Privacy Proof

derëalhouse — a DERËAL world

The promise, made checkable

Do not trust the promise — check it. This page lists everything the world holds about a citizen, and everything it never holds. Nothing is left off on purpose.

And you do not have to take this page's word for it either. Inside the world, Download my world shows you your own actual rows — the real file, not a summary of it. The last section of this page tells you how to check, step by step.

Everything we hold about you

Your account

Your email address. The address your account is made with.
Your citizen number. The number given to you when your email was proven. It is yours alone.
Your password, only as a scrambled hash. The password itself is never held — only a scrambled hash we cannot read, checked against what you type when you sign in.
Two moments. When your account was made, and when your email was proven.

The sign-in guard

One-time codes, held only as hashes. A code is held only as a hash, with its purpose, the time it runs out, a count of tries against it, and when it was used. A spent or expired code's hash stays with your account until you delete it. The plain code travels by email only and is never held.
A failed-guess counter and a lockout time, while they last. When wrong passwords keep coming, a counter climbs and a lockout time is set, so guessing slows to a stop.
Your session, only as a hash. A session is held only as a hash of its token — the token itself is never stored — with the times it was made and last moved. The session dies after 15 quiet minutes, or the moment you sign out.
A short-lived passkey challenge, while you use one. While you are adding or using a passkey, a challenge is held briefly so the answer can be checked, then it is gone.

Your profile

What you put there. Your name, your bio line, your photo if you added one, and the links you added.
Your assistant, if you connected one. Its name and its link — only the one you chose to connect.
Your birth month and your birth day only. The month and the day, and nothing more of your birthday than that.
The space your birthday assigns. Held as a number that points to your space, so the world can take you to it.
Your days here, in plain numbers. When you joined, your last visit day, your days inside, and your streak days.
When your space was lit, and by whom. The day it was lit, and the citizen number of the citizen who lit it.

What you make and do inside

Your signals. The words you share inside, including voice recordings, replies with their Heard lines — the line that says what you heard first — and welcomes written to new citizens.
Pulses you gave. A mark that you rested your hand on a signal, and when.
Your sealed capsules. Capsules you seal for a later day — their words stay sealed until their day comes.
Your creations, and the layers on them. The things you make, and the layers mates added to them in their own light.
Pulses you gave on creations. A mark that you rested your hand on a creation, and when.
Your passkeys, as public-key material only. The public half of a passkey, the passkey's own identifier, a use counter, and when you added it. Your face and your fingerprint never leave your device — we never see them and we never hold them.
Past ritual lines, if any remain. Lines left from before that feature was retired, kept only so they stay yours to take or delete like everything else here.

Held for the world — not about a person

Anonymous shield counts. When a browser reports that the world's shield stopped something, only a count is kept: the day, the rule, and the kind of source — for an outside source, its site name, never a page on it. Never a page, never an address, never a person.
The world's signing key. A secret the world itself holds, used to seal creations so their seals can be checked later. It is a world secret, not citizen data, and it is never handed out.

What we never hold

No birth year. Your birth year is checked at the door to prove you are 18 or older, and it is never stored.
No plain secrets. No plain password, no plain one-time code, and no plain session token is ever held — hashes only, as the lists above say.
No biometric data. Nothing about your face or your fingerprint is ever sent to us, seen by us, or held by us.
No activity log. There is no activity log here — no diary of clicks, pages, or time spent. Less held is safer held.
No location. The world does not hold where you are.
No device fingerprint. The world does not build a picture of your device to follow you by.
No ad trackers, no third-party analytics. No company follows you around this world, and nobody follows you out of it on our behalf.
Nothing sold, nothing shared. What is held is never sold and never shared with advertisers or partners. Citizens are not the product.

Check it yourself

Download your world. Sign in and use Download my world. The file you get is the list above, yours: your account, your profile, your signals, capsules, creations, and the rest — with three honest limits. First, the security machinery is never exported: your password hash, code hashes, session hashes, and lockout counters stay inside, because they are how the guard works, not your world. (The seals on your creations DO travel with them — they are your receipts, made to be checked.) Second, passkeys appear only as an id, the moment they were added, and a use counter — never as key material. Third, a sealed capsule's words stay sealed even in your own file until its day comes: the file carries the capsule and its day, not its words.
Delete your account. Deleting takes your password and the word DELETE, typed exactly. When you delete, everything above goes with it — account, profile, and everything you made and did inside — and your citizen number is never handed to anyone else.
Check a creation's seal. The creations in your export carry a seal you can check any time at the world's verify endpoint, even after you leave. If the receipt itself was changed after you took it, the seal will not match — the proof holds whether you are still a citizen or not.