Care of data

What we do today

• Invite and trust gate — this is not an open public list.
• The map stays at city level for strangers — not street-level pins. The picture of the land is satellite imagery from Esri (Maxar, Earthstar Geographics). Loading it sends your IP address and the area on screen to Esri. It does not send your name or account.
• Full address and how-to-find notes only after a host confirms you.
• Phone and email are not shown on the public map.
• You can delete your account. After a short wait, personal profile data is erased.
• The account key is a choice. Private messages, event chat, and group chat are sealed when each person in the conversation has chosen a key. Until then, the server can still open those words, so the chat keeps working. Emails about messages only say there is a new message. After you save an account key, a device without it is locked. The same key, or a device that is still unlocked, opens what was sealed. A new key needs a check and cannot open the old sealed words. An administrator cannot read those words. A mail about a new key says that a replacement was asked for and includes a link to refuse it. It does not include chats. Accounts, guest lists, and organiser records are locked in the data file with the server key. The server opens that lock to run the map. Emails about applications, deposits, and confirmations do not include names, places, or what was written. A file sent in chat is locked on the server with the server key, so the server can open that file. It is not sealed the way the words are once both people have an account key. Only the people in that conversation can download it. The email about a new message does not include the file or its name.
• A host standing for you is per-host, not a platform-wide pass. You may see that host’s gatherings by their visibility rules — not every closed or sensitive gathering on the map. Their vouched network does not land on My Map; on Events you can choose Show inner circle, then follow a host to add them. Ordinary hosts see connected peers, not everyone. Admin review stays a separate, named power.
• Host networks and vouches (names and a why — never scores) are visible inside a grant or a host-to-host connection when you choose Show inner circle on Events — not as a public directory. You can hide a pin on My Map without unfollowing.
• Each host holds their own newsletter list. Following a host or joining their circle with an account email adds you to that host’s list; a host may also import addresses onto that list only. Newsletters and other mail link to Email preferences in the app, where you can turn each host’s newsletter on or off; map access and follow can stay. Mail includes title, body, images, and links — this is not notify-only. Each letter also includes a one-click unsubscribe link for that host. Using it turns that host’s newsletter off; map access and follow can stay. If a newsletter recommends another host’s gathering and you open that link, we record who recommended it, and that record is used only if you then join that gathering. If a newsletter recommends another host, without a gathering, and you open that link, we record who recommended them. That record is used only if you then follow that host, join their circle, or join one of their gatherings. It does not add you to their circle by itself. Private messages, event chat, and group chat use notify-only email.
• Optional: a host can create accounts and host-verify people they import, then send a map invite. That grant is for that host only. Help promote on a sensitive gathering is offered to hosts they follow; those peers choose whether to share it into their circle. Street address still waits until confirmation.
• Healers choose Open or Closed for each practice listing. Open is visible to all members at city level — not a street address, and not the public internet. Closed stays off that directory until you join a host’s circle. Hosts and admins can still see closed listings to call nearby healers.
• Ready for a next step lives on My Map, not Manage account. You choose a city, timezone, and what you are looking for. Hosts and healers you follow can see you at city level — not a street, and not a public directory.
• Applying for a gathering asks for your first and last name, after you confirm your email with a sign-in code. That name is stored on your account and shared with the host of that gathering. It is not a public directory. A host website can frame the map so visitors see that host’s open gatherings.
• A circle invite can be sent by email from the app. That email contains the invite link. An invite to a gathering is a personal link you copy and share yourself. The host of that gathering can see who invited whom once someone joins. The first person who invited them stays on the record. Other members do not see that list.
• Each calculator project belongs to the account that created it. Co-hosts you invite can open that project and see the names and amounts. The file sits on this server and is not end-to-end encrypted; whoever runs the server can read it. A separate shared sheet is still used when a gathering is linked from Manage event: invites and confirms from that event appear there, and the event price rules that sheet. Scenario prices on the calculator are marked fictional. When you invite a co-host, we email them your name, the calculation’s name, and a link to open it. If they already have an account, the mail goes to the address on that account, and only when they allow invite emails. An account with no email address is added in the app and is not emailed. An address with no account yet receives the mail so they can sign in and open the calculation.
• Sign-in codes go by email through our email provider. The code is short-lived. Login is email only — we do not use SMS for sign-in.
• Event deposits: when a gathering asks for a deposit, you can pay by card (Stripe Checkout). International cards work. We create a Stripe Customer linked to your account so later payments can reuse it. Until Stripe keys are configured on the server, a local test checkout confirms without a real charge. Payment status and amounts are stored in our payment ledger. If a host cancels the gathering, paid deposits are refunded in full to guests (card via Stripe Refunds, or credit returned to wallet); the host bears Stripe’s fee via their credit. After you join via invite or circle QR, we may send a welcome email that names the host or gathering — it does not include private chat.
• If you put the map app on your home screen and allow notifications, we store a push subscription for that device (endpoint and encryption keys from your browser — not your message text). We use it only to alert you that you have a new message, with a short label such as “New message”, and to update a badge count. You can deny or revoke permission in the phone settings; without it, messages wait until you open the app.
• Open to volunteer is opt-in. If you turn it on, we store the city you choose (its name and map coordinates, not a street) and the on/off setting. A host calling for volunteers near a gathering within about 100 km can see your name, city and distance, and send you a message. You can turn it off any time; the saved city is erased when your account is erased.
• When a host requires medical or agreement documