What we promise — and how each promise is enforced
A privacy policy is a sentence. Below each sentence is the mechanism that makes it true, so you can check rather than trust.
“Your data is encrypted”
Every personal field is AES-256-GCM, under a key generated for you alone. That key is itself encrypted with a master key that lives in a file outside the code and outside every backup of the database. A stolen database is a pile of authenticated ciphertext with no key in it.
“Companies only get what you allow”
A permission is a row of (field, purpose) pairs you ticked. Every request names a purpose; a mismatch is refused and written down as a refusal. An app cannot even ask for a field it did not register in advance with a written reason.
“They cannot use it for anything else”
Marketing, profiling, advertising and resale are refused at the platform level — they are not purposes a company can register, and not purposes you can accidentally agree to. Contact details are relay-only, so the raw material for those uses never reaches them in the first place.
“You will know who used your data and why”
Every access appends a ledger row: time, app, field, purpose, allowed or refused. Each row carries the hash of the previous one, so a deletion or an edit anywhere breaks the chain from that point on. You can run the check from your own account and download the whole thing as JSON.
“Delete means delete”
Closing your account destroys your data key. Rows sitting in old backups become unreadable at the same instant — which is the one deletion that a backup tape cannot undo.
What we hold about you
Only what you typed in: name, email, and whatever else you chose to add. No tracking pixels, no third-party scripts (this page loads nothing from any other domain), no advertising identifiers, no profile built from your behaviour. The ledger records that a field was read, never the value.