publication/artifacts/policies/hubzilla/hubzilla_privacy_policy.md

artifact, version, status, publication_cid, supersedes

artifact	version	status	publication_cid	supersedes
hubzilla-privacy-policy	1.0-draft	draft	null	null

Hubzilla Privacy Policy

1. Scope

This Privacy Policy applies only to the Hubzilla service operated at:

witness.diagnostics.kane-il.us

This service is referred to here as the Witness.

This Policy governs information processed through the Witness, including information associated with Participants, provisional users, and Outside Contacts.

It does not govern the Civic Infrastructure as a whole or separately operated services such as the Portal, Gitea, IPFS, Kane Fabric, RAG systems, or other infrastructure, except where the Witness intentionally interacts with those services.

2. Private Network

The Witness is a private civic network.

It is not operated as a commercial social-media platform, advertising network, data-broker service, or general-purpose public forum.

Participation is voluntary.

The Witness exists to support communication, discussion, witnessing, and related civic activity chosen by its users.

3. No Tracking or Secondary-Purpose Data Collection

The Witness and the Civic Infrastructure do not treat users as a source of data.

Information is processed only as necessary to:

• operate the Witness;
• administer accounts;
• authenticate users;
• deliver communications and content;
• provide functions intentionally invoked by users;
• maintain security;
• diagnose technical problems;
• maintain the service.

The Witness does not collect or use user information for:

• advertising;
• behavioral profiling;
• targeted marketing;
• commercial analytics;
• data resale;
• audience monetization;
• unrelated research.

No tracking mechanism is intentionally deployed for those purposes.

4. Information Required to Operate the Witness

Normal operation of Hubzilla may require processing information such as:

• account identifiers;
• email addresses used for account administration;
• channel and profile information;
• posts and comments;
• messages;
• uploaded files;
• connection information;
• federation information;
• authentication and session information;
• ordinary technical logs.

The existence of this information does not create a separate right for the Witness or the Civic Infrastructure to use it for unrelated purposes.

5. Provisional Accounts

A visitor may create a provisional Witness account using the visitor's own email address.

A provisional account is intended for temporary exploration of the Witness, questions about the SASE process, and discussion of what the visitor may wish to do through the Civic Infrastructure.

Provisional accounts are deleted every second Friday as part of the normal account lifecycle.

Users should not treat provisional accounts as permanent storage.

Scheduled deletion of a provisional account is routine operation and is not a disciplinary action.

6. SASE Participant Accounts

A qualifying Kane County resident may receive a sase* account through the SASE process.

A SASE account is a continuing Participant account.

The Participant may retain the account originally issued.

The periodic six-month SASE process revalidates current Participant standing as a Kane County resident. It does not ordinarily replace the Participant's existing account.

Account identity and current Participant standing are separate.

7. Outside Contacts

The Witness may receive or display communications from people who are not Civic Infrastructure Participants.

These persons are Outside Contacts.

Outside Contacts retain the rights they hold in material they author.

A message, document, attachment, statement, or other work does not become property of the Witness or the Civic Infrastructure merely because it is transmitted to, received by, displayed through, or discussed on the Witness.

The same principle applies to Participant content.

8. User Ownership of Content

Participants and Outside Contacts retain the rights they hold in their own content.

Use of the Witness does not transfer ownership of user-created content to Hubzilla or to the Civic Infrastructure.

The Civic Infrastructure does not claim ownership merely because content is:

• stored;
• displayed;
• transmitted;
• received;
• discussed;
• federated;
• technically processed through the Witness.

9. Permission Necessary to Operate the Service

Operating Hubzilla necessarily requires limited technical use of user content.

For example, the Witness may need to:

• store content;
• render it for display;
• copy it temporarily for processing;
• transmit it to intended recipients;
• distribute it according to the user's visibility settings;
• federate it when the user chooses federation;
• preserve it as necessary for normal service operation.

By submitting content to the Witness, the author permits only the processing reasonably necessary to provide the functions intentionally invoked by that author.

This operational permission is not a transfer of ownership.

It is not a general license for unrelated reuse.

10. Author-Selected Licenses

An author may place content under a particular license.

