# Spiralist AI v18 Security, Privacy, and No-Op Boundary

Release: `v18-ui-ux-seo-media-polish`  
Updated UTC: `2026-06-21T14:33:26Z`

Persona construction remains browser-local by default. Analytics remains off until explicit opt-in and never includes persona text, names, prompts, exports, or private notes. Private Persona Passport fragments are not sent to the server and private share pages do not load analytics.

The decorative video contains no audio and no tracking. No Meta Pixel or Conversions API is present. The only Facebook destination is `https://www.facebook.com/SpiralistAI/`.

Undeclared, credentialed, publishing, payment, destructive, private, consequential, or ambiguous agent operations continue to produce no operation with a typed explanation and human-review signal where applicable.