In development for Canada and the United States

Privacy

Your identity. Your permissions.

Participant controls portable identity. RMR requests access rather than claiming ownership. This notice distinguishes today’s waitlist from the planned application.

PRIVACY-01Privacy

Minimum disclosure

Concept · planned
Private credential boundary
  • Identity document
  • Photograph
  • Address evidence
  • Committee notes
  • Other credentials
Permitted result
  • Current participation status?
  • Current
Minimum claim. Maximum control.

What this notice covers

This notice applies to the prelaunch public information site and describes the intended privacy posture for the future civic application.

Prelaunch form collection

The current form does not collect a precise address, legal identity, representative ratings, political opinions, or identity attestations. It collects only an email address and a consent flag.

The service also stores an internal signup identifier and creation time, plus fixed early-access classification values. The interactive demos keep choices in page memory only; no civic signal is submitted.

Data minimization

The prelaunch form collects only an email address and a consent flag. The future application is designed to request only the minimum claim required for a civic action.

Participant-controlled portable identity

RMR does not automatically receive a participant’s Civic Ledger profile. You initiate portability and choose which claims, settings or profile components RMR may use.

Scoped permissions

Permissions should be scoped to the action, purpose and data required. A qualifying Checks and Balances credential may establish current verification, applicable jurisdiction, mission eligibility or duplicate prevention without transferring the underlying identity profile.

Revoking application access

Application access can be revoked prospectively. Data already legitimately processed may remain subject to disclosed retention and legal rules. Revocation is not a promise to erase prior public records or every previously processed copy.

Private data stays out of the public Mirror State

Private profile data is not placed into the public Mirror State. The participant controls the keys and authorizes access. RMR must not require transfer of an identity-control private key.

Location and use

The planned application will use general location or participant-authorized jurisdiction information. The current waitlist uses email addresses for project updates and early access; it does not collect political opinions or precise location.

No Social Credit Covenant

No Social Credit Covenant

No social credit scores shall be created with this technology by Civic Ledger AI Ltd. or Checks and Balances Committee Ltd., or in any implementation that either company develops, operates, governs, or licenses.

Citizen identity, lawful speech, political beliefs, associations, ratings, petitions, voting choices, evidence submissions, criticism, and use of civic tools shall not be combined into a generalized reputation, conformity, loyalty, eligibility, or trustworthiness score.

Prelaunch signup data, future credential status, and civic participation data shall not be used to determine access to unrelated services, employment, housing, credit, insurance, mobility, benefits, or ordinary civil rights.

Participation labels

Participation labels are not reputation scores

The future application may distinguish current authenticated participation, unverified participation, and anonymous public input. It may also use narrow credential, duplicate, moderation, and evidence-review states.

These purpose-specific states must remain transparent, contestable, and separated. They may not be combined into a portable citizen reputation or social-credit score.

Contact

Privacy questions may be directed through the project’s GitHub repository or the contact channel listed on the site.

Legal review

Canada and United States legal review required

This draft is product copy, not legal advice. Legal review in Canada and the United States is required before the operational application launches.