Privacy

Anonymity that is enforced, not promised.

42-True

Architecture

The two-key design

The commercial proposition depends on the exported data being genuinely anonymous. That is a technical claim, so here is what backs it.


          INTERNAL (never leaves our database)     EXPORTED (what a licensee receives)
─────────────────────────────────────    ────────────────────────────────────
user_id                                   unlinkable_token
pseudonymous, in GDPR scope,              HKDF-derived, scoped per release,
links to a person                         not linkable to a person by anyone

The link between a person and their contribution lives in a ledger that never leaves our infrastructure. The exported record carries only a token that is regenerated for every release.

This is what makes “we license anonymous data” true by construction rather than by assertion. A licensee genuinely cannot get back to a person, while we can still attribute a contribution to the person who earned it.

42-True

Architecture

The pseudonym

Tokens are derived using HKDF-SHA256 from a high-entropy key held as an environment secret, with domain separation between distinct identifiers, seeded on a random per-signal UUID and scoped to the release.

The key is not in source, so the token cannot be reconstructed from our published code.
Two identifiers that should be independent are derived from separate contexts.
Records cannot be joined across releases. Cross-release correlation is not merely prohibited by contract; it is unavailable.
If the key is absent, export fails closed. No key, no publication.

42-True

Enforcement

Text scrubbing, and knowing when it did not work

Free text passes through two layers: a deterministic pass for structured identifiers (email, phone, IBAN, card), then an AI pass for names and addresses.

The important part is what happens when the second layer fails. The achieved level is recorded on the record — regex_ner (both ran) or regex_only (the name pass did not). A record at regex_only is refused publication by rule R13b.

We learned this the hard way. The AI layer was silently degrading in production, and a value that had dodged it was indistinguishable from a fully cleaned one. Recording the achieved level is what made the failure visible. Every record in the current release achieved regex_ner — the full pass — because anything less is refused publication rather than downgraded quietly.

42-True

Enforcement

Quasi-identifier controls

Timestamps are coarsened to the hour — on every export path, including internal inspection tools, because a guarantee that depends on which door you came through is not a guarantee. Event sequence is preserved by array order rather than by timestamps.
k-anonymity is enforced at build time. Any region with fewer than 10 records is suppressed: the region and its confidence become null, and the locale falls back to bare language. The record carries region_suppressed: true, distinguishing a withheld region from one that simply could not be resolved. It is applied as a function of the data, so a region reappears automatically once the corpus grows past the floor.
Free-text notes are never exported. When a user explains why a match was wrong, that prose is the single most likely place for something identifying about their life. It is captured, it is scrubbed, it informs our own matching work — and it never enters a licensable artifact. That was decided while every stored value was still empty, so nothing had to be retracted.
Declaration length is bounded. Past roughly a thousand characters, text stops being a search and starts being biography.

Zero regions below the floor survive in the current release, and a large share of records currently have their region suppressed as a result — with few contributors, most regions sit under k=10. That share falls automatically as the corpus grows, and it is one of the figures published at 100 contributors.

42-True

Consent

Consent, and what the records do not claim

Every record carries the scope it was collected under. Today that is ["ad_matching"] on every record, and the validator refuses to publish any record claiming a scope that has not been granted.

Two properties are worth calling out because they are unusual. The rights are per record, not per corpus — scope lives on the record and travels with it, so a downstream filtering step is checkable rather than a matter of trust. And we refuse to publish records claiming rights they do not have: that is validator rule R07b, not a policy document.

Third-party model training is a separate permission that does not yet exist. No record asserts it. Which means this corpus is not currently licensed for third-party model training — and we would rather tell you that here than let you find it in a schedule.

42-True

Provenance

Provenance you can hand to your own legal team

For an AI lab this is often the binding constraint, not volume. A dataset is only useful if you can establish where it came from and what you are permitted to do with it.

What you need to show	What the corpus carries
Where each record came from	`provenance.operator` and `operator_version` on every record
That it has not been altered since we produced it	Ed25519 signature per record, verifiable offline against a published key
What you are permitted to do with it	`consent_scope` on every record, enforced at export — a record cannot be published claiming a permission that was not granted
That the people in it agreed	Declarations are typed by users into a product built around declaring intent. No scraping, no third-party acquisition, no inferred profiles
That deletion propagates	Every release is a rebuild; a deleted account is absent from the next one
Which vocabulary a label used	Taxonomy version and a content hash of the dictionary, so a code always resolves to the exact vocabulary in force

42-True

Contributors

Contributor ownership

Users can download their own contribution, in the corpus record shape, from within the product.

The identifiers in that personal export deliberately do not match any published release. Stamping it with the live release id would let a user point at “their” rows in the licensed corpus — and would hand the same capability to anyone who obtained a copy of the file.

42-True

Have it tested

We would encourage you to check the claim rather than take it from us

We can show you the mechanism, the enforcement in the validation gate, and an independent scheduled re-check that re-derives the whole corpus and reports failures per rule. The Record tab describes the gate itself.

Email [email protected]

Profila privacy policies