SemperScribe Privacy and Security Notice

Last reviewed: 2026-07-22. Document version: 1.1.

Return to the application

1. Status of This Application

SemperScribe is a non-official Proof of Concept (PoC) maintained on a personal basis. It is not official USMC, DON, or DoD software. It does not carry an Authority to Operate (ATO). Use is at the user's discretion and risk.

2. What the Application Processes

SemperScribe processes only the text that the user enters or imports into the in-browser form. All document formatting occurs locally within the browser, and the formatter performs no server-side processing of user input. The optional GunnyBot assistant is the sole exception, described in Section 5A.

3. What the Application Does Not Do

The following statements describe the document formatter. The optional GunnyBot assistant is the single exception and is covered in Section 5A.

  • The formatter transmits nothing. No document, and no part of one, reaches any system the operator controls.
  • The application emits no telemetry, no analytics, and no usage beacons to any third-party host at runtime.
  • The formatter calls no backend, database, or external API at runtime. GunnyBot, when the user enables it, calls the user's chosen provider directly, per Section 5A.
  • The application sets no third-party cookies. The GunnyBot API key is held in session memory, not local storage, and clears when the tab closes.

Two claims left this list on 26 August 2026 because they were not true. It said the formatter does not store PII and does not process CUI. It does both, on the user's own machine: what the user enters is written to browser storage, and the application reads and formats it. What it does not do is send any of it anywhere. Section 3A states what persists and where.

3A. What Persists, and Where

Everything below is written to the browser profile on the computer the application is opened on. None of it leaves that computer.

  • Saved drafts, in the IndexedDB database named semperscribe, object store documents. Each carries the full contents of the document.
  • Files bound to a document, in the enclosureFiles store. This includes an uploaded NAVMC 10132, retained in full so later exports write into the signed original rather than a copy of it. A signed unit punishment book runs to several megabytes and carries the accused's name and DoD ID.
  • Application settings and the unit profile, in the settings store and in local storage.

Clearing the form, or starting a new case, deletes the uploaded file and resets the document. Deleting a document from the library removes it and its bound files. Neither reaches any other copy the user has made, including exported PDFs saved elsewhere on the computer.

Because this persists on the user's own machine, the machine is what has to be approved for the information entered. A government furnished workstation already accredited for a Marine's service record is approved for a document drawn from it. A personally owned computer is not.

4. User Responsibilities

The application has no technical mechanism to recognize or reject sensitive input, and does not attempt one. The user decides what to enter, on a computer approved for it, and bears sole responsibility for the content they enter and the use they make of generated output.

Two features move a document off the computer, and each warns where it is used rather than here. GunnyBot sends what the user submits to the provider the user configured, per Section 5A. A share link carries the whole document inside the link itself, so the document travels wherever the link travels.

5. Outbound Network Calls

At build time, the static export downloads webfont files via Next.js's font/google loader and bundles them with the output. At runtime, the browser fetches only assets served from the same origin as the application, with one exception: when the user enables GunnyBot, the browser also contacts the user's chosen LLM provider, per Section 5A. Reference: Phase 2 of docs/COMPLIANCE_REMEDIATION_PLAN.md.

5A. The GunnyBot Assistant

SemperScribe includes an optional AI assistant, GunnyBot, which stays off until the user supplies a personal LLM provider API key. When the user enables it and uses a GunnyBot feature (a format or policy question, a proofreading review, a paragraph rewrite, or a drafted paragraph), the text the user submits to it leaves the browser and goes directly to the user's chosen provider, Google or GenAI.mil, under the user's own key. The provider processes that text under the provider's own terms and privacy policy, outside SemperScribe's control.

The API key is held in browser session memory only. It clears when the tab closes, is never written to disk, and is never sent to any SemperScribe-controlled host. GunnyBot output is advisory only. The user reviews and accepts any change, and nothing is written to the document automatically.

Before any GunnyBot feature sends text, the application scans it in the browser for two high-confidence structured identifiers, the Social Security number digit pattern and the ten-digit EDIPI. A match opens a consent prompt naming the finding, and the send proceeds only if the user acknowledges it. This scan runs on all four GunnyBot paths and never leaves the browser. It is a narrow tripwire, not a certification: it does not detect CUI, PHI, classification markings, or any identifier outside those two patterns, and it produces occasional false matches on unrelated ten-digit numbers. GunnyBot applies no attestation prompt beyond this. The user remains solely responsible for not submitting CUI, PII, PHI, or classified text to GunnyBot.

6. Output as Federal Record

When a user takes a document generated by SemperScribe and uses it to transact official business, that document becomes a Federal record under 44 USC 3301. Records management is the user's responsibility through their Command Designated Records Manager per MCO 5210.11F. SemperScribe does not perform records-management functions and is not registered as an Electronic Information System (EIS).

7. Privacy Act Posture

Because the application does not collect or maintain a system of records, the Privacy Act of 1974 (5 USC 552a) does not apply to SemperScribe as operated. The application is also not registered under any System of Records Notice (SORN). If a user enters real PII into the form, the user assumes any resulting Privacy Act obligations personally. See SECNAVINST 5211.5F paragraph 5b for context on DON privacy responsibilities.

8. Security Posture

The application is statically exported and hosted on GitHub Pages. It has no backend. There is no authentication, no session management, and no server-side state. Browser security is the user's first and last line of defense. For vulnerability reporting, see the SECURITY.md document at the repository root.

Having no backend is not the same as nothing being logged. GitHub serves the pages and sees the request for each one, including the full address requested. Anything placed in a URL by this application therefore reaches a third party's logs. Share links are built so the document rides in the fragment after the #, which browsers do not send to the server, rather than in the query string, which they do. Links created before 26 August 2026 used the query string and their contents reached those logs.

9. Compliance References

  • Privacy Act of 1974, 5 USC 552a.
  • 44 USC 3301, Definition of Records.
  • SECNAVINST 5211.5F, DON Privacy Program, 20 May 2019, paragraph 5b.
  • MCO 5210.11F, Marine Corps Records Management Program, 7 April 2015.
  • MCO 5211.5, USMC Privacy Program, 28 August 2024.
  • DoDI 5200.48, Controlled Unclassified Information, 6 March 2020.
  • NIST SP 800-218 (SSDF v1.1), practices PO.5.1 and PS.1.

10. Updates to This Notice

This notice is reviewed when material changes to the application's data handling occur. The Last reviewed date at the top reflects the most recent review. Substantive revisions also bump the Document version field.