crewship privacy
Self-service controls for the peer-memory feature: decide whether crew agents may keep “peer cards” about you, see every card stored about you across the workspace, and delete them. Every action is scoped to your own data — no workspace-admin role is required. The server reads your user ID from the auth token and the routes address the literalme, so you can only ever act on yourself.
Cross-user GDPR actions by admins go through a separate admin surface.
Subcommands
crewship privacy peer-consent
set on opts you out: every existing peer card about you in this
workspace is purged immediately (the command reports how many were
removed), and future extraction is blocked while opted out. set off
opts back in — it does not recreate anything; agents may simply extract
new cards going forward.
Opting out is destructive, so it prompts for confirmation unless --yes.
set also accepts true/false and yes/no.
crewship privacy peer-cards
list shows one row per card (ID, AGENT, BYTES, UPDATED). The
full card content is returned by the API and surfaced with -f json —
useful as a subject-access request (“show me everything you stored”).
delete removes every card about you across the workspace but does
not opt you out — agents may re-extract new cards later unless you
also run peer-consent set on.
crewship privacy user-model (aliases: operator-model, about-me)
The operator model is a short profile every agent in your crew reads at
the start of a session: your role, what you own, and the working preferences
and constraints you have stated. It records only things you actually said —
never anything the system concluded about you — and there is no field in it
for a mood or a personality read. See
Memory System → Operator model
for what is recorded and how the refusals are enforced.
list shows one row per field (FIELD, VALUE). An empty table means nothing
has been recorded about you in this workspace yet — a fresh operator, or an
instance with extraction switched off.
forget <field> is the answer to “an agent recorded something wrong about me”
that does not cost you everything it recorded correctly. A field name that is
not stored returns a 404 rather than reporting success. Forgetting the last
remaining field removes the model entirely.
delete forgets everything but does not opt you out: new facts may be
recorded again from things you state later. To stop recording altogether, use
peer-consent set on — which now also purges the operator model on the same
request, not on the next daily sweep.
list shows what is stored, not where each entry came from. Extraction checks
every fact against a verbatim span of your own words, but that span is not
persisted — the file has a 1.5 KB budget read into every agent prompt.
Per-entry provenance is tracked as follow-up work.API
See also
crewship memory for the agent-facing memory
tiers and crewship preferences for personal UI
settings.