Authorization first
Robots rules never substitute for Convex workspace authorization or API checks.
Seller resource
Public clarity starts with private data boundaries.
Public pages are crawlable only when they are approved; authenticated workspace data remains behind authorization, and analytics uses an explicit allowlist.
Workspace boundary
Private Product data is not acquisition content.
Product photos, Source facts, prompts, generated assets, storage IDs, signed URLs, and seller identity remain workspace-scoped. A public example requires a separately approved derivative and disclosure.
Proof is explicit
The public registry does not enumerate private Sources automatically.
Analytics is narrow
Consent-gated events exclude product content, prompts, email, names, raw URLs, and storage references.
Review before publication.
- Public pages use approved fact and capability IDs.
- Legal routes remain accessible but are not treated as counsel-approved without owner inputs.
- Session Replay and Autocapture are permanently disabled in the SEO/GEO analytics program.
- Security, compliance, encryption, retention, and deletion claims are not added without evidence.