Privacy and security
A chat keeps conversations, which are often the most sensitive data an application has. June itself has no service: nothing goes to June. What leaves your machine goes to the providers your chat calls, and what's stored goes to the store you chose.
| Data | Sent externally when | Stored by June when |
|---|---|---|
| user input and the context | every turn, to the model a model chat calls, or wherever a workflow chat's steps send it | the store appends turn.accepted, before the responder runs |
| the reply | on later turns, as part of the context | the turn completes: turn.completed. Streamed text that never became a reply isn't stored |
| feedback and preferred edits | never by June; only if your app later sends them to a trainer, eval target or model | session.feedback() appends feedback.recorded |
| instructions | every turn, as a model chat's system prompt | never; they're configuration |
| tool inputs and outputs, the trace | whenever a workflow chat's tools and providers send them | never; only provenance: responder kind, id and version, model, usage, finish reason |
earlier turns, for summaryContext() | to the summarizer model, which may be another provider | never; summaries are kept in memory only |
API keys, auth headers and raw provider requests and responses are never stored. Each provider's own terms govern what it keeps of what it's sent. Security and privacy covers the rest of June.
What's on disk
With fileStore(), the journal is the only thing written: one plain, unencrypted JSON lines file per session. It creates its directory readable only by its owner (0700) and each journal as 0600, where the platform supports it; a directory that already exists keeps its permissions. A journal holds tool inputs and outputs only where a reply itself quotes them. Treat .june/ as sensitive and keep it out of version control:
# .gitignore
.june/Nothing in a journal is deleted or rewritten by June. To forget a session, delete it from your store: for fileStore(), its <session id>.jsonl file.
Your own stores
A database or cloud ChatStore is responsible for its own access control, encryption and retention. June stores what it's given and doesn't authenticate who reads a session. Chat has no notion of users: before your application opens a session for someone, it decides whether they may.
Feedback and training
Feedback is written by people and can contain anything, including personal data. A preferred edit can carry a mistake or something private, and every conversation went to whatever model answered it. Review what you're about to train on before training on it; see Learning from chat.
Tools and retries
Approvals in a workflow chat go through the runtime's own approvals: june chat and june ask ask before a tool that needs approval runs, and deny it when there's no one to answer. Retrying a turn runs its tools again, sending their inputs out again; see Side effects happen again.