Controller and notice status
Draft notice for the current implementation. The controller's legal identity and privacy contact are not yet supplied; see operator details. This is a material transparency gap, not a completed UK GDPR notice. Controller/processor roles, lawful bases, hosting agreements, international transfers, retention and rights-handling arrangements need confirmation. Do not submit patient data, identity documents, financial credentials or other sensitive material to this prototype.
Information used by current features
- Sign-in supplies the application with an account identifier through trusted hosting headers. It is used to isolate workspaces and authorize requested actions. The application does not ask for your ChatGPT password, browser credentials or wallet private key.
- Private workspace records include notes, hypotheses, exclusions, submitted accounting references, funding settings, resource preferences, purchase records and applications. They are scoped to the signed-in account by the application; authorized hosting administration and lawful operational access may still apply. This is not end-to-end encrypted storage.
- Public network records include Node names, IDs, platform labels, activity timestamps, signing public keys, signed job results, commitments, ledger transactions and research-asset references. Pool names, descriptions and member Node IDs are public. These identifiers can be linkable to people; pseudonymous does not mean anonymous.
- Published product slabs expose listing descriptions, licence text, content hashes, prices and supplied public business/fulfilment details. Product delivery content and drafts are not intended as public catalogue data. Never put a home address, private phone number or secret in a public listing field.
- Driver/rider applications currently store the display name, city, country, licensing authority, work and vehicle type, consent flags and provider status references. No document-upload or live screening flow is currently connected.
- Sandbox checkouts store the quote, product reference, total, fee, invoice/session reference and verified test settlement status. The application does not collect card numbers. Payment details would be entered on the provider's hosted page only after a configured connection and explicit user action.
- Local game saves, browser Node keys and offline assets use device storage as described in cookies and storage. Optional portrait/video input is processed locally by the current game; it is not uploaded or saved with the local game save.
- Hosting infrastructure may process IP addresses, request URLs, authentication/security records and error logs to deliver and secure the service. Exact provider settings, locations and log retention have not been verified in this release.
Purposes and lawful bases to confirm
The proposed purposes are providing the features you request, keeping accounts and signatures secure, recording contribution/fulfilment evidence and responding to legal obligations and complaints. The named controller must assess the appropriate basis for each processing activity: requested service performance, a documented legitimate-interest assessment where applicable, specific legal obligations or genuine consent for optional processing. Reading or accepting terms is not blanket consent to all data uses. This draft does not assert that an incomplete commercial contract establishes a lawful basis.
There is no advertising or analytics code added by Etheraio in this build. There is no facial identity matching, medical profiling, model training on portraits or solely automated employment/licensing eligibility decision. Any future sensitive-data research, biometric identification, marketing or materially different purpose requires separate review and notices before collection.
Recipients and transfers
Sites/OpenAI and Cloudflare provide hosting/authentication infrastructure. Stripe, BitPay and Certn are selected integration candidates; merchant and screening connections are not active. A user opening an external link is subject to that provider's notice. Future supplier fulfilment, processors and cross-border transfers must be mapped with appropriate contracts and safeguards. No blanket permission to sell personal data is created. Contributions explicitly published to the ledger can be read and copied by anyone.
Retention and deletion
Workspace and ledger records currently persist in the hosted database. Automatic account erasure and a full retention schedule are not implemented. Invitations expire after ten minutes and jobs after two minutes; expired records are pruned on related operations, not by a guaranteed timed deletion service. Game media remains in the local session until replaced, removed or the page closes; device saves, keys and cache remain until you remove them or clear that site's storage.
The operator must justify retention periods for each category and implement deletion/archival procedures before production use. Public ledger copies may remain outside the operator's control; publication is not an excuse to ignore lawful erasure, restriction or correction requests. Never publish sensitive personal data to the ledger. Backups, provider logs and legal retention exceptions need a documented policy rather than an invented deletion deadline.
Your choices and rights
Depending on the circumstances, privacy law provides access, correction, erasure, restriction, portability and objection rights, and withdrawal of consent where consent is used. A working operator privacy contact and proportionate identity-checking procedure must be supplied before this notice is finalized. You can independently complain to the ICO or the relevant authority in your country. Rights requests must not require disclosure of Node private keys. Removing local browser storage is not deletion of hosted records.
References: ICO privacy information and ICO retention guidance.
Optional research memory
Research prompts are saved privately only when the Remember choice is checked (64 prompts per account, maximum 2000 characters each). They can be cleared on /learning. Raw prompts are never shared or used to train model weights in this release. Querying can retrieve up to five relevant opt-in verified computation lessons with their evidence and applicability conditions. Matching words is not scientific confidence. A Node must separately opt in per job to add a successful deterministic computation to public memory (latest 256 lessons). This does not establish clinical efficacy or generalize beyond the recorded task. Public block evidence remains on the chain after local or account memory is cleared.
Downloadable local AI starter
The optional local AI starter sends chat prompts only to its loopback Ollama runtime and stores question history locally only when requested. Network-learning opt-in downloads public verified evidence without uploading prompts. It can train a small local classifier from verified examples and retrieve evidence for a separately installed model; it does not retrain that model’s weights. Optional live sync occurs only while its window is visible. Model and runtime downloads are separate third-party products with their own published licences and notices.