to Cloud |
| Developer Forum Posts & Comments | Cloud Server | Firebase Firestore | TLS 1.3 (Public by Design) |
| Route Popularity Counter | Cloud Server | Firestore page_stats | Anonymous Atomic Increment |
Corpsian AI Studio 2.0 & BYOK Zero-Telemetry
In Corpsian AI Studio 2.0, we reject the conventional predatory paradigm of proxying your artificial intelligence calls through surveillance backends. We enforce an uncompromising zero-telemetry, zero-retention standard:
Your personal API keys (OpenAI, Google Gemini, Anthropic Claude, Groq, OpenRouter, Mistral, DeepSeek, Ollama) are stored exclusively in your browser’s isolated local storage. They are never sent to Bolt Corps servers.
Prompts, temperature parameters, and generated code artifacts dispatch directly from your client browser to the upstream provider endpoint via HTTPS TLS 1.3. Bolt Corps acts as zero-proxy.
When utilizing WebLLM (e.g. Qwen2-0.5B-Instruct), weights load into your device’s GPU VRAM through WebGPU shaders. Inference operates 100% offline without dispatching a single network packet.
LiveWire IDE, WASM Lab & Sandbox Privacy
LiveWire IDE and the WASM Polyglot Lab represent a breakthrough in decentralized developer tooling. Traditional web IDEs dispatch your source code to remote Docker containers on cloud clusters. Bolt Corps does the opposite:
- In-Browser Interpreters: Python executes locally via
Pyodide(compiled to WebAssembly). C++ scripts compile through in-browser Clang/WASM runtimes. PHP runs viaphp-wasm. React and HTML/CSS run inside isolated sandbox<iframe>containers with restricted cross-origin policies. - Zero Code Telemetry: Code scripts, variables, terminal outputs, and file hierarchies remain locked in your browser’s client memory space (
IndexedDB). - No Persistent Network Sniffing: LiveWire sandbox execution cannot read your local disk files without your explicit HTML5 File System Access API confirmation.
FlowForge Zero-Knowledge AES-256 Encryption
Collaborative project management platforms routinely leave sensitive sprint notes, API tokens, and architectural secrets unencrypted in centralized SQL databases. FlowForge changes this paradigm through mathematical zero-knowledge cryptography:
- When you establish or enter a FlowForge workspace, an AES-256-GCM cryptographic key is derived client-side from your workspace passphrase using PBKDF2/SHA-256 key stretching.
- Before any card title, description, sprint milestone, or column title is synchronized across the network to Supabase, it is encrypted into an opaque ciphertext payload.
- The encryption key is never transmitted to Supabase, Bolt Corps servers, or any third party.
- The cloud database only ever holds unreadable ciphertext strings. Even in the theoretical scenario of a database breach or unauthorized government subpoena, only encrypted ciphertext blobs would be produced.
* Note: Because FlowForge is truly zero-knowledge, Bolt Corps does not possess master recovery keys. If you lose your private workspace passphrase, your board data cannot be recovered.
Cypher Peer-to-Peer WebRTC Audio/Video
Cypher and LiveWire Pair Programming deliver video, audio, and screen sharing using decentralized serverless WebRTC connections:
- BitTorrent DHT Signaling: Signaling handshakes are facilitated peer-to-peer using Trystero over BitTorrent DHT network swarms. No media streams pass through a central media MCU or SFU server owned by Bolt Corps.
- DTLS-SRTP End-to-End Encryption: Audio frames, webcam video feeds, and code-sharing data channels are encrypted end-to-end between participating peers using standard WebRTC DTLS-SRTP cryptographic handshakes.
- Zero Call Archival: Bolt Corps does not record, listen to, transcribe, or retain audio, video, or in-meeting text chat messages.
37+ Developer Tools & In-Memory Computation
Our comprehensive suite of 37+ developer utilities operates under a strict "zero-server-transmission" principle:
JSON Studio & JWT Inspector
Cryptographic tokens, claims, and JSON payloads are inspected and formatted solely inside JavaScript V8 heap memory.
Webhook Inspector & HMAC Verifier
Simulated payloads and HMAC-SHA256 signatures are calculated locally using the browser’s native SubtleCrypto Web API.
