SemperScribe Privacy and Security Notice

1. Status of This Application

SemperScribe is a non-official Proof of Concept (PoC) maintained on a personal basis. It is not official USMC, DON, or DoD software. It does not carry an Authority to Operate (ATO) and holds no CUI authorization of its own. Use is at the user's discretion and risk.

2. What the Application Processes

SemperScribe processes only the text that the user enters or imports into the in-browser form. All document formatting occurs locally within the browser, and the formatter performs no server-side processing of user input. The optional GunnyBot assistant is the sole exception, described in Section 5A.

3. What the Application Does Not Do

The following statements describe the document formatter. The optional GunnyBot assistant is the single exception and is covered in Section 5A.

• The formatter transmits nothing. No document, and no part of one, reaches any system the operator controls.
• The application emits no telemetry, no analytics, and no usage beacons to any third-party host at runtime.
• The formatter calls no backend, database, or external API at runtime. GunnyBot, when the user enables it, calls the user's chosen provider directly, per Section 5A.
• The application sets no third-party cookies. The GunnyBot API key is held in session memory, not local storage, and clears when the tab closes.

Two claims left this list on 26 August 2026 because they were not true. It said the formatter does not store PII and does not process CUI. It does both, on the user's own machine: what the user enters is written to browser storage, and the application reads and formats it. What it does not do is send any of it anywhere. Section 3A states what persists and where.

3A. What Persists, and Where

Everything below is written to the browser profile on the computer the application is opened on. None of it leaves that computer.

• Saved drafts, in the IndexedDB database named semperscribe, object store documents. Each carries the full contents of the document.
• Files bound to a document, in the enclosureFiles store. This includes an uploaded NAVMC 10132, retained in full so later exports write into the signed original rather than a copy of it. A signed unit punishment book runs to several megabytes and carries the accused's name and DoD ID.
• Application settings and the unit profile, in the settings store and in local storage.

Clearing the form, or starting a new case, deletes the uploaded file and resets the document. Deleting a document from the library removes it and its bound files. Neither reaches any other copy the user has made, including exported PDFs saved elsewhere on the computer.

Because this persists on the user's own machine, the machine is what has to be approved for the information entered. A government furnished workstation already accredited for a Marine's service record is approved for a document drawn from it. A personally owned computer is not.

4. User Responsibilities

The application has no technical mechanism to recognize or reject sensitive input, and does not attempt one. The user decides what to enter, on a computer approved for it, and bears sole responsibility for the content they enter and the use they make of generated output.

Classified material is never permitted. CUI is governed by the system, not by this application: DoDI 5200.48 paragraph 3.3.c requires CUI to be processed on a DoD information system at the moderate confidentiality level, and paragraph 3.10.b bars non-DoD information systems for official business involving CUI unless approved. Whether this application, served from a non-DoD host and run in a browser on your system, is permitted for CUI is your authorizing official's decision. Until your command has granted that approval, do not enter CUI. Personally Identifiable Information (PII) such as names and EDIPI, and Protected Health Information (PHI), may be entered at the user's discretion and risk: the formatter never transmits it, and every export is scanned for SSN and EDIPI patterns and PHI keyword clusters before the file is written (Section 5B). A name or an EDIPI is not CUI on its own. Whether a completed record about a real Marine, such as a NAVMC 10132, a NAVMC 118(11) entry, a NAVMC 10274 or a Counseling Worksheet, is CUI in the Privacy category of the DoD CUI Registry (marking PRVCY, authorities 5 USC 552a(b), OMB M-17-12, DoDI 5400.11) is determined by your command's CUI and Privacy Act guidance, not by this application, which serves every command and applies no marking of its own. Where your command treats such a record as CUI, the condition above on your system and your authorizing official's approval applies to it. Sample data and drafts about no real person are not CUI. The user bears sole responsibility for the content they enter, for any Privacy Act obligation it creates (Section 7), and for the use they make of generated output.

Two features move a document off the computer, and each warns where it is used rather than here. GunnyBot sends what the user submits to the provider the user configured, per Section 5A. A share link carries the whole document inside the link itself, so the document travels wherever the link travels.

5. Outbound Network Calls

At build time, the static export downloads webfont files via Next.js's font/google loader and bundles them with the output. At runtime, the browser fetches only assets served from the same origin as the application, with one exception: when the user enables GunnyBot, the browser also contacts the user's chosen LLM provider, per Section 5A. Reference: Phase 2 of docs/COMPLIANCE_REMEDIATION_PLAN.md.

