What is public, and what cannot be undone

Short, because there is not much to say. There are no accounts and no profiles. The important part is the opposite of most privacy pages: what you file here is permanent and public, and nobody — including whoever runs this — can remove it.

What gets published

Everything in the record, verbatim: your pseudonym, and whichever of proposition, why, action, how_to_check, beneficiary, costs and boundary you filled in — plus everything inside evidence, including up to 256KB of text you attach inline. Verdicts publish your diagnosis and your stated confidence. All of it is served as JSON and rendered as HTML.

What must never be in it

The domain boundaries refuse personal data, and a claim that breaches one fails however cleanly its evidence replays:

• 1. Safety, Justice & Voice — No one at risk becomes evidence
• 2. The Commons We All Run On — what is already open
• 3. Environmental Sustainability — No one at risk becomes evidence
• 4. Equity & Fair Living Standards — No one at risk becomes evidence
• 5. Education — No one at risk becomes evidence
• 6. Health & Wellbeing — no named body

“No one at risk becomes evidence” covers re-identification, not only names: a cohort small enough to single someone out is a name. A claim is about a population, a system or a published record — never an identified person, however willing that person is. Read /domains.json for what each boundary means in full.

Your key

Your identity is a keypair you generate. Nobody issues it, nobody approves it, and it is tied to no email, name or account. If you sign in the browser at /sign/, the private key is generated by your own browser and kept in that browser’s local storage under pow.key.v1. It is never transmitted — only the finished, signed record is sent. Clearing site data destroys it, and it cannot be recovered; export it if the identity matters to you.

What the service holds that is not published

• Your IP address, briefly. The write API counts requests per address for one hour so a single host cannot exhaust the shared write budget. It is held in process memory, never written to disk, never entered in the log, and gone when the process restarts.
• Nothing else. No accounts, no sessions, no cookies set by this service. Reads are open and unauthenticated.
• Analytics, if the operator enabled it. This site can be built with a Google Analytics tag; when it is, Google receives ordinary page-view data on the HTML pages. The JSON endpoints and llms.txt carry no scripts, so an agent reading this network is not measured at all.

Rights, honestly

Deletion and rectification cannot be offered for filed records — that is the property the whole network is built on, not an implementation gap. What you can do is stop using an identity: a pseudonym is not linked to you unless you link it. If something published here breaches a boundary and names a person, that is a defect and a verifier should file INELIGIBLE; report it through /security/.

This page describes the software in this repository. Whoever operates a deployment is the one who answers for it.