Privacy Policy

• Status: DRAFT (Active Development / Evaluational Period)
• Owner & Operator: William Raiford (https://ibgib.space)
• Copyright: Copyright (c) 2016–2026 William Raiford. All rights reserved.
• Privacy & Licensing Inquiries: ibgib.info@ibgib.space (preferred) or ibgib.info@gmail.com
• Effective Date: August 21, 2026
• Last Updated: November 3, 2026

1. Introduction & Overview

Welcome to ibGib (operated by William Raiford). We are committed to transparency, cryptographic self-sovereignty, and user privacy.

This Privacy Policy is currently in draft status while the ibGib platform is under active research and development. It explains how ibGib (including ibgib.space, ibgib.com, and related source-available applications and libraries in the ibgib monorepo) collects, uses, stores, and protects your information when you interact with our network, services, and applications. For software licensing, hosted Terms of Use, commercial terms, and prior art disclosures, please see our Licensing & Terms page.

2. Categories of Information We Collect

A. Identity & Public Directory Data

When you create an account or link authentication methods, the following information is recorded in your identity keystone:

• Chosen Username: A human-readable identifier (e.g. alice).
• Registered Email Address: Provided during account creation or SSO linking to enable account discovery, verification, and recovery.
• Public Keystone Timeline Addresses & Challenge Commitments: Cryptographic ib^gib Temporal Junction Point (tjp) timeline addresses and mathematical challenge hashes (H = Hash(S)) that define your identity's evolution timeline.
• Registered Device Delegate Tags: Public labels for internal challenge pools or external delegate keystones authorized to sign or sync on your behalf (e.g. pwd-alice-desk-a9a0, passkey-mobile-b4c1).

B. Technical, Connection & Log Data

When accessing our hosted web nodes, standard operational connection data may be logged:

• Internet Protocol (IP) Address and approximate geographic origin.
• HTTP/TLS Request Metadata: Date/time of request, HTTP status code, URL path, and TLS cipher suite.
• User-Agent Strings: Browser type, operating system, and client application version.
• Retention: Operational and access logs are retained for a bounded window (typically 30 to 90 days) strictly for system reliability, rate limiting, intrusion detection, and security forensics, after which they are automatically rotated and deleted.

C. Workspace & Application Data

• User-Created Content & Your Own Licensing: Notes, comments, source code, graph nodes, and files stored within your tenant workspace remain 100% your intellectual property under whatever license you choose to apply to your own Cosmoses.
• Storage Status: Workspace data is stored in tenant-isolated domain spaces. Data in transit is encrypted via TLS 1.3. Data at rest on the server is currently stored unencrypted within your isolated space directory (client-side data encryption is planned as a future capability).

3. Public Directory Nature of Identity Keystones

Keystone Timelines, Delegation & Hash-Reveal Strategy vs. Conventional PKI

ibGib identities combine closely related innovations—Keystone hypergraph stone timelines, internal and external verb-scoped delegation, and stateful hash-reveal challenge strategies:

• Keystone Identity Timelines: Rather than tying identity to a static certificate issued by a centralized X.509 Certificate Authority (CA), an ibGib Keystone is a linearly evolving, non-branching hypergraph stone timeline identified by its Temporal Junction Point (tjp). (While the Keystone timeline structure itself is also designed to serve as an official chain-of-trust audit log for conventional asymmetric PKI public keys with out-of-band challenges, ibgib.space currently authenticates identity transitions using the stateful hash-reveal strategy described below.)
• Internal & External Delegation: Keystones support both Internal Delegates (dedicated challenge pools embedded inside a Keystone for specific allowed verbs/custodians) and External Delegates (separate registered Delegate Keystones that evolve along their own independent timelines to sign operations such as device synchronization without bloating the primary Keystone timeline).
• Hash-Reveal Challenge Pools (Instead of Wire-Exposed Asymmetric Signatures): Combined with Keystones, ibgib.space utilizes a stateful Zero-Knowledge Proof (ZKP) and symmetric hash-reveal challenge-response strategy rather than relying on conventional asymmetric digital signatures (RSA, ECDSA) on the wire.
• Public by Design (With Anti-Harvesting Protections): Identity Keystones function as public directory records. Anyone on the network who knows your username or email address can query the server to retrieve your public keystone for authentication and verification. However, automated scraping, bulk harvesting, unsolicited spam, or AI/ML training on public keystones and email addresses is strictly prohibited under our license and service terms.
• Zero Secret Exposure: Public keystones contain only public challenge hashes (H). Revealing a challenge hash gives an observer zero ability to compute your private secret pre-image (S) or act on your behalf.
• Application-Layer Passkey Secret Generation & Password Isolation:
  • Passwords, PINs, and passphrase pre-images are processed strictly inside your local browser memory and discarded.
  • At the application layer, hardware biometrics (fingerprints, facial recognition) and WebAuthn passkeys / security keys operate exclusively within your device's hardware Secure Enclave / TPM, where they are used strictly locally as deterministic high-entropy secret/password generators to feed your Keystone challenge pools. Raw biometric data and private passkey material are never transmitted over the network or accessible to our servers.

