PRIVACY.md

Privacy and security

• A Static Hugging Face Space runs its data processing in your web browser. No custom server, user account, API key or paid model is required.
• The app makes outbound requests to api.worldbank.org only after the user clicks the live-data button. These requests disclose the selected country codes, indicator codes and date range, and the normal HTTP metadata of the visitor to that third-party provider.
• No analytics trackers, third-party UI script CDNs, authentication cookies, or intentionally submitted personal identifiers are included.
• Research sessions exported as JSON stay on the visitor's own device unless the user shares them.
• Imported JSON is parsed locally and filtered through a strict observation schema. It is not submitted to the World Bank. Data from imported JSON are not independently verified.
• A restrictive size limit applies when importing a session; users should still avoid loading private or confidential information into unknown or shared systems.
• Browser and Hugging Face platform hosting may have their own access logs or privacy policies. This document does not guarantee the absence of all network metadata collection.
• Do not place tokens, passwords, private educational records or proprietary datasets inside public repository files.