# Privacy and security

- A **Static** Hugging Face Space runs its data processing in your web browser. No custom server, user account, API key or paid model is required.
- The app makes outbound requests to `api.worldbank.org` **only** after the user clicks the live-data button. These requests disclose the selected country codes, indicator codes and date range, and the normal HTTP metadata of the visitor to that third-party provider.
- No analytics trackers, third-party UI script CDNs, authentication cookies, or intentionally submitted personal identifiers are included.
- Research sessions exported as JSON stay on the visitor's own device unless the user shares them.
- Imported JSON is parsed locally and filtered through a strict observation schema. It is not submitted to the World Bank. Data from imported JSON are **not independently verified**.
- A restrictive size limit applies when importing a session; users should still avoid loading private or confidential information into unknown or shared systems.
- Browser and Hugging Face platform hosting may have their own access logs or privacy policies. This document does not guarantee the absence of all network metadata collection.
- Do not place tokens, passwords, private educational records or proprietary datasets inside public repository files.