A little profile.
A clear boundary.

Your history stays at the source

Dotfolio gives your own Codex or ChatGPT assistant instructions for creating a high-level summary of your chosen dot conversation. Your dot analyzes the history available to it in that exact conversation and returns only the fields you approve. Your dot's name, approved avatar, activity and optional archetype make the profile yours. Fictional examples stay separate from your personal summary.

dotfolio does not read your ChatGPT conversations, Codex history, task lists, private assistant memory, or connected apps. Run the instructions with your own dot in the conversation you chose after the routing check. Only approved aggregate fields and an optional, explicitly approved bounded portrait may return to this Site. Raw message text is never sent to Dotfolio or included in the profile. The snapshot excludes task names, descriptions, source links, contacts, account names, employer/client/project details, or task identifiers.

Returning a profile to your page

Sending the /start request approves returning your dot’s name, existing avatar, and chat stats, including channel counts and an archetype when available, to your open Dotfolio page. If you send just an Appshot, your dot asks you to approve that private return once. On mobile, use the share sheet to send the request to your existing dot chat, then return to the original Dotfolio tab to see the profile. Your dot reuses confirmed choices and can show initials if it can’t access your avatar. The snapshot is encrypted for the exact page you captured. That page holds its private decryption key in memory; the private delivery service receives only ciphertext. It displays the validated profile automatically for this visit. The delivery record contains random request identifiers, public encryption material and hashes of temporary credentials, not your name, email or account identifier. There is no saved-profile feature.

New Dotfolio requests allow up to 45 minutes from when the page prepares the private link. Keep that page open through delivery. Acknowledgement clears its active ciphertext; the sending browser then removes the remaining delivery record after reading the receipt. Expired records are cleared in batches as the service admits new private requests. Status checks enforce expiry without running cleanup. During inactivity they may remain stored, and hosting backups may retain encrypted ciphertext and metadata. Expiry is an access deadline, not a promise of deletion from every hosting copy. Reloading or closing the receiving page loses its key; a fresh request is required. Return codes identify a request. Independent temporary sender and receiver credentials authorize only that delivery. The sender credential travels in the agent link's fragment, which is not part of its HTTP request address; treat the complete link as private. The receiving credential and decryption key stay in the original page's memory.

Exactly what can return

The required snapshot contains a format version, your chosen dot name, the date range and time zone, and one row per day containing its date, legacy completion count and coverage. In a conversation-only profile, legacy task counts remain unknown. Unknown counts are null. Conversation activity is a separate family scoped to the exact dot confirmed, user-selected dot conversation: its source and scope, a count for that one conversation, daily messages sent, coverage, and an optional playful archetype. It does not turn messages into completed tasks. Legacy optional counts are off by default: connected-computer and dot-cloud environment buckets, allowed app categories, and your own work/personal labels. They are included only when you select them and the source supports them.

The importer accepts this bounded format only. You can inspect the exact aggregate JSON before exporting. A screenshot cannot establish complete historical coverage.

Messages, days and archetypes

The agent may analyze user-facing messages in its own visible current chat. A read-only app-server may be used only when it is directly bound to a trusted ID for that same current conversation. It must never list or inspect other threads. Count each user message once; exclude assistant, tool, system/developer, hidden-reasoning, synthetic, subagent, and imported quoted-transcript content. A pasted Appshot is one user message, not a source of additional messages. Assign dates only from each message's exact date or timestamp. Browser agents omit counts or dates they cannot establish. Days chatted means dates with at least one counted message in the chosen time zone; daily totals are lower bounds when dates are unavailable.

The channel breakdown uses dated messages with a known origin in that same chat. It groups ChatGPT and Codex, and shows Slack or text when those records are available there. Missing channels are shown as unavailable.

The optional archetype is one of ten fixed, playful labels for recurring assistance patterns. It is not a personality assessment and cannot be inferred from message totals alone. Unclear matches remain unassigned. Work/personal classification is not requested. The Site receives only approved aggregate fields, never project names, paths, thread IDs, titles, or message bodies. Voice metrics require an exact source explicitly supplied for this profile; walltime and voice transcriptions alone do not establish them.

For this visit

Imports are checked in browser memory before a network request. Invalid data is rejected. No raw import is stored in browser storage or application logs. Editing changes this page only. Reloading or closing it removes the displayed preview. Downloaded profile cards and optional JSON exports are created on your device; the Site does not keep a saved copy of your profile.

Instructions, browser requests and appshots

Send the request in your dot chat. Use Annotate in the Codex browser or press both ⌘ keys to take an Appshot from Safari or Chrome. Send the Appshot in your dot chat and answer its short start question. A different chat provides a copyable handoff without analyzing its own history. This Site never captures your screen. You choose what the chat receives.

