Core: Model training opt-in/out by data domain (exclude PII and Digital You)

[ReBoticsAI]

Summary

Ship per-domain controls so ReBotics can optionally use non-PII, non–Digital You platform/product data to improve GodMode models, while giving users clear opt-in/out choices before any training on workspace content begins.

Privacy Policy (effective 2026-07-28) states we do not currently operate public foundation-model training on customer content, and that training on workspace content will not begin until opt-in/out controls exist. This issue is the implementation track for those controls.

Scope

In scope (candidate domains for toggles)

• Aggregate / operational product telemetry (first-party metrics, platform request logs, coarse plugin telemetry in tenant analytics DuckDB)
• Optional workspace content categories that are not PII and not Digital You (exact categories TBD; e.g. anonymized product usage patterns, non-personal structural signals)
• GodMode-operated model improvement paths (when GodMode Inference / first-party models exist)

Hard exclude (never trainable; not opt-in-able)

• PII and account identity fields
• Digital You agent memory, persona, twin profiles, and related Digital You store contents
• Anything we cannot confidently classify as non-PII / non–Digital You without a documented review

Out of scope for v1

• Training public third-party foundation models on customer content for unrelated parties
• Policing all user-uploaded wiki/notes content for child data (user responsibility remains)

Acceptance criteria

• Per-area (domain) toggles for training eligibility, documented in product UI and Privacy/Terms
• Safe defaults: no training on workspace content until the user has an explicit choice (opt-in or documented opt-out with clear pre-start notice; prefer opt-in for workspace content)
• Hard-coded exclusion of PII and Digital You data paths from any training pipeline
• Audit trail: when a domain is enabled/disabled, who/when, and which data categories are included
• Privacy Policy and Terms stay in sync with shipped behavior (no promising UI that does not exist)
• Admin/operator docs for what enters training corpora vs operational logs only

Related

• Existing training/persona productization: Productize training / persona adapters (Unsloth-oriented) #77
• Privacy Policy marketing page (MarketingPrivacy.tsx) references this roadmap item