Initial curated EventLens source from 0d80d3b38dfb817285481665b9e71e4b8a0656a0

docs/PRIVACY.md

@@ -0,0 +1,37 @@
+# Privacy model
+
+Windows Event Logs frequently contain usernames, hostnames, IP addresses, e-mail addresses, executable paths and application-specific fields.
+
+## In-memory workflow
+
+1. The browser sends the selected `.evtx` to the self-hosted API.
+2. A receive-level request gate rejects oversized body streams before multipart parsing; the API then reads bounded chunks, parses bytes off the event loop and returns normalized JSON.
+3. EventLens does not create an application-level upload file or database record.
+4. The multipart parser may transiently spool request data as part of the web framework; the upload handle is closed after every request and the app does not retain that path.
+5. The browser keeps the normalized analysis in component memory for the current session; switching workspaces does not create another copy or upload it elsewhere.
+6. Only display preferences (timestamp mode, defaults, density and preferred workspace) may be stored in the single `eventlens.preferences.v1` localStorage record; event text, EVTX-derived values and analysis results are never stored there. The Settings workspace labels this boundary directly, exposes its technical key only on request and can reset the record to defaults.
+7. Export is generated locally in the browser.
+8. The favicon, touch icons and web manifest are static files bundled with EventLens. They make no third-party request, do not enable a service worker and do not persist investigation data.
+
+## Redaction before export
+
+Redaction is enabled by default and operates on a cloned analysis object. It masks or replaces:
+
+- computer/host values;
+- username/account/e-mail identity fields, including domain-qualified accounts, SIDs and machine accounts;
+- e-mail addresses in free text;
+- IPv4 and IPv6 addresses in free text or IP-address fields;
+- Windows and UNC paths (including spaces/parentheses) and path-like fields;
+- source-name fields and source values propagated into free-form text;
+- known structured identities propagated into summaries, incident titles and reasons;
+- the source filename in the exported report.
+
+The UI previews replacement counts by type before export. The original in-memory analysis is never modified by the redaction function. The source name is replaced with `[REDACTED_SOURCE].evtx` when redaction is enabled. JSON and Markdown carry the same redacted normalized analysis and parse-completeness metadata.
+
+Redaction can be disabled when a raw forensic export is explicitly required, but that is an explicit user choice and the warning remains visible.
+
+## Limits
+
+The API enforces a 50 MiB file limit, a bounded request body independent of `Content-Length`, parser event/time budgets, bounded normalized strings/fields/output and bounded parse concurrency. These controls reduce accidental resource exhaustion; they are not a guarantee against every parser implementation vulnerability.
+
+Redaction is a best-effort privacy layer, not a formal DLP engine. Application-specific free-form values may contain sensitive data that cannot be inferred safely. Review exports before sharing them outside the intended context.