5A. The GunnyBot Assistant

SemperScribe includes an optional AI assistant, GunnyBot, which stays off until the user supplies a personal LLM provider API key. When the user enables it and uses a GunnyBot feature (a format or policy question, a proofreading review, a paragraph rewrite, or a drafted paragraph), the text the user submits to it leaves the browser and goes directly to the user's chosen provider, Google or GenAI.mil, under the user's own key. The provider processes that text under the provider's own terms and privacy policy, outside SemperScribe's control.

The API key is held in browser session memory only. It clears when the tab closes, is never written to disk, and is never sent to any SemperScribe-controlled host. GunnyBot output is advisory only. The user reviews and accepts any change, and nothing is written to the document automatically.

Before any GunnyBot feature sends text, the application scans it in the browser for two high-confidence structured identifiers, the Social Security number digit pattern and the ten-digit EDIPI. A match opens a consent prompt naming the finding, and the send proceeds only if the user acknowledges it. This scan runs on all four GunnyBot paths and never leaves the browser. It is a narrow tripwire, not a certification: it does not detect CUI, PHI, classification markings, or any identifier outside those two patterns, and it produces occasional false matches on unrelated ten-digit numbers. GunnyBot applies no attestation prompt beyond this. The user remains solely responsible for not submitting CUI, PII, PHI, or classified text to GunnyBot.

5B. The Pre-Export Scan

Before any PDF, DOCX, official-form, or batch ZIP download, the application scans the document in the browser for the Social Security number digit pattern, the ten-digit EDIPI, and clusters of medical keywords. A match opens a dialog naming the finding, and the file is written only if the user acknowledges it. The scan never leaves the browser and records nothing.

This scan is the control behind Section 4. Several document types exist to carry identifiers, among them the NAVMC 10132 Unit Punishment Book, the NAVMC 118(11) Page 11, the NAVMC 10274 Administrative Action form, and the Counseling Worksheet, each of which asks for a Marine's EDIPI. The scan does not block those exports. It makes the user say, at the moment of export, that a file carrying a personal identifier is leaving the browser and is now subject to their command's handling rules. It is a tripwire, not a certification: it does not detect CUI, classification markings, or any identifier outside those patterns, and it produces occasional false matches on unrelated ten-digit numbers.

6. Output as Federal Record

When a user takes a document generated by SemperScribe and uses it to transact official business, that document becomes a Federal record under 44 USC 3301. Records management is the user's responsibility through their Command Designated Records Manager per MCO 5210.11F. SemperScribe does not perform records-management functions and is not registered as an Electronic Information System (EIS).

6A. Retention and Deletion

The application keeps what you enter in this browser only: the document library, the autosaved working copy of each open tab, uploaded enclosure and form files, your profile, and the optional backup folder link. Nothing expires on its own. The retention and disposition of the records you produce with it belong to your command's records schedule, through your CDRM; the application applies none. A Counseling Worksheet is destroyed when the senior and junior relationship ends (NAVMC 2795 para 3005.1.i), and it is your action, not the application's, which does that. Settings, Data, "Delete all local data" removes every store the application keeps and reloads; use it before another person uses this computer. Auto-backup keeps the newest five snapshots of each document in the folder you chose and warns when that folder name suggests a sync client, because a synced folder does leave the machine.

7. Privacy Act Posture

Because the application does not collect or maintain a system of records, the Privacy Act of 1974 (5 USC 552a) does not apply to SemperScribe as operated. The application is also not registered under any System of Records Notice (SORN). If a user enters real PII into the form, the user assumes any resulting Privacy Act obligations personally. See SECNAVINST 5211.5F paragraph 5b for context on DON privacy responsibilities.

8. Security Posture

The application is statically exported and hosted on GitHub Pages. It has no backend. There is no authentication, no session management, and no server-side state. Browser security is the user's first and last line of defense. For vulnerability reporting, see the SECURITY.md document at the repository root.

Having no backend is not the same as nothing being logged. GitHub serves the pages and sees the request for each one, including the full address requested. Anything placed in a URL by this application therefore reaches a third party's logs. Share links are built so the document rides in the fragment after the #, which browsers do not send to the server, rather than in the query string, which they do. Links created before 26 August 2026 used the query string and their contents reached those logs.

9. Compliance References

• Privacy Act of 1974, 5 USC 552a.
• 44 USC 3301, Definition of Records.
• SECNAVINST 5211.5F, DON Privacy Program, 20 May 2019, paragraph 5b.
• MCO 5210.11F, Marine Corps Records Management Program, 7 April 2015.
• MCO 5211.5, USMC Privacy Program, 28 August 2024.
• DoDI 5200.48, Controlled Unclassified Information, 6 March 2020.
• NIST SP 800-218 (SSDF v1.1), practices PO.5.1 and PS.1.

10. Updates to This Notice

This notice is reviewed when material changes to the application's data handling occur. The Last reviewed date at the top reflects the most recent review. Substantive revisions also bump the Document version field.