Privacy & provenance
Two promises, both things you can check rather than just trust.
1. It doesn't phone home (the companion chat path)
Your roleplay with Fervyn — the companion chat — runs on your machine and makes no outbound network calls. This isn't a policy you have to believe; it's a public continuous-integration test that fails the build if any code path on that companion chat path tries to make a network call.
Verify it yourself:
- Read the test in the open companion repository.
- Confirm it runs in CI on every change (the build goes red if the guarantee breaks).
Scope, plainly: this guarantee covers the companion (NSFW) chat path. Optional, clearly-labelled features that are off by default may use the network — they are never on this path, and they're not part of the experience this receipt covers.
2. Every image carries verifiable provenance
Every image Fervyn generates is C2PA-signed at the moment it's created (the open Content Credentials standard — "made by Fervyn, locally, AI-generated, not based on a specific real person"). Open any generated image in a C2PA verifier and read the manifest.
When you export a saved chat, you get a portable bundle containing:
- the full prose of that chat,
- every image you generated, and
- a per-panel sidecar with the C2PA manifest plus an invisible brand watermark payload embedded in the image itself — which survives screenshots and re-compression.
This is the "signed artifact you can verify": a signed, inspectable record travelling with your content. The provenance manifest is cryptographically signed; the watermark is robust and tamper-evident.
3. No ID, no account
Fervyn asks for no government ID and no account to use what you install.
Fervyn is local-first by design. The verifications above exist because "private" is a word people are right to distrust — so we made it checkable.