Reference operator
Data policy
Minimize retention. Publish what we store. No scan analytics or scan notifications by default.
May store
- Public trust layer Profile id, public key, handle, manifesto, signed card, QR credentials, status flags
- Vouches & revocations Signed vouches, verification summaries, revocation and suspension records
- Live control Short-lived challenge records (minutes), not long-term history
Must not store
- Private keys or recovery secrets
- Backup passphrases or encrypted backup files by default
- Government ID or KYC artifacts
- Phone or email required for card creation
- Scan analytics, alerts, histories, or fingerprinting
- Payment or shipping PII in the resolver DB
Key custody
- Session-only key The owner key is generated in your browser and kept only while the create tab or owner session still has it. Revoke and live proof require signing material in this tab, or unlocking a saved backup or recovery key locally.
- Saved on this device Save ownership on this device copies control to browser storage so other tabs can restore signing. The operator never receives private keys.
- Encrypted backup Backup files download client-side. The passphrase is never sent to humanity.llc; lose it and the backup cannot be reset.
- Recovery key If you saved the recovery private key shown at create, it can sign revokes later. The resolver stores only the public recovery key.
- No operator backdoor humanity.llc can verify signed actions. It cannot recover lost passphrases, decrypt backups, load your private key, or revoke on your behalf.
Client UI (not operator storage)
Saved card rows on My objects and the device hub may show checked … ago. That timestamp is only when this browser last successfully polled resolver status for a saved card — stored locally in session storage, not sent to or retained by the operator. It is not a log of who scanned the QR.
Scan notifications
Passive scans do not trigger steward notifications, browser alerts, emails, webhooks, or scan dashboards. Live control is the narrow exception: a scanner explicitly asks the steward to sign a short-lived challenge.
Future interaction signals may be coarse object state, such as discovered recently or active this week. They must not expose timestamps, locations, IPs, scanner identity, or per-scan history.
Commerce firewall
- QR payloads stay clean Printed URLs must not embed order IDs, emails, or shipping fields.
- Shop stays separate Payment and shipping PII live in Shopify / Printify — not in the resolver database. Buying merch does not upgrade verification or vouch state.
Access logs
Default: no scan logging. On the reference network,
GET /c/…, status JSON, and QR credential lookups are not access-logged.
Status JSON exposes scan.limits.scan_analytics: false. Any future minimal
logs require governance approval and published retention — not a silent product change.
Retention
- Active cards Public card and credential state stays until owner revoke, disable, or operator suspension.
- Orphan registrations Cards that stay active but are never updated, have no vouches, and have no live QR may be purged automatically after 90 days.
- Live-control challenges Short TTL in minutes — not kept as long-term history.