check-me: what it looks at and what it doesn’t

What it reads (only when you run it)

The names and counts of AI-tool configuration: e.g. CLAUDE.md / AGENTS.md, skills, subagents, hooks, MCP server names, plugin names, permission rule counts; sizes and line/heading counts of those files; whether you authored them (yes/no) and a bucketed number of co-authors; the number of git worktrees; the kind of git host (GitHub/GitLab/other — never the URL). If you switch it on, a coarse 30-day bucket per AI tool (“used on 0 / 1–3 / 4–10 / 11+ days”) computed on your machine from file timestamps.

Never: file contents, source code, secrets, .env files, keys, chat transcripts, commit messages, colleagues’ identities, general commit counts, dates or time-of-day.

Who sees it

Only you see your scans, reports and items. Not your lead, not HR, not management. There is no admin screen for individual results. Glorium sees only the anonymous monthly totals described below, for groups of 10 or more people, rounded to 10% (e.g. “about 60% have an MCP server”). You can exclude yourself on your page.

The game: XP, leaderboard and hero pages

The dungeon has XP, levels, gold, loot and trophies, earned by playing the dungeon only. The scan never feeds XP beyond one flat quest reward for your first completed Ritual of Scrying, and the items a scan grants are also lent to everyone by learning rooms, so nobody gains a ranking edge from their real setup.

The leaderboard and the public hero pages show game progress only: the name you choose, your class, level, XP, deepest floor, trophies, gold and the in-game gear your hero wears and carries. They are visible to signed-in colleagues. Nothing the scan found ever appears there.

You can hide yourself from the leaderboard and the hero pages at any time on your page; you then also drop out of the stack totals. Game progress is never used for performance evaluation.

No scores, no decisions

Your scan results are never scored: check-me does not rate, rank or level anyone’s work, and makes no decisions about people (GDPR Art. 22 does not apply because there are no automated decisions). Its results are never used for performance reviews, pay, promotion, discipline, project staffing or licence allocation. Changing this would need a new privacy review, 30 days’ notice and your fresh opt-in.

In the game, hearts are a temporary resource that resets when you respawn. Riddles and code puzzles are checked deterministically and only teach; your answers stay private and only count toward the anonymous “tricky concepts” totals.

The anonymous AI-adoption report

Once a month the server computes anonymous totals for Glorium: how many people use any AI coding tool, which practices (rules files, skills, subagents, hooks, MCP servers and more) are common, adoption per stack, and which dungeon concepts people find tricky. Workshops are suggested from them, for example for colleagues who use no AI tools yet.

Every total covers at least 10 people, with at least 3 on each side of a share; shares are rounded to 10% and counts to 5. It holds no names, emails, user ids, repository or project names; tool and MCP server names appear only when 10 or more people use them. You can exclude yourself on your page.

AI inside

The scan is driven by AI models on our server, called through OpenRouter only via providers with zero data retention. They write the short “scrying” text on your report, in your language. AI output can be wrong; you can delete any report.

Why we may do this, and for how long

Legal basis: our legitimate interest in helping staff learn to use AI safely (also an EU AI Act AI-literacy measure). Taking part is voluntary; not taking part has no consequences.

• Scan request details: at most 7 days.
• Your latest inventory and report: until you replace or delete them.
• Game progress: until 12 months of inactivity or when you leave.
• XP history for the weekly leaderboard and your private puzzle answers: 90 days.
• Backups: roll off within 30 days.

Your rights

See, export or delete your data, or object, with one click on your page (“Me”) — or by email to the Glorium DPO. You can also complain to your data protection authority.