# SHIRE3D / Kitchen Hero Privacy Boundary — v1.3.0

## Product sources allowed

The product-sync service may issue public, read-only HTTP GET requests only to the fixed SHIRE3D source hosts coded in `server.js`:

- `shire3d.com` and `www.shire3d.com`
- `shire3d.com.au` and `www.shire3d.com.au`
- `etsy.com` and `www.etsy.com`, limited to the configured public SHIRE3D shop and discovered listing pages

There is no arbitrary-URL product endpoint.

## Social authorization allowed

The Accounts screen may redirect Ray to the official authorization endpoints for Facebook, Instagram, LinkedIn, TikTok and Google/YouTube. The callback returns only to the local Forge server on `127.0.0.1:4173`.

The Forge must never collect a social password. Developer secrets are configured outside the browser. On Windows they are encrypted for the current Windows user using DPAPI. OAuth tokens are held in server memory only in v1.3.0 and are destroyed when the server closes.

Developer secrets and OAuth tokens must never be placed in:

- browser local storage;
- Forge JSON exports;
- `catalog-cache.json`;
- product or campaign records;
- audit event text;
- screenshots or support bundles.

## Kitchen Hero prohibited data

The Forge must not request, import, infer or store Kitchen Hero repositories, databases, recipes, households, users, customers, subscriptions, Stripe information, analytics, images, brand assets, social accounts, credentials or API keys.

## Other prohibited data

Product sync does not request SHIRE3D customer records, Etsy orders, addresses, messages, seller sessions, payment information or private analytics.

Social account connection does not authorize ingestion of private messages, contacts, orders, ad audiences or customer databases. Only the minimum scopes configured for identity and future approved publishing may be requested.

## Network boundary

`server.js` binds to `127.0.0.1` only. It does not expose the Forge to the LAN or internet. OAuth callbacks are received only on the local machine.

## Stored operational data

Browser local storage may contain public product details, Ray's local production details, draft campaigns, approvals, queue records, controls and audit events.

`catalog-cache.json`, when present, contains only public storefront results and timestamps.

`social-oauth.secure.json`, when created on Windows, contains developer IDs and DPAPI-encrypted developer secrets. It is excluded by `.gitignore` and must not be redistributed.

## Marketing authority

Website sync and social login do not approve or publish marketing. SHiRE may prepare drafts across every live product, but Ray Morrison remains the sole approval authority. The live posting APIs remain disabled in v1.3.0; the publishing queue is controlled test mode.