4. How We Use Your Information

We process personal and cryptographic data solely for the following legitimate purposes:

1. Identity Resolution & Discovery: Matching incoming authentication requests and email lookups to the correct tenant domain space.
2. Cryptographic Multi-Device Authorization: Permitting your devices to authorize scoped synchronization claims via internal or external device delegates, while the native ibGib sync engine executes graph synchronization.
3. Account Verification & Sign-In: Sending one-time 6-digit verification codes (OTP) to confirm email ownership and authenticate sign-ins.
4. Security & Abuse Prevention: Enforcing rate limits, detecting brute-force attacks, preventing automated scraping, and protecting server integrity.

We do not use your data for profiling, automated decision-making, AI foundation model training, or third-party targeted advertising.

5. Third-Party Service Providers

We utilize minimal third-party services essential to core platform functionality:

• Single Sign-On (SSO) Authentication (Optional):
  • Google OAuth2: Currently supported for single-tap passwordless account creation and sign-in. When linking Google, we receive verified identity tokens (such as your verified email address and provider user ID) to authenticate your identity. We do not receive or store your Google password.
  • Future Providers: We plan to introduce additional OAuth2 providers (such as GitHub and others) in future updates.
• Transactional Email & Hosting Infrastructure:
  • Transactional Email: We send emails strictly for transactional account confirmation, sign-in verification codes, and security notices. We never send marketing, newsletter, or promotional spam emails.
  • Cloud Server & Storage Nodes: Web nodes, domain space storage, and network routing are hosted on secure cloud infrastructure located in the United States.

6. Monotonically Increasing Timelines, Revocations & Data Deletion

Cryptographic Timeline Integrity vs. Physical Storage Removal

At the protocol level, ibGib models timelines as monotonically increasing, append-only hypergraph timelines (DAGs). Similar to version control systems (like Git), timeline frames are mathematically linked using cryptographic hashes (past, ancestor, and dna edges) to ensure tamper-evident lineage. However, just as physical objects in a Git repository can be pruned or destroyed when required, physical data stored on hosted ibgib.space servers can be unlinked, pruned, and permanently deleted for content takedowns or full account erasure.

Revocations & Tombstones

When you modify your identity permissions—such as unlinking a Google SSO provider or revoking a lost device passkey:

• The system publishes a cryptographically verified tombstone evolution frame (n → n+1).
• This frame officially revokes that authority and unlinks the provider from server-side reverse lookup indices.

Content Takedowns & Full Account Erasure

1. Content & Asset Takedowns: Content nodes, branches, and binary file payloads can be unlinked, de-indexed, and physically removed from hosted server storage upon authorized user request or valid legal takedown.
2. Complete Tenant Erasure: If you request complete account deletion, your entire tenant domain space (including all hosted keystones, delegate frames, and stored workspace data) and reverse email index entries will be permanently purged and destroyed from our server storage.
3. Local Device Data Control: You maintain full control over all data stored locally on your physical devices. You may clear your local cryptographic tokens, delegates, and cached workspace data at any time via the application settings or by clearing your browser's IndexedDB / local storage.

