We verify artifacts, not people.
The system is designed so the person scanning is never identified. That is the product, not a setting — and this page changes in the same change-set as the architecture it describes.
Scan telemetry is off by default and leaves the device only if you explicitly opt in.
If you opt in to scan telemetry
The Reader reports anonymous scan events: what kind of event happened (verified, denied, resolved), the artifact and issuer it concerned, and a timestamp. When an event arrives through our edge network, it is recorded with a country-level region; your IP address is not stored. You can turn it off again at any time; nothing already sent identifies you.
What issuers see
An issuer’s dashboard counts verification events: which code, which verdict, when, and a country-level region. There is no scanner profile to export, because none is built. Metrics name events, not people.
Issuers and their holders
Issuers are signed-in customers; their Studio actions are recorded by design — who approved a key, for which device, when. A holder key names a device fingerprint and the attributes it opens, never a person. When your phone holds a holder key, it signs each door request with it, so the vault records which holder key a door was opened or refused for.
If you sign in to the issuer seat
The Reader has a second lane for issuers, behind a sign-in to their own studio. Holders never need it, and until someone signs in it sends nothing. Once signed in, it uploads enrolment images and holder attributes to that studio, and keeps a session sealed in the phone’s hardware keystore for up to about 30 days. Signing out removes it.
Verification is local
A verdict is computed on your phone against a trust list it already holds. No lookup, no call home, no record of who was standing there. The one network act the holder lane offers — syncing the trust list — fetches a signed file and sends nothing about you.
This text is the product’s privacy posture, kept in lockstep with the design records that define it. A policy that drifts from the architecture is worse than no policy.