The Charter

What we cannot do to you.

This is not a privacy policy. A privacy policy describes what a company decided this quarter, and it can be rewritten the morning after an acquisition. These are statements about the shape of the system.

Every service that protects your identity collects your identity first. That makes it the most valuable target in the room — for a breach, for a broker, for a subpoena. It is the reason so many privacy tools eventually become the thing they were built against.

SOVRAN is built to be worthless to anyone who takes it.

A promise can be broken overnight. An architecture has to be rebuilt.

Your photographs stay on your device

Faces are matched locally. The image is never uploaded, and there is no copy of it to lose.

This is also what makes searching for a face ethical rather than dangerous. We do not build an index of faces. A search begins with a name you give us, returns candidate listings to your device, and your device decides which are you. There is no stored face geometry belonging to anyone — not you, and not the strangers whose photos those sites published without asking.

We never ask who you are

No name, no address, no phone number, no date of birth, no government document. An account is an email address you choose and a passphrase you generate. If you use an alias, we will not check — there is nothing here to check it against.

One honest exception, stated rather than buried. Searching people-search sites requires a name, because those sites are indexed by name. So you type one in and we search for it. That name is used for that search and discarded — not written to a database, not attached to your account, not kept afterwards. You are telling us something for a moment; we are not collecting it. If you would rather we never saw it at all, do not use that feature. Everything else works without it.

III

Your notes are sealed before they leave you

Encrypted with a key derived from your passphrase, in your browser, before anything is sent. We hold ciphertext and cannot open it — not for a court, not for ourselves. The cost of that being real is that a lost passphrase cannot be recovered by anybody. We would rather say so plainly than offer a reset that proves we could have read it all along.

Nothing you search for is written down

No query logs. No history. No behavioural profile. There is no record of your use to hand to anyone, which is why we will not add an AI assistant — the questions people would ask it are the most sensitive sentences they will write all year.

Where a search must touch our servers, we keep counts and never terms. Some things cannot run entirely on your device — querying hundreds of broker sites is one of them. For those, we record that a request happened and nothing about what it contained. A number like “forty searches from this address today” is enough to stop abuse and to keep the service standing up. The words you typed are not stored, not logged, and not recoverable afterwards. We would rather write that limit down than let you find it later.

We never sell, and never take money from anyone who does

No advertising. No data brokers. No investment from anyone whose interests require us to reverse this later.

You can end it completely

Delete your account and everything goes with it. Not flagged, not moved to a suppression list, not kept for compliance. The row is gone, because there was almost nothing in it to begin with.

VII

We never block you for how you connect

Use a VPN. Use Tor. Use a borrowed phone on someone else's wifi. We will not throttle you, challenge you, or treat you as suspicious for it. Protecting yourself is not suspicious behaviour — it is the behaviour we recommend.

VIII

Nobody is turned away for lack of money

If you cannot afford it, you say so and we believe you. No proof of income, no benefits letter, no case number, no review. We will not ask you to document being poor in order to be protected — requiring that proof would mean building a database of exactly who is vulnerable, which is the thing this entire project exists to argue against. How that works →

How to check we mean it

A charter nobody can verify is just nice writing. Three of these are checkable right now, by you, without asking us.

Turn off your connectionThen use the Photo Check, the Audit, the Guide, the Map, or the Passphrase generator. They all still work. That is only possible because nothing is being sent anywhere. It is the fastest way to verify Articles I, III and IV without taking our word for anything.

Read the CanaryA statement we renew on a schedule, saying we have received no secret order. Data leaves a company three ways — a breach, a sale, or a legal demand nobody is allowed to tell you about. The third is the one no promise can prevent, and this is the only defence against it that works. Check its status →

Look at what an account holdsAn email address, a random salt, a hash that only proves identity, and a block of ciphertext. That is the complete list, and it is written on the account page before you sign up rather than buried after.

What is not settled yet

Three things are still open. They are listed here because a charter that only describes what already works is marketing, and because you should be able to hold us to what we said before we did it.

The identity check for face search. We will never take a government document. The plan is a live selfie enrolled on your device, so the account is bound to a face rather than to a legal name. Until that is built, face search does not exist.
How payment stays separate. The intent is that your payment and your account never share an identifier, so that no database we hold could connect them. The design is written down; it is not built.
Whether SOVRAN becomes a public benefit corporation. That would make this document legally binding rather than a promise on a web page. We are leaning towards it.

If we ever change one of these articles, the change will be announced rather than quietly edited. That is not itself enforceable — but saying it here makes it harder to do otherwise.