Privacy Policy

1. Data Controller

The Data Controller responsible for the processing of personal data on this website and the UNONYM platform under the General Data Protection Regulation (GDPR) is:

2. Core Principle: Zero-PII & Privacy by Design

UNONYM is a digital identity protocol that enables users to prove they are a unique, real human without revealing their real-world personal identity. We adhere strictly to the principle of Zero-PII (Personally Identifiable Information):

• No Raw Identity Documents: We never collect, transmit, or store government ID documents, passport numbers, raw phone numbers, or social security details on our servers.
• Provider Attestation & Cryptographic Hashes: Verifications are conducted externally (e.g. via hardware security tokens or SMS OTP microservices). UNONYM only receives and stores irreversible pseudonymous hash values (HMAC with system-wide peppers) to prevent Sybil attacks and duplicate accounts.
• Local Biometrics: Biometric authentication (fingerprint, Face ID, Passkeys) is executed strictly inside your device's local hardware security enclave (Keystore / Secure Enclave). Biometric data never leaves your device and is never accessible to UNONYM.

3. Platform Integrations & Reddit Devvit Mod App

When using our platform integration apps (including the UNONYM Reddit Mod App built on Reddit Devvit):

• Zero-PII Reddit Identifier: In accordance with the Reddit Developer Platform policy, neither your Reddit username (u/username) nor your Reddit internal user ID (t2_...) is transmitted across the external network to UNONYM servers.
• Derived Opaque Identifier: Devvit derives a purely local pseudonymous identifier (r_anon_...) using a cryptographic one-way hash.
• Asymmetric Digital Signatures (Ed25519): Verification proofs are digitally signed with UNONYM's private key. The Reddit Devvit app verifies codes locally with an embedded public key. Reddit administrators or third parties cannot forge verification codes.
• Session Nonces: Devvit generates a temporary 16-character hex nonce stored in Reddit Redis with a 15-minute expiration, ensuring proof codes can only be redeemed by the active Reddit session that requested them.

4. Categories of Data Processed

• Email Address: Used solely for account authentication, password recovery, and transactional security notices.
• Password Hash: Salted and hashed using Argon2 / bcrypt via Ory Kratos.
• Public Identifier: A randomly generated pseudonymous identifier (e.g. uno_...).
• Trust Points & Tier Level: Aggregated points determining verification status (UL-Bronze, UL-Silver, UL-Gold).
• Hashed Hardware Signatures: SHA-256 hashed device identifiers to enforce the 1:1 hardware device integrity bound.
• Server Logs: Standard web server connection logs (IP address, timestamp, requested URI) stored temporarily for up to 30 days solely for DDoS defense and intrusion prevention.

5. Legal Bases for Processing (GDPR Art. 6)

• Contract Performance (Art. 6(1)(b) GDPR): Operating your UNONYM account, managing sessions, and fulfilling identity verification requests.
• Consent (Art. 6(1)(a) GDPR): Optional account linkages (Reddit, GitHub, Google OIDC).
• Legitimate Interests (Art. 6(1)(f) GDPR): Sybil resistance, anti-abuse filtering, and platform security.

6. Hosting & Third-Party Service Providers

• Cloud Hosting (Hetzner Online GmbH): All servers, databases, and authentication instances operate in ISO 27001-certified data centers in Germany (EU).
• Transactional Email (Brevo): SMTP relay for security verification emails (Brevo GmbH, Berlin, Germany / Sendinblue SAS, France).
• DNS & MX (Hostinger Operations UAB): Domain and inbound mail routing in the European Union.
• Cookieless Web Analytics (Umami): Self-hosted analytics on our Hetzner servers. No cookies, no cross-site tracking, and zero personal profiles.

7. Your Rights Under GDPR

You have the right to:

• Access your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure ("Right to be forgotten", Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Lodge a complaint with a supervisory data protection authority (Art. 77 GDPR)

To exercise your privacy rights, email us at: contact@unonym.org.