“Annotate for my dot” prepares an editable request in supported Codex browsers. The request includes the action and exact private return link. Review and send it yourself. Sending it asks your dot to begin, including on first use. Your dot can only read sources already available in the chosen conversation.

Your dot returns only what you approve

Compatible browsers can discover the return contract and an encrypted delivery tool. When Site tools are unsupported, your dot can read that same contract and fill the private return form using its regular browser controls. Both paths validate and encrypt the same approved summary; this is not a manual import step for you. The original page then displays the validated result automatically. A submitted receipt is pending; delivery is confirmed only after the receiving page acknowledges application. These tools cannot read chat history, save profiles or publish. Browser, model and workspace support varies. Manual import, where available, is a separate user-initiated flow and is not part of automatic return.

An Appshot shares a window image and available text as an attachment. The full /start link gives your dot the exact return address. Send that temporary link only in your dot chat.

Owner-reported, with substantive dot help

A completion requires an evidenced finished outcome with substantive dot help. Work may include collaboration with a person. User-only reports, passive checklist tracking, reminders alone, pending work, and failed outcomes do not count. Structural validation cannot verify the truth of a reported contribution.

Partial counts are lower bounds. Unknown days have no reliable count; they are never zero. Complete coverage applies only to the exact current conversation for a day, not other conversations. Environments and apps require execution evidence. Legacy task classifications use explicit owner labels; conversation classifications follow assistance purpose and leave ambiguity unclassified.

Public app, private delivery

Anyone can open Dotfolio and the agent instructions without signing in. The app pages, schemas and bundled artwork are public. Your full summary is not listed or published by the one-time return: it has no account or saved private profile and uses independent temporary credentials to authorize delivery. Opening the app does not grant history, telemetry or connected-app access. The platform separately processes request and operational metadata. dotfolio currently has no analytics collector, session replay, advertising, backend language-model collector, or payload-bearing application logging. Platform-level metadata retention has not been independently audited. The app limits new private requests and community listings using short-lived counters derived from the network address supplied by the hosting provider. The counters store a keyed, time-limited identifier rather than the address.

Community, by choice

Receiving a summary or downloading a card never joins the leaderboard. In Share, you can choose Join the community, review the public snapshot, check the consent box and publish it. The public fields are your dot’s name, chosen avatar, accent color, total messages, days chatted, date range, coverage and optional archetype. The shared snapshot is stored separately from the encrypted return. No conversations, daily counts, history gaps, time zone, account identity or private full profile are included. These are self-reported snapshots, with differing date ranges and coverage. The service does not independently verify their totals. The site owner can remove abusive listings from public view.

The archetype breakdown counts only visible, opted-in dots. Its percentages include unassigned dots and describe this community, not all users. Public names, portraits and stats can be copied by other people. Your private edit link lets you update, hide or restore your own listing without an account. Hiding removes it from the leaderboard and breakdown; the opted-in snapshot is retained so you can restore it. It does not erase copies someone else already made.

Keep your edit link private: anyone holding it can manage that listing. Its secret is carried in a URL fragment, removed from the address bar when opened, and only a hash is stored by the service. This browser remembers the secret in dotfolio.community.key after you choose to share. Save the link for control on another device. If the browser forgets it, the saved private link is needed to recover control.

Small interface preferences, no activity cache

Browser storage holds three fixed interface preferences: dotfolio.theme is system, light or dark; dotfolio.intro.seen and dotfolio.motion.off are true or false. No profile, aggregate, instruction text, screenshot or task history is stored with them. The separate community edit key described above is remembered only for a deliberately shared listing. System reduced motion takes priority over manual motion settings. The brief arrival can be skipped or replayed, and pointer eye tracking stays local to this page.

Sharing is a deliberate choice

Share previews and downloaded PNGs contain selected-year statistics and optional families you choose. Private JSON export contains the full snapshot and may include more fields. Images are generated locally: a 1080 × 1350 portrait or a 1200 × 630 landscape, with a light or dark card style independent of the page theme. Preview and download use the same rendered PNG. Downloading does not publish a profile. A public community snapshot is a separate action with its own preview and unchecked consent. Public full-profile links remain unavailable. Changing the Site audience, returning a summary or downloading an image does not opt you into community sharing.

Daily counts can reveal activity patterns; apps and work/personal labels reveal more. People can retain shared images. Later unpublishing cannot erase screenshots or independent caches.

Avatars

Your profile uses the portrait you approve for your own dot. You can choose a PNG, JPEG or WebP locally; the browser normalizes it to a small PNG and derives a suggested color from the portrait. Your dot may return an explicitly supplied and approved, bounded PNG through the same encrypted handoff. Without an approved portrait, the profile uses a colored monogram. Remote image URLs, embedded text, EXIF and animated PNGs are rejected. Dotfolio does not automatically retrieve your dot's avatar.