# Privacy and security

A chat keeps conversations, which are often the most sensitive data an application has. June itself has no service: nothing goes to June. What leaves your machine goes to the providers your chat calls, and what's stored goes to the store you chose.

| Data                                  | Sent externally when                                                                     | Stored by June when                                                                        |
| ------------------------------------- | ---------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
| user input and the context            | every turn, to the model a model chat calls, or wherever a workflow chat's steps send it | the store appends `turn.accepted`, before the responder runs                               |
| the reply                             | on later turns, as part of the context                                                   | the turn completes: `turn.completed`. Streamed text that never became a reply isn't stored |
| feedback and preferred edits          | never by June; only if your app later sends them to a trainer, eval target or model      | `session.feedback()` appends `feedback.recorded`                                           |
| instructions                          | every turn, as a model chat's system prompt                                              | never; they're configuration                                                               |
| tool inputs and outputs, the trace    | whenever a workflow chat's tools and providers send them                                 | never; only provenance: responder kind, id and version, model, usage, finish reason        |
| earlier turns, for `summaryContext()` | to the summarizer model, which may be another provider                                   | never; summaries are kept in memory only                                                   |

API keys, auth headers and raw provider requests and responses are never stored. Each provider's own terms govern what it keeps of what it's sent. [Security and privacy](https://june.dev/docs/reference/security.md) covers the rest of June.

## What's on disk

With `fileStore()`, the journal is the only thing written: one plain, unencrypted JSON lines file per session. It creates its directory readable only by its owner (`0700`) and each journal as `0600`, where the platform supports it; a directory that already exists keeps its permissions. A journal holds tool inputs and outputs only where a reply itself quotes them. Treat `.june/` as sensitive and keep it out of version control:

```text
# .gitignore
.june/
```

Nothing in a journal is deleted or rewritten by June. To forget a session, delete it from your store: for `fileStore()`, its `<session id>.jsonl` file.

## Your own stores

A database or cloud `ChatStore` is responsible for its own access control, encryption and retention. June stores what it's given and doesn't authenticate who reads a session. Chat has no notion of users: before your application opens a session for someone, it decides whether they may.

## Feedback and training

Feedback is written by people and can contain anything, including personal data. A preferred edit can carry a mistake or something private, and every conversation went to whatever model answered it. Review what you're about to train on before training on it; see [Learning from chat](https://june.dev/docs/chat/learning.md#review-before-promotion).

## Tools and retries

Approvals in a workflow chat go through the runtime's own approvals: `june chat` and `june ask` ask before a tool that needs approval runs, and deny it when there's no one to answer. Retrying a turn runs its tools again, sending their inputs out again; see [Side effects happen again](https://june.dev/docs/chat/turns.md#side-effects-happen-again).