CertDecoder & ByteForge Hex Dump
X.509 PEM certificates, SAN records, and binary hex files are decoded via client-side ASN.1 parsers without network transmission.
TableCraft, CodeDiff & Chmod
CSV conversions, Longest Common Subsequence line diffs, and Linux permission octals compute instantaneously on your CPU.
Authorized Subprocessors & Third-Party APIs
We partner exclusively with enterprise infrastructure providers that adhere to rigorous security standards (SOC-2 Type II, ISO/IEC 27001):
| Subprocessor | Corporate Purpose | Data Handled | Security Certs |
|---|---|---|---|
| Google Cloud / Firebase | Auth & Community Firestore | User profiles, forum threads | SOC 1/2/3, ISO 27001 |
| Supabase Inc. | FlowForge Sync Engine | Ciphertext blobs (Zero-Knowledge) | SOC 2 Type II, HIPAA |
| Vercel Inc. | Edge CDN & Platform Hosting | HTTP request routing, IP routing | SOC 2 Type II, ISO 27001 |
| Cloudflare Inc. | DDoS Protection & DNS | Encrypted Edge Transit | SOC 2, ISO 27701 |
International Transfers & Data Sovereignty
Bolt Corps operates a globally distributed edge footprint. If your data originates within the European Economic Area (EEA), United Kingdom, or Switzerland and is transferred to servers outside your jurisdiction:
- We rely on the European Commission’s Standard Contractual Clauses (SCCs) pursuant to Commission Implementing Decision (EU) 2021/914.
- Where relevant, transfers adhere to the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and UK Extension.
- Technical supplementary measures (AES-256 client-side encryption and zero-knowledge architecture) ensure foreign authorities cannot access decipherable contents.
Data Retention Schedules & Account Purging
We adhere to strict data minimization schedules:
- Authenticated Profiles: Preserved while your account is active. Upon account deletion request, user profiles and associated private tokens are permanently purged within 30 calendar days.
- Community Forum Posts: Preserved as part of the public developer knowledge graph. If you request account erasure, you can elect to redact posts or pseudonymize author attribution to
"[Deleted User]". - Anonymous Page Telemetry: Aggregated rolling counters retained indefinitely as non-identifiable numerical operational metrics.
Your Statutory Rights (GDPR, CCPA/CPRA, LGPD)
Regardless of your geographic location, Bolt Corps extends tier-one privacy protections to all developers:
Request a complete JSON machine-readable export of all profile records and community contributions linked to your identifier.
Permanently delete your profile and authentication records from all databases and production backups.
Update outdated profile metadata, display names, or linked developer URLs at any time in your settings.
We do NOT sell personal data or share data for cross-context behavioral advertising. You enjoy full non-discrimination rights.
Technical & Organizational Safeguards (TOMs)
Bolt Corps implements industry-leading security controls designed to preserve the confidentiality, integrity, and availability of our systems:
- Encryption in Transit: All HTTP traffic is enforced over TLS 1.3 with strict HTTP Strict Transport Security (HSTS) headers.
- Encryption at Rest: Cloud data is protected by AES-256 server-side encryption, augmented by FlowForge client-side zero-knowledge encryption.
- Content Security Policy (CSP): Hardened CSP headers to mitigate Cross-Site Scripting (XSS), clickjacking, and injection vectors.
- Continuous Vulnerability Audits: Automated dependency scanning, static code analysis (SAST), and continuous integration vulnerability gates.
Minors & Children's Online Privacy (COPPA)
Our services are engineered exclusively for software engineers, designers, and developers aged 16 and older (or 13 where permissible by local law). We do not knowingly solicit or collect personally identifiable information from children under 13 (or under 16 in the European Union). If we discover that personal data from a child has been collected without verified parental consent, we take immediate steps to permanently delete that information.
Policy Amendments, DPO & Contact Information
We may revise this Policy periodically to reflect new developer tools, infrastructure upgrades, or evolving legal mandates. Material amendments will be highlighted via platform notifications or direct email alerts to registered developers. Continued engagement with Bolt Corps after changes take effect indicates acceptance.
Data Protection Officer & Legal Operations
To exercise your GDPR/CCPA rights, request an account data purge, or submit inquiries to our Data Protection Officer: