Skip to main content

​
crewship privacy

Self-service controls for the peer-memory feature: decide whether crew agents may keep “peer cards” about you, see every card stored about you across the workspace, and delete them. Every action is scoped to your own data — no workspace-admin role is required. The server reads your user ID from the auth token and the routes address the literal me, so you can only ever act on yourself. Cross-user GDPR actions by admins go through a separate admin surface.

​
Subcommands

set on opts you out: every existing peer card about you in this workspace is purged immediately (the command reports how many were removed), and future extraction is blocked while opted out. set off opts back in — it does not recreate anything; agents may simply extract new cards going forward. Opting out is destructive, so it prompts for confirmation unless --yes. set also accepts true/false and yes/no.

​
crewship privacy peer-cards

list shows one row per card (ID, AGENT, BYTES, UPDATED). The full card content is returned by the API and surfaced with -f json — useful as a subject-access request (“show me everything you stored”). delete removes every card about you across the workspace but does not opt you out — agents may re-extract new cards later unless you also run peer-consent set on.

​
crewship privacy user-model (aliases: operator-model, about-me)

The operator model is a short profile every agent in your crew reads at the start of a session: your role, what you own, and the working preferences and constraints you have stated. It records only things you actually said — never anything the system concluded about you — and there is no field in it for a mood or a personality read. See Memory System → Operator model for what is recorded and how the refusals are enforced.
list shows one row per field (FIELD, VALUE). An empty table means nothing has been recorded about you in this workspace yet — a fresh operator, or an instance with extraction switched off. Name a field (show timezone) to see just that one; a field that is not stored is an error, not an empty table. --provenance adds where each entry came from — the answer to “when did I say that?” before deciding whether to forget it:
QUOTE is the exact span of your own words the entry was verified against (extraction refuses anything it cannot find in a message you wrote), RECORDED is when the sweep stored it, and MESSAGE is the id of the message it was found in. A later conversation that changes a field, or says it again in a new message, records a new row and list shows the newest; nothing is ever rewritten in place, and the same sentence re-found by the next day’s sweep is not recorded twice — the date stays the first time you said it. A dash means the entry was recorded before provenance was kept — the value is still yours to forget. With -f json each fact carries a provenance object with the same four fields (quote, message_id, source_type, at), omitted for an entry that has none. forget <field> is the answer to “an agent recorded something wrong about me” that does not cost you everything it recorded correctly. A field name that is not stored returns a 404 rather than reporting success. Forgetting the last remaining field removes the model entirely. delete forgets everything but does not opt you out: new facts may be recorded again from things you state later. To stop recording altogether, use peer-consent set on — which now also purges the operator model on the same request, not on the next daily sweep.
Provenance lives beside the model, not in it: the model file has a 1.5 KB budget read into every agent prompt, so the quotes are kept in their own table and never reach a prompt. They are deleted with the model on every path — forget drops the field’s rows, delete and opting out drop them all, and an administrator’s Art. 17 erasure reaches them too.

​
API

See also crewship memory for the agent-facing memory tiers and crewship preferences for personal UI settings.