Privacy

What we store

• Your sealer name. Public by design: a track record with no name certifies nothing.
• Your password, hashed. We store only a scrypt derivative. We can neither read nor recover it.
• Your email, if you give it to us. Optional. We also store it if you enter it at payment, so we can send your receipt and reply to you. We never use it to write to you without reason.
• What you seal. The text, its criterion and its dates. A private seal is not published, but it is in our database, unless you use in-browser encryption, in which case we store text unreadable to us.
• Your IP address, temporarily. We use it only to limit abusive sign-ups, and it is deleted automatically after an hour.
• A session cookie. Strictly necessary to keep you signed in. We store only its hash, so leaking it would not allow impersonating you.

Who else sees it

These are all the third parties that process data on our behalf. There are no others, and we neither sell nor share data with anyone.

• Cloudflare. legal.privacidad.subencargados.cloudflarePara legal.privacidad.subencargados.cloudflareDatos
• Supabase. legal.privacidad.subencargados.supabasePara legal.privacidad.subencargados.supabaseDatos
• Dodo Payments. legal.privacidad.subencargados.dodoPara legal.privacidad.subencargados.dodoDatos
• DeepSeek. legal.privacidad.subencargados.deepseekPara legal.privacidad.subencargados.deepseekDatos

You should know this explicitly: when you seal, the text of your falsification criterion and the URL of the source you name are sent to DeepSeek to automatically check that the criterion is decidable. The text of your prediction is NOT sent. If you'd rather nothing left at all, write the criterion without personal data.

How long

Seals are kept as long as the registry exists: they are the product, and deleting them would break proofs already issued to third parties. Attempt and rate-limit marks delete themselves within an hour. Sessions expire and are purged.

Your rights

You can ask us for access to your data, its correction, or its deletion. Write to soporte@cassandraregistry.com from the email associated with your account, or tell us your sealer name.

An honest limit: we can delete your account, your email and your private seals. We cannot withdraw a seal you have already revealed publicly. On revealing it, it entered an append-only registry whose integrity depends on not being rewritten, and there are third parties holding proofs issued against it. That is the price of the proof being worth something, and it's why revealing is flagged as irreversible before we charge you.

Where the data lives

The database is hosted in the United States and the site is served from Cloudflare's global network. If you write from the European Union, that means an international transfer, covered by each provider's standard contractual clauses.

Contact

For any privacy matter, including a complaint, write to soporte@cassandraregistry.com. If you are in the European Union, you can also complain to your country's data protection authority.