Last updated 13 September 2026.
Machine Builder is a canvas at
noodlemachine.app
and, locally, at /builder on ideas serve.
There is no sign-up: you can use it without telling anyone who you are.
This page lists everything that gets stored on your device, everything that
can leave the browser, and the two ways the page is served, because they
are not the same server.
Aviv Profesorsky is the controller. Privacy questions: [email protected].
The public site serves this policy and the builder over GET. It has no
accounts and no POST. Served locally by ideas serve, the same
origin also binds POST /api/run and POST /api/judge.
Those routes belong to the idea-machine pipeline at /, not to
this builder, and the builder does not call them. Either way, this page
does not post your keys, your canvas or your prompts to the origin that
served it.
Everything below is localStorage on this origin. Nothing goes
to cookies, sessionStorage, IndexedDB or a service worker.
| What | Where | Why | Kept for |
|---|---|---|---|
| Your API keys | mb.keys |
So a live run can authenticate without you pasting a key every time | Until you press “Forget every key on this device”, or clear site data |
| The canvas | mb.workflow |
Brings your machine back after a refresh: blocks, wiring and settings, including any phrase or prompt you typed into them. Results, costs and statuses are stripped out before it is written | Rewritten as you work, and dropped when the canvas is empty |
| Blocks you define | mb.blocks |
Keeps the blocks you make in the library between visits | Until you delete the block, or clear site data |
| Theme | mb.theme |
Remembers light, dark or auto | Until you clear site data |
| Your answer about usage data | mb.consent |
So the question is asked once instead of on every visit | Written whichever way you answer, Decline included. Until you clear site data |
| A random number standing in for you | mb.anon |
Ties one visit's usage events to the next without knowing who you are. Not derived from anything about you or this browser | Written only after you Allow. Deleted the moment you Decline |
| Usage events waiting to be sent | mb.tq |
Holds events until PostHog accepts them, so a bad connection delays them instead of losing them | Written only after you Allow. Emptied as each batch is accepted, and deleted when you Decline |
| A report you wrote that has not sent yet | mb.fb |
Only if Send feedback is enabled and a send fails for a reason that might work later. Holds the message and the address you typed, and nothing else. The shipped page has no access key, so this entry is not written | Written only on a failed send, and deleted the moment the report is accepted. Never written if you do not write in |
Those eight are the whole list. The first four are your work and never leave
this browser at all. mb.consent, mb.anon and
mb.tq exist only because of the usage-data question, and two
of those three are not written unless you answer it with Allow.
mb.fb is written only if you write in and the send does not
get through, on a build where that form exists.
If you paste a key it is kept in this browser's localStorage
under mb.keys and, in live mode, sent from here to the vendor
that owns the model. It is never posted to the origin that served this
page. Be aware that
any script running on this page could read it; that is true
of every browser-stored key anywhere. Use a key scoped to this purpose and
revoke it at the vendor if you stop using the site. Forgetting a key here
does not revoke it.
Simulated, which is how every load starts, calls nothing
at all. Live sends the block's prompt and your key from
this browser straight to the vendor that owns the model. What you send is
then covered by that vendor's terms, and the run spends your money. The
wiki-context block reads en.wikipedia.org in either mode: it
sends the word it is expanding, with no key and no cookies.
| Host | When | What is sent |
|---|---|---|
api.openai.com |
A live run against an OpenAI model | Your OpenAI key and that block's prompt |
api.anthropic.com |
A live run against an Anthropic model | Your Anthropic key and that block's prompt |
generativelanguage.googleapis.com |
A live run against a Google Gemini model | Your Google key and that block's prompt |
api.groq.com |
A live run against a Groq model | Your Groq key and that block's prompt |
en.wikipedia.org |
A wiki-context block, live or simulated | The word being expanded. No key |
us.i.posthog.com |
Only after you Allow usage data | The events below. Never a prompt, a result, a key, or text you typed |
api.web3forms.com |
Only if Send feedback is enabled and you send a report | What you typed, described below. The shipped page does not send this |
On the public deployment, a content-security-policy names those hosts and
the browser refuses anything else. Served by ideas serve there
is no such policy.
