Privacy
Exactly what leaves your computer, and when. Everything else stays where it is.
- Everything you write starts private.
- You open each entry yourself: per entry, per face, per audience.
- No login. No account.
| What | Leaves? | When, and to whom |
|---|---|---|
| Your entries | Never on its own | Only an entry you opened yourself and put in a card, when you show that card to someone or publish it. |
| The mirror | Never | The mirror is yours alone. It never enters a card, an export, a meeting or an assistant's answer. |
| Your keys | Never | Your signing key stays on your computer. An export carries it only if you ask, and then only encrypted with a passphrase you choose. The keys you hold for model providers are never exported. In the browser record, the key is created in the browser. |
| A card you show in a meeting | Yes, the card | Only the card you chose, signed, to the person you are meeting. Nothing about where you met, or who was there, is kept. Unless you both choose to witness each other's record: then each keeps the other's signature and its date, never the place. |
| Witnessing each other's record | Only if you both choose it, at that meeting: a hash of your whole record and how many entries it holds. Never an entry, and never a word of one: each entry's hash is salted so it cannot be guessed. | You keep their signature and its date, and they keep yours; neither keeps the place. Later, a card you choose to show can prove an entry was already in your record by then, and that shows who witnessed it. |
| A card you publish to an organisation's shared notebook | Yes, the card | The organisation's server stores it. You can take a card back. It stops being shown at once; it cannot make anyone forget what they already read. The stored copy is kept, and no longer served. Whether stored copies should be deleted is still being decided. |
| Model calls | Only if you turn a model on | By default no model is on, and nothing is sent. If you turn one on, you choose the provider: a local model on your own computer, where nothing leaves, or a cloud provider, which receives the entries each pass reads. The passes that read your entries are: finding your faces, proposing what matters now, and sorting new entries into faces. Your 3P writes down every call: when, which provider, where the words went, and how many characters, never the words.
Local by default; cloud only when you say so, each time. Your entries go to a local model by default. A cloud model gets them only if you opt in for that one run, after 3P shows you exactly what would be sent, word for word, and only what you saw is sent. Your yes, and each send, are written in your access log. Your mirror is never sent, to any model. |
| Voice notes | Only with a provider you choose | They are transcribed either on your computer, or by a transcription provider you choose. With a provider, the audio goes to that provider. |
| What an assistant reads | Only what you allowed | An assistant is not you. It asks before it reads, and you allow each thing separately: reading, writing, signing, publishing. What it reads goes wherever that assistant runs. This holds for assistants that go through 3P. Software running as you on your computer can read your record file directly. |
| This website | Two fetches, named here | No analytics, no cookies, no requests to other sites when a page loads. The card checker fetches only two things: the sample cards, from this site; and, when a card names an organisation's domain, that domain's key file, which tells that domain a card is being checked. The browser record sends a card only when you publish it, and only to the shared notebook address you type. The pages are served by GitHub Pages, which, like any web host, receives the requests for them. |
On your computer
Your record is one file on your own computer. 3P does not encrypt that file itself: it relies on your computer's disk encryption, such as FileVault on a Mac. Turn it on.
This is not a legal privacy policy. It says what the code does today. The legal text is the project owner's to write, and it is not written yet.