Privacy policy

In short

• No biometric data is collected, requested or stored. Not once, not optionally.
• There are no passwords, because an account is a wallet.
• There is no analytics, no advertising and no tracking of any kind.
• A verification certificate is public on purpose, and what is anchored on a public chain is permanent — including for us.

What is stored

Everything below is either something you typed, something derived from it, or something a public blockchain already reports.

• Licence contents: the party names, campaign, rights, platforms, territories, dates and fee you enter, plus the canonical document and the two hashes derived from them.
• Signatures: a Solana public key, the exact message that was signed, the signature itself, and whether verification succeeded.
• Payments: a transaction signature, the payer and recipient addresses, and the amounts the chain reported. Public keys only.
• Proofs: the on-chain transaction signature, the memo, and the moment it was anchored.
• An append-only history of what happened to each licence and when. Nothing in the application updates or deletes a row in it.
• If you sign in: a wallet address, and a session token with an expiry. Name and e-mail exist as optional labels a user may add; they are never credentials and nothing requires them.

What is never stored

• Biometric data of any kind. No image or recording of a real person is required to create a licence, and none is requested. The demo portraits are AI-generated faces of people who do not exist.
• Passwords. There are none to store, reset or leak.
• Card numbers, bank details or any payment instrument. Settlement happens directly between two wallets and this application never touches the funds.
• Private keys or seed phrases. Signing happens in your wallet; we receive a signature.

The private contents of a contract are never written on-chain either. Only the licence identifier and the two hashes are anchored, and a hash cannot be read backwards into the document it came from.

What becomes public

A verification certificate is public by design. Anyone holding the licence ID can read the party names, the campaign, the scope, the fee and the signing wallets — that is what makes it useful to a brand or a platform that was not in the room.

So a licence ID is a capability rather than a secret. Treat it the way you would treat a contract reference: share it with the people who need to check the deal, and understand that anyone they share it with can check it too.

The scope hash exists partly for this reason. It lets a licensee demonstrate which rights were granted without disclosing who granted them or what was paid.

What goes on a public chain, and why that is permanent

One memo instruction per licence, containing the licence identifier, the document hash and the scope hash. Nothing else.

RightsProof|v1|HID-2026-8F3A92|<documentHash>|<scopeHash>|<timestamp>

Anchored data cannot be deleted, by us or by you. That is the property that makes a proof worth anything, and it is a genuine trade: in exchange for being able to prove a record existed unaltered, you accept that its identifier and fingerprints are permanent. This is why the contents are not anchored — only fingerprints of them.

Cookies

Three, none of them analytic:

• lang — your language. One year. Set when you use the switch.
• theme — light or dark. One year. Set when you use the switch.
• A session token, only if you sign in. httpOnly, so no script can read it, and sameSite=lax, so it does not ride along with cross-site requests.

The session it points at is a database row, which is why signing out ends it immediately rather than merely forgetting it: the token is dead even if the cookie survives.

Third parties

• Public Solana RPC nodes see the transaction signatures we ask them about, and the usual network metadata that comes with any request.
• Your wallet provider sees what you ask it to sign, and is governed by its own policy rather than this one.

There are no other processors. No analytics vendor, no advertising network, no session recorder, no error-tracking service, no embedded fonts or scripts loaded from someone else's domain.

Retention, revocation and deletion

A licence is never deleted. It is revoked — and the record stays public and verifiable, marked as revoked, with the reason kept in its history.

That is deliberate rather than lazy. A contract history that can be erased is not evidence, and the ability to make an inconvenient licence disappear would defeat the only thing this product claims to do. The database refuses to drop a licence that carries history, so the guarantee is enforced a level below the application.

Expired sessions are cleared whenever a new one is opened. Anything already anchored on a public chain is beyond anyone's reach, including ours.

What you control

• What you type. A licence contains what you put in it; nothing is enriched, inferred or looked up elsewhere.
• Whether to sign in at all. Reading and verifying need no account.
• Whether to sign. A wallet signature is yours to withhold, and the message tells you what it authorises before you approve it.
• Whom you give a licence ID to, which is the practical control over who can read the certificate.
• Your cookies, which you can clear at any time without losing access to anything.

Status of this policy

This describes a demonstration deployment, honestly and in full, but it is not a policy drafted for a jurisdiction and it names no operator, controller or contact — because there is none to name.

If you deploy this, that is the gap you must close first: identify who is responsible, say where they are, give people a way to reach them, and have the result reviewed. What is written above will remain true of the software; it will not be sufficient as your policy.

Demonstration data may be reset without notice. Do not put anything here that you would mind losing, and do not use it as the system of record for a real agreement.