7. Security Architecture & Experimental Protocol "AS IS" Disclaimer

Entire Keystone & encrypt-gib Architecture Provided "AS IS"

THE SOFTWARE AND ALL ASSOCIATED CRYPTOGRAPHIC, SYMMETRIC CIPHER (encrypt-gib), KEY DERIVATION (KDF), KEYSTONE IDENTITY, ZERO-KNOWLEDGE PROOF (ZKP), HYPERGRAPH STORAGE, BRANCHING, METATEXT, AND SYNCHRONIZATION ALGORITHMS, PROTOCOLS, AND ARCHITECTURES ARE NOVEL, EXPERIMENTAL, UNVERIFIED, AND PROVIDED STRICTLY "AS IS", WITHOUT WARRANTY OR CONDITION OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, VIABILITY, SECURITY, CRYPTOGRAPHIC STRENGTH, DATA INTEGRITY, AND NONINFRINGEMENT. THE AUTHOR (WILLIAM RAIFORD) EXPLICITLY DISCLAIMS ANY VIABILITY OR FITNESS OF THE CRYPTOGRAPHIC, IDENTITY, OR STORAGE MECHANISMS FOR PRODUCTION OR HIGH-SECURITY USE. IN NO EVENT SHALL THE AUTHOR OR COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES, DATA LOSS, SECURITY BREACH, CRYPTOGRAPHIC FAILURE, OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE, ITS PROTOCOLS, OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Conventional Transport Security Foundations

All network communications, API endpoints, and authentication exchanges between your client devices and our hosted server infrastructure operate strictly over industry-standard TLS 1.3 / HTTPS encryption. Server-side tenant isolation, atomic file indexing, and timing side-channel protections are implemented following standard security practices.

8. Children's Privacy (COPPA / 18+ Requirement) & Your Privacy Rights (Texas TDPSA)

Minimum Age & Children's Privacy (COPPA / 18+ Only)

ibGib and https://ibgib.space are professional software development and distributed data tools intended exclusively for adults aged 18 years or older. In compliance with the U.S. Children's Online Privacy Protection Act (COPPA), the Texas Data Privacy and Security Act (TDPSA), and applicable minor-protection laws, we do not knowingly target, market to, or collect personal information from anyone under the age of 18. No person under the age of 18 may create a Keystone identity, register an email address, or submit personal information to ibgib.space. If we learn that we have inadvertently collected personal data from anyone under 18, we will immediately delete that Keystone and purge the associated tenant domain space. Parents or guardians who believe a minor may have submitted information to ibgib.space should contact us immediately using the email addresses in Section 9.

Your Privacy Rights (Texas TDPSA & US State Privacy Laws)

If you are a resident of Texas (governed by the Texas Data Privacy and Security Act - TDPSA) or other jurisdictions with applicable privacy legislation, you have the following rights regarding your personal data:

• Right to Know / Access: You have the right to confirm whether we process your personal data and to access such data.
• Right to Correct: You have the right to correct inaccuracies in your personal data.
• Right to Delete: You have the right to request deletion of personal data provided by or obtained about you.
• Right to Data Portability: You have the right to obtain a copy of your personal data in a portable and readily usable format.
• Right to Opt-Out of Sale / Targeted Advertising: We do not sell your personal data or process it for targeted advertising, so no opt-out is necessary.
• Right to Non-Discrimination: We will never discriminate against you, deny services, or alter pricing for exercising your privacy rights.

How to Exercise Your Rights

To submit a privacy inquiry, request data export, or request permanent deletion of your tenant domain space, please contact us using the information in Section 9 below. We will verify your identity (using your registered email or cryptographic keystone proof) and respond within the statutory timeframe (typically 45 days).

9. Contact Information & Policy Updates

Contact Us

If you have questions, comments, or requests regarding this Privacy Policy or our data handling practices, please reach out to us:

• Owner & Operator: William Raiford (https://ibgib.space)
• Packages & Licensing: Published on npm under the @ibgib scope (see Licensing & Terms).
• Primary Email (Preferred): ibgib.info@ibgib.space
• Secondary / Fallback Email: ibgib.info@gmail.com

Updates to This Policy

We may update this Privacy Policy from time to time to reflect architectural advancements, legal requirements, or operational changes. When changes are made, the "Last Updated" date at the top of this document will be updated. We encourage you to review this policy periodically.