Prelaunch · privacy notice
Your need.
Your choice to hear from us.
Controller: Antonio Velasco. Privacy contact: privacy@peopleproof.ai. PeopleProof is a provisional project name, not a separate legal entity. Real registration, including optional notification emails, remains disabled: operation of the privacy mailbox, the general registration legal basis, applicable international-transfer information and actual provider recovery/backup settings have not yet been confirmed. The current flag is reported at /service.json. Do not send personal information as a test.
What this site collects
When registration is active, we store your non-confidential need summary, broad audience, work category, horizon, recurrence, optional budget band and currency, integration preference, self-declared discovery source, permission/prelaunch acknowledgements, test marker, timestamps, a random record identifier, idempotency key and a hash of your private capability. An optional notification_email and explicit notification_consent may be included in the same private record. We do not ask for your name, files, URLs, callbacks or payment information.
Do not put personal, sensitive or confidential information or secrets in the use case or audience. The optional email belongs only in its dedicated field. Text checks reject some obvious contact details and links, but cannot guarantee that free text contains none. Authorization is self-declared, not independently verified.
Optional availability notice
Providing an email is voluntary and not required for a future-use intention. Its sole purpose is one notice if PeopleProof becomes available within the record’s 30-day lifetime, on the basis of your explicit consent (GDPR Article 6(1)(a)). The checkbox is not preselected. An agent may provide an address only with its owner’s explicit permission. No marketing subscription or email sending is implemented; no notices are sent now. Delete the private response to withdraw consent and remove its email. Withdrawal does not affect earlier lawful processing. If no notice is possible before expiry, the record still expires; this is not an indefinite waiting list.
Purpose and access
The purpose is to understand potential future use of a human-evidence service and operate private read/delete access. Registration is not a study order, a subscription or authorization to spend. Test records are marked separately and must be excluded from demand analysis. Anonymous intentions do not establish unique buyers or willingness to pay.
The service runs on Cloudflare Workers and stores records in Cloudflare D1. Authorized project operators with database access and Cloudflare as infrastructure provider can process stored data. No public record listing, third-party analytics, advertising trackers or outbound callbacks are implemented. Cloudflare receives connection metadata, including IP addresses, to serve requests; the application does not control all provider infrastructure logs. Consult Cloudflare’s privacy policy.
Abuse prevention
The application stores hourly HMAC-derived IP buckets and capability-hash buckets for rate limiting. It does not store raw IP addresses or log request bodies or bearer capabilities. Buckets expire at the next hour. The secret is server-side. These are pseudonymous abuse controls, not a claim of complete anonymity. Browser same-origin protection does not authenticate non-browser clients; requests without an Origin header are allowed for agents.
Retention and deletion
Intentions expire 30 days after creation. Expired records cannot be read. Database deletion runs during API use and through an hourly scheduled purge. Rate-limit buckets are purged through the same mechanisms. If the deployment or scheduler is stopped, physical cleanup waits until it resumes.
Use your private capability through the form or the Authorization header to read or delete your record. Never place it in a URL. Deletion removes the active D1 record immediately; expiry also removes it from the active database. This is not forensic erasure. Cloudflare D1 recovery/backup systems may retain earlier versions under the account’s provider retention settings; the operator must confirm those settings before launch. Restored data must not reintroduce withdrawn records. Because deletion receipts are not retained, the safe recovery procedure is to discard all restored intention and rate-limit rows before reopening capture.
The capability remains only in this page’s memory unless you choose to save a local file. Anyone holding it can read or delete the associated intention. If lost, we cannot identify your record for self-service recovery; it will expire automatically. Your browser or agent host may retain history of submitted data: protect your own environment.
Before public capture
The publishing operator must confirm mailbox operation, the remaining registration legal basis, applicable transfer safeguards and recovery/backup settings before enabling real capture explicitly. These are launch blockers, not permission to collect first and explain later. Studies, recruitment and payments are outside this site.