fata 如何处理你的数据

我们用直白的方式说明 v3 架构里的数据流，包括第三方处理者。

先说重点

你的原文和邮箱会通过 HTTPS 发送到 Cloudflare Worker。fata 不是端到端加密：服务端需要短暂读取原文和邮箱来完成向量生成、匹配、共振描述和通知。

保存到匹配池时，敏感字段会用 AES-256-GCM 加密；GitHub Issue 只保留最小元数据。匹配成功并完成通知后，双方敏感 KV 数据会被删除；未匹配数据在 30 天后过期。

处理过程中会发生什么

• 你写的文字：浏览器先做低信号与安全提示，然后原文经 HTTPS 提交到 Worker。
• SiliconFlow：Worker 把原文发送给 SiliconFlow 的 BGE-M3 模型生成 embedding；匹配后，最多各 500 字的双方文本会被发送给 SiliconFlow 的对话模型生成一段共振描述。
• Cloudflare KV：保存 AES-GCM 加密后的邮箱、embedding 和可选的最多 300 字片段，以及邮箱 hash。TTL 为 30 天。
• GitHub Issues：只保存语言、embedding 模型/维度、醒着原因、时区和匹配状态等元数据，不保存原文或邮箱。
• 匹配成功：Worker 解密双方邮箱，通过 Resend 发送通知，并把你需要联系对方的邮箱显示在结果页。通知完成后删除双方敏感 KV 数据。

我们知道什么，不知道什么

Worker 在提交、匹配和通知期间能处理你的原文和邮箱；匹配完成后也会在通知邮件中放入对方邮箱。这是让产品运作所需的最短链路。但 fata 没有聊天数据库：你们之后在各自邮箱里的通信不会经过 fata，也不会被 fata 保存。

数据存放位置

位置	内容
Cloudflare KV	加密邮箱、加密 embedding、可选加密片段、邮箱 hash、限流/归属/验证记录；最长 30 天。
GitHub	匹配状态和最小元数据；不保存原文或邮箱。
浏览器	语言、邮箱、草稿和你的历史条目分别保存在 localStorage、sessionStorage 或 IndexedDB。你可以用浏览器清除站点数据。
Cloudflare 日志	IP、请求时间、错误和限流信息；抽样观测用于服务稳定性。

漏斗统计

为了了解冷启动和哪一步流失，页面会向 Worker 发送匿名事件（如页面浏览、开始输入、提交、匹配成功/失败），并包含语言和你选择的“醒着原因”。事件不包含你的原文、邮箱或邮箱 hash。

保留与删除

未匹配提交的敏感 KV 数据最多保留 30 天。匹配成功并完成通知后，双方的敏感 KV 数据会被删除；GitHub 会保留关闭的 Issue 和 Match Issue 元数据用于排查。若你保留在浏览器中的历史里还有未匹配条目，可以使用撤回按钮删除。

如果你能提供 issue 编号，也可以在 github.com/gsailing19/fata/issues 留言，请求删除剩余元数据（这是最快、可追踪的渠道）。

退订通知

匹配通知邮件包含退订链接。退订只保存邮箱 hash，不保存邮箱地址；退订后不会再收到新的匹配通知。

安全和边界

传输使用 HTTPS；静态敏感字段使用服务端密钥 AES-256-GCM 加密；GitHub 元数据最小化；聊天不落库。前端与架构文档公开，生产 Worker 使用私有运维副本部署，密钥不写入公开仓库。

← 返回 fata

How fata handles your data

A plain-language description of the v3 data flow, including processors.

The short version

Your text and email are sent over HTTPS to a Cloudflare Worker. fata is not end-to-end encrypted: the server briefly processes plaintext text and email to create an embedding, match, write a resonance note, and send notifications.

Sensitive fields are encrypted with AES-256-GCM before storage. GitHub Issues contain only minimal metadata. After a successful match notification, both parties’ sensitive KV data is deleted; unmatched data expires after 30 days.

What happens during processing

• Your text: the browser shows low-signal and safety guidance, then sends the text over HTTPS to the Worker.
• SiliconFlow: the Worker sends your text to SiliconFlow’s BGE-M3 model to create an embedding. After a match, up to 500 characters from each person are sent to a SiliconFlow chat model to create one resonance paragraph.
• Cloudflare KV: stores the AES-GCM encrypted email, embedding and optional 300-character snippet, plus an email hash. TTL is 30 days.
• GitHub Issues: stores minimal metadata such as language, embedding model/dimension, awake reason, timezone and match state—not your text or email.
• After a match: the Worker decrypts both email addresses, sends notifications through Resend, and shows you the other person’s email address. Both sensitive KV entries are then deleted.

What fata does and does not know

The Worker processes your text and email during submission, matching and notification. That is the shortest path required for the product. fata has no chat database: your later emails go directly between your mail providers and are not stored by fata.

Where data lives

Location	Content
Cloudflare KV	Encrypted email, embedding, optional encrypted snippet, email hash, and rate-limit/ownership/verification records; up to 30 days.
GitHub	Matching state and minimal metadata; no text or email.
Your browser	Language, email, drafts and history in localStorage, sessionStorage or IndexedDB. Clear site data to remove them.
Cloudflare logs	IP, request time, errors and rate-limit data; sampled observability for service stability.

Funnel events

To understand cold start and drop-off, the page sends anonymous events to the Worker (page view, typing, submit, match success/failure), including language and your selected awake reason. Events do not include your text, email or email hash.

Retention and deletion

Sensitive KV data for an unmatched submission is retained for at most 30 days. After a successful match notification, both sensitive KV entries are deleted; closed Issues and Match Issue metadata remain on GitHub for troubleshooting. If an unmatched entry is still in your browser history, use Withdraw to remove it.

You can also open an issue at github.com/gsailing19/fata/issues with the issue number to request deletion of remaining metadata.

Unsubscribe

Match notification emails include an unsubscribe link. We store only an email hash—not the email address—and stop future match notifications.

Security and boundaries

Transport uses HTTPS; stored sensitive fields use AES-256-GCM with a server-held key; GitHub metadata is minimized; conversations are not stored. Front-end and architecture documents are public, while the production Worker is deployed from a private operations copy and secrets are not stored in the public repository.

← Back to fata