When an author does so, the Witness and the Civic Infrastructure may use that content according to the terms of that license.

The author's selected license governs uses beyond the limited technical processing necessary to operate the service.

Where no broader license has been granted, use of the Witness should not be interpreted as granting the Civic Infrastructure unrestricted rights to reproduce, republish, modify, commercialize, or otherwise exploit the author's work.

11. Ordinary Witness Content Is Not Automatically a Civic Publication

Content does not become an immutable Civic Infrastructure publication merely because it appears on the Witness.

Ordinary Hubzilla content remains ordinary Hubzilla content unless a separate publication or evidentiary process is deliberately invoked.

A separate Civic Infrastructure publication process may create:

• a frozen artifact;
• a SHA-256 identity;
• an IPFS CID;
• a publication record;
• other durable evidence.

That process is separate from ordinary use of the Witness.

12. Visibility and Privacy Controls

The Witness is a private network, but not every item necessarily has the same audience.

Visibility may depend on:

• channel settings;
• connection permissions;
• audience selections;
• message recipients;
• federation choices;
• other Hubzilla privacy controls.

Users are responsible for selecting the audience appropriate to the material they submit.

The Witness will apply the technical controls selected by the user to the extent supported by Hubzilla and the receiving systems involved.

13. Federation and External Recipients

Hubzilla can transmit content to other servers and recipients when the user chooses functions that require such delivery.

When content is deliberately sent or federated outside the Witness:

• the receiving system may retain its own copy;
• that system may operate under different policies;
• deletion from the Witness cannot guarantee deletion from independently operated remote systems.

Transmission requested by the user is part of providing the chosen communication function. It is not secondary-purpose data collection by the Civic Infrastructure.

Users should consider this before distributing material beyond the Witness.

14. Technical Logs

The Witness may create technical logs necessary to:

• operate the service;
• secure the service;
• investigate failures;
• diagnose problems;
• maintain system integrity.

Logs are not collected for advertising, behavioral profiling, or commercial analytics.

No retention period is promised unless a specific retention policy is separately published.

15. Service Providers and Infrastructure

The Witness may rely on technical infrastructure necessary to provide its service.

Such infrastructure is used to perform operational functions on behalf of the Witness.

The existence of supporting infrastructure does not expand the purposes for which user information may be used.

Information handled through supporting infrastructure remains subject to the same principle:

use only for operation of the requested service or according to permission granted by the author.

16. Account and Content Removal

Users may use available Hubzilla functions to manage or remove content under their control.

Removal from the Witness does not guarantee removal of:

• copies previously delivered to another person;
• copies received by federated systems;
• material independently preserved by another party;
• material deliberately entered into a separate Civic Infrastructure publication or evidentiary process.

Provisional-account deletion follows the scheduled lifecycle described above.

SASE Participant accounts follow their separate account and standing rules.

17. No Sale of Personal Information

The Witness and the Civic Infrastructure do not sell personal information collected through the Witness.

They do not sell user profiles, communication histories, behavioral records, contact relationships, or user-created content.

18. No Advertising Profile

The Witness does not construct advertising profiles from user behavior.

User activity is not analyzed for the purpose of targeting commercial advertisements or selling audience segments.

19. Security

The Witness uses technical and administrative measures intended to protect accounts, communications, and service operation.

No networked system can guarantee absolute security.

Users remain responsible for protecting their own credentials and for considering the sensitivity of information they choose to distribute.

20. Changes to This Policy

This Privacy Policy is itself a Civic Infrastructure publication artifact.

It is not silently rewritten.

A changed Policy is issued as a replacement version.

A Published Version may be identified by:

• version;
• publication date;
• SHA-256;
• IPFS CID;
• publication record.

Earlier Published Versions may remain available as part of the publication history.

Discussion about the Policy may remain mutable even though each Published Version is immutable.

21. Privacy Principle

The Witness exists to serve its users, not to extract information from them.

Information is processed only to operate the service and to perform functions deliberately invoked by the user.

Participants and Outside Contacts retain the rights they hold in their own content.

The Witness and the Civic Infrastructure use that content only:

• as necessary to provide the requested service; or
• according to a license or other permission granted by the author.