Privacy Policy

1. Who We Are

The Sites — primedirective.dev and conscience.wiki — are operated by the Universal Primary Directive stewardship, and the Directive is stewarded by the Universal Primary Directive Foundation (in formation; to be federally incorporated under the Canada Not-for-profit Corporations Act), with its registered office in Ontario, Canada.

For data protection purposes we are the data controller for the information described in this notice.

Privacy and data-subject requests: privacy@primedirective.dev
General contact: human@primedirective.dev

2. What We Collect and Why

2.1 When You Adopt the Directive

If you complete the adoption ceremony at primedirective.dev/adopt, we collect:

• Your name (or pseudonym) — displayed in the public adoption ledger and on your personalised seal
• Your email address (optional) — used only to contact you about your adoption if necessary; never shared, never used for marketing
• Your adoption path (person, organisation, or AI) — recorded in the public ledger
• Your adoption date — recorded in the public ledger

Why: The public ledger exists for accountability and verification. Anyone can verify an adoption at conscience.wiki/verify. Your name and adoption date are public because transparency is one of the Directive's core values.

Your choice: You may adopt under a pseudonym. The ledger records whatever name you provide. If you prefer not to have any public record, you may deploy the Conscience without completing the formal ceremony — the text is CC BY 4.0 and freely available.

2.2 When You Contribute to the Wiki

If you submit a contribution to conscience.wiki (a commentary, a Safe Word test result, or a deployment guide update), we collect:

• Your name (or pseudonym) — credited on the contribution if published
• Your contribution content — reviewed by the steward and, if accepted, published on the wiki

Why: Attribution matters. Contributors deserve credit for their work.

Your choice: You may contribute under a pseudonym.

2.3 When You Visit the Sites

We use Vercel Analytics to understand how many people visit the Sites and which pages they view. Vercel Analytics is privacy-respecting:

• It does not use cookies
• It does not track individual users
• It does not collect personal data
• It does not follow you across the web
• It provides only aggregate data (total page views, visitor counts)

We do not use Google Analytics, Facebook Pixel, or any other tracking service.

2.4 When You Make a Financial Gift

If you make a voluntary gift through our donation page, payment is processed by Stripe. We do not see or store your credit card number or payment details. Stripe handles payment processing under its own privacy policy (stripe.com/privacy). We receive only a confirmation that a gift was made and the amount.

2.5 Server Logs

The Sites are hosted on Vercel. Vercel may collect standard server logs (IP addresses, browser types, timestamps) as part of its hosting infrastructure. These logs are governed by Vercel's privacy policy and are not accessed by the stewardship for tracking or identification purposes.

2.6 Adopting Under a Pseudonym

You choose how you appear on the public record:

• Public name — your real name appears on the ledger.
• Pseudonymous — a name of your choosing appears on the ledger. If we hold any link between that pseudonym and your real identity, we keep it in private records and never publish it.
• Organisational — the record identifies an organisation rather than an individual.

Please understand that pseudonymity is not anonymity. Someone determined to identify you might do so by combining your pseudonym with information available elsewhere. We publish nothing that would assist this — no IP addresses, no timestamps beyond the adoption date, no technical fingerprints — but we cannot prevent it entirely.

4. Cookies

The Sites use no tracking cookies. If any essential functional cookies are used by the hosting infrastructure (Vercel), they are limited to technical necessity (such as load balancing) and contain no personal data.

We do not display cookie consent banners because there are no non-essential cookies to consent to.

5. Data Retention

• Adoption records are retained permanently in the public ledger. This is by design — the ledger is the public record of the Directive's adoption, and its permanence is part of its accountability function.
• Contribution content is retained permanently once published. Unpublished submissions (GitHub Issues) are retained for stewardship reference.
• Analytics data is retained according to Vercel's data retention policies. No personal data is included.
• Email correspondence (if you contact us) is retained for the purpose of responding and for stewardship records.
• Any pseudonym-to-identity mapping is retained until you ask us to erase it.
• Confirmation email addresses are discarded once the confirmation completes. They are never published on the ledger.
• Consent records (the timestamp, the version of the disclosure you were shown, and your chosen identity class) are kept privately as our accountability record for the lawful basis of processing. They are not published.

6. Your Rights

Under the GDPR and, where applicable, other data protection laws, you have the following rights:

To exercise any of these: email privacy@primedirective.dev. We will respond within one month. If your request is complex we may extend this by up to two further months, and we will tell you if we do.

What erasure means here — please read this before adopting

Adoption records are cryptographically signed. A signature, once published, is mathematically permanent and may have been copied by others. We cannot un-sign it, and we cannot recall copies held by third parties.

When you ask us to erase your information, we will:

• Delete any private mapping between your pseudonym and your real identity. If you adopted pseudonymously, this severs the link between the public record and you as a person.
• Revoke your public record, so your adoption is no longer presented as active anywhere we control.
• Remove your record from listings, search surfaces, and directories we operate.
• Delete any other information about you that we hold.

What we cannot do is reach into copies of the signed record held by others. We tell you this before you adopt so the choice is genuinely informed.

6.1 For European Visitors (GDPR)

If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation, including the right to lodge a complaint with your local data protection authority. Our lawful basis for processing is consent (for adoption and contributions) and legitimate interest (for analytics and site operation).

6.2 For Canadian Visitors (PIPEDA)

We comply with the Personal Information Protection and Electronic Documents Act. You have the right to access, correct, and challenge the accuracy of your personal information held by us.

7. Children

The Sites are not directed at children under 16. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 16, we will delete it promptly.

8. International Data Transfers

The Sites are hosted on Vercel's global infrastructure. If you access the Sites from outside Canada, your data may be processed in Canada or other jurisdictions where Vercel maintains servers. By using the Sites, you consent to this transfer. We ensure that any data processing complies with applicable privacy laws regardless of where it occurs.

9. Data Security

We implement reasonable measures to protect your data, including:

• HTTPS encryption on all pages
• Secure serverless functions for form submissions
• No storage of payment details (handled by Stripe)
• No user accounts or passwords to be compromised
• Minimal data collection as a fundamental principle

No system is perfectly secure. If we become aware of a data breach that affects your personal information, we will notify you and any relevant authorities as required by law.

10. Third-Party Services

The Sites use the following third-party services:

We do not use social media tracking widgets, embedded advertising networks, or any service whose primary business model is surveillance or data brokerage.

11. Changes to This Policy

If we make significant changes to this policy, we will note the changes on the Sites and update the "Last updated" date. We will not make changes that contradict our core commitments — particularly the commitments in Section 3 ("What We Do Not Do").

12. Contact

For a data-subject request — access, correction, erasure, restriction, portability, objection, or withdrawal of consent:

privacy@primedirective.dev

For any other privacy question or concern:

human@primedirective.dev

We will respond within one month, and will tell you if a complex request needs longer.