Privacy & provenance
Two promises, both things you can check rather than just trust.
1. It doesn't phone home (the companion chat path)
Your roleplay with Fervyn — the companion chat — runs on your machine and makes no outbound network calls. This isn't a policy you have to believe; it's a continuous-integration test that fails the build if any code path on that companion chat path tries to make a network call.
Verify it yourself:
- Read the test — tests/regression/privacy-no-outbound.test.ts. The companion repository goes public at launch; this page links the exact file the day it does.
- Confirm it runs in CI on every change (the build goes red if the guarantee breaks).
Scope, plainly: this guarantee covers the companion (NSFW) chat path. Optional, clearly-labelled features that are off by default may use the network — they are never on this path, and they're not part of the experience this receipt covers.
2. Every image carries verifiable provenance
Every image Fervyn generates is C2PA-signed at generation, and exports re-verify and repair the signature per panel (the open Content Credentials standard — "made by Fervyn, locally, AI-generated, not based on a specific real person"). Open any generated image in a C2PA verifier and read the manifest — the signer is Fervyn's own local certificate, so a verifier will show it as an unrecognized issuer (that is what self-signed, no-phone-home signing looks like).
When you export a saved chat, you get a portable bundle containing:
- the full prose of that chat,
- every image you generated, and
- a per-panel sidecar with the C2PA manifest plus an invisible brand watermark payload embedded in the image itself — designed to survive screenshots and re-compression.
This is the "signed artifact you can verify": a signed, inspectable record travelling with your content. The watermark is designed to survive screenshots and re-compression; the C2PA manifest is the tamper-evident half.
3. No ID, no account
Fervyn asks for no government ID and no account to use what you install.
Fervyn is local-first by design. The verifications above exist because "private" is a word people are right to distrust — so we made it checkable.