> For AI agents: the complete documentation index is available at /mbzoo/docs/llms.txt, the full documentation bundle is available at /mbzoo/docs/llms-full.txt.

# Privacy

**Nothing you open in MBZoo leaves your device.**

- The viewer is a static web application. Backups are read with the browser
  File API and parsed inside a Web Worker on your machine. There is no upload
  path — no backend, no telemetry, no analytics.
- The CLI reads local files only.
- External resources referenced by course content are not fetched
  automatically. Course links that Moodle rewrote into `$@…@$` tokens are
  decoded and offered as links, never requested (ADR-0019). If a future
  feature needs network access, it will be opt-in and documented here first.

This is a product property enforced by architecture (static deployment, no
server code), not just a policy statement.

## When a backup contains people

Nothing leaves your device — **but the file does.** A course backup taken
with _user data included_ carries a root `users.xml`, and it is not a list of
names. One record holds:

> username · email · first and last name · ID number · two phone numbers ·
> institution · department · postal address · city · country · the last IP the
> account logged in from · a free-text profile description · role assignments

Forum posts, glossary entries, assignment submissions, quiz attempts and
grades travel the same way when that box was ticked.

So MBZoo says so as soon as such a file is opened: **how many people, and
which kinds of data are actually populated** — a column that exists but is
blank for everyone is not reported, because warning about phone numbers when
nobody has one teaches people to ignore the warning.

The list of names sits behind a disclosure that stays closed. Knowing a file
names four hundred people is what everyone needs; reading their names is a
deliberate act, and not one to perform by accident while screen-sharing.
"Understood" folds the banner into a one-line pill that keeps the count and
the kinds on screen; that choice lives in memory for the page session only and
is never written to browser storage.

**Treat a backup with user data as personal data** before emailing it,
uploading it, or committing it to a repository.

## Exports

Per-activity export (module XML, rendered content as a standalone HTML file,
attached files as a ZIP) is a deliberate user action: nothing is written
without a click, and the file is produced in your browser and handed to your
own download folder. See [Activity support](/mbzoo/docs/guide/activity-support.md).

MBZ Doctor does the same with a repaired `.mbz` and with a diagnostic
report. Both are produced in the browser after an explicit click. The
original file is not modified. The JSON report is English technical text
and omits question text, file bytes, passwords, usernames and email
addresses. The on-screen before/after preview can show the XML that will
change; downloaded reports replace that preview with `[omitted]`. A report
can still name archive paths. See [MBZ Doctor](/mbzoo/docs/guide/mbz-doctor.md).

## What this repository never contains

Real institution or personal backups are never committed. Committed fixtures
are synthetic, deterministic and checksummed in `fixtures/manifest.yaml`. Real
specimens used to verify parsers are recorded there with their provenance and
left out of the tree.