We use PostHog
(us.i.posthog.com) to count what the page does and to hear
about crashes. It is not contacted at all unless you click Allow, and
declining leaves the page fully working. Until you answer, there is no
identifier, nothing written and nothing sent.
If you Allow, this page tells PostHog that a short list of things happened:
the page opened, a block was dropped on the grid, a run started in Live or
in Simulated, a run finished, a run stopped and what stopped it, and any
error the page hit. Each event carries counts and fixed words — how
many blocks, which kind, how long it took, what the spend meter said —
and a random number that stands in for you
(mb.anon).
Never a prompt, a result, a model's answer, a key, or any name or
text you typed.
Every property that is allowed out is listed by name in the page's source,
and anything not on that list is dropped before it can be queued —
including the contents of an error message, which is the one place your
text could arrive by accident.
PostHog also sees what any server you connect to sees: the IP address the
request came from and your browser's user-agent string. It derives an
approximate country, region and city from that address and stores them as
$geoip_* properties on the event. That happens at their end,
not here, and it is the one thing on this page you do not hand over
deliberately. Events wait in this browser under mb.tq until
they are accepted, so a flaky connection delays them rather than losing
them — which is also why declining has to delete the queue rather
than only stop adding to it.
Decline also deletes the identifier and the queue if an earlier visit left them here. Change your mind whenever you like: open Machine Builder and use What this page stores. Decline and Allow are the same weight of button in the same place.
The page can include a Send feedback button that posts what you write to
api.web3forms.com, which turns it into an email to whoever
runs this page. It is gated on an access key. The shipped page has
no key, the button is hidden, and nothing is sent.
The rest of this section describes the path that exists once a key is
pasted, not something the live page currently does.
A report sends your message, the address you typed if you typed one, this
build's date, the word production or local for
where the page is running, and your browser's user-agent string.
That is the whole payload, and the dialog shows it to you as it
will be sent rather than describing it.
No key, no prompt, no output, no machine, nothing read off your canvas.
The subject line is Machine Builder - Feedback.
It is not joined to the usage data above. It carries no
identifier, it does not use mb.anon, and it works exactly the
same whether you allowed usage data or declined it — declining to be
counted is not declining to report a bug. Leave the email box empty and
there is nothing in the message that says who wrote it. If a send fails for
a reason another try could fix, the report waits in this browser under
mb.fb and goes out on your next visit.
| What | Purpose | Basis |
|---|---|---|
mb.keys, mb.workflow, mb.blocks, mb.theme |
Deliver the canvas you asked for | Strictly necessary for a service you requested (ePrivacy 5(3)) |
mb.consent |
Remember your usage-data answer so the question is not asked again | Strictly necessary to honour that answer |
Usage events, crash reports, mb.anon, mb.tq, and the country / region / city PostHog derives from your IP |
See which blocks are used, whether runs finish, and which errors the page hits | Consent (GDPR Art. 6(1)(a) and ePrivacy 5(3)). Off until you Allow |
| A live-mode call to a model vendor | Run the block you asked to run | Strictly necessary for that request. You paste the key |
| A wiki-context lookup | Expand the word you put in that block | Strictly necessary for that request |
| A feedback report, when that form is enabled | Read the note you chose to send | Consent. Nothing is sent unless you press Send |
OpenAI, Anthropic, Google and Groq see a live run you pointed at them. Wikimedia sees a wiki-context lookup. PostHog sees usage events you allowed, including the approximate geo they derive from the IP. Web3Forms would see a report you sent, on a build where that form exists. Each of those is outside the EEA; their handling is governed by their own terms. No other host is contacted by this page.
Forget every key on this device, in API keys, drops the keys. Clear in the Workflow bar empties the canvas and the saved copy of it. Decline in What this page stores drops the identifier and the usage queue. A waiting report is deleted as soon as it is accepted, and there is nothing to erase until one fails to send. Clearing site data for this domain removes every localStorage entry at once.
Events already accepted by PostHog are not in this browser. Write to
[email protected]
with the value of mb.anon if you still have it, and they are
deleted. You can also ask for a copy of what is stored under that id,
or to restrict or object to that processing. A reply goes out within one
month. You may complain to your national data protection authority.
This page is a tool for building with language-model APIs. It is not aimed at children, and it does not knowingly store information about anyone under 16.