Privacy Policy

Last updated: 24 March 2026

    The short version: Carapace is built on the W3C Solid Protocol. Your data stays in your Solid Pod — we never see it, store it, or process it. This is not a privacy promise, it's an architectural fact.

1. How Carapace Works

Carapace is a static web application that runs entirely in your browser. When you use Carapace:

Your browser connects directly to a Solid server (e.g. crawlout.io)
You authenticate using Solid-OIDC (an industry-standard protocol)
Your work graph data is fetched from the Solid server to your browser
All processing happens client-side — in your browser, on your device

There is no Interition backend server involved in the data flow.

2. What We Collect

Data	Collected?	Detail
Your work graph data	No	Stays in your Pod, never reaches us
Your WebID	No	Used by your browser for auth, not sent to us
Authentication tokens	No	Stored in your browser's localStorage only
Usage analytics	No	No analytics, tracking, or telemetry
Cookies	No	Carapace sets no cookies

3. Browser Storage

Carapace stores the following in your browser:

localStorage: Your OIDC access token and WebID (to persist your session across page refreshes)
sessionStorage: Temporary OIDC state during the login redirect flow (cleared after login completes)

You can clear this data at any time through your browser settings. Logging out from Carapace clears it automatically.

4. Alpha: crawlout.io

Important: This alpha version of Carapace connects exclusively to crawlout.io, a Solid Pod server operated by Interition. While Carapace itself does not see or process your data, your data is stored on infrastructure we operate. Interition is therefore the data processor for Pod data held on crawlout.io.

The data sovereignty principles below still apply — your Pod data is yours, access-controlled by you, and stored in open W3C standards. However, as the server operator we do have access to the underlying storage and server logs. We will not access your Pod data without your consent except as required for server maintenance or legal obligation.

crawlout.io is a pre-production alpha service. It is not yet covered by a formal SLA, and data durability is not guaranteed. See crawlout.io for server-specific terms.

Future versions of Carapace will allow you to connect to any Solid server of your choice.

5. Third-Party Services

Carapace loads the following external resources:

Oxigraph WASM (from cdn.jsdelivr.net) — the in-browser SPARQL engine. jsdelivr's privacy policy applies.
crawlout.io — the Solid server you authenticate against, operated by Interition Digital Transformation Limited.

6. Data Sovereignty

The Solid Protocol is designed around data sovereignty — you choose where your data lives and who can access it. Carapace respects this principle:

We cannot read your data unless you grant us access (we don't ask for it)
We cannot delete, modify, or lock you out of your data
If you stop using Carapace, your data remains in your Pod, accessible via any Solid-compatible tool
There is no vendor lock-in — the data format (RDF/Turtle) is an open W3C standard

7. GDPR

For data stored on crawlout.io, Interition is the data processor. You are the data controller — you decide what data to store and who can access it via Solid access control. For any data protection requests or privacy questions: paul.worrall@interition.com

8. Children

Carapace is a professional work management tool. It is not intended for use by children under 16.

9. Changes

We may update this policy as Carapace evolves. Changes will be reflected in the "Last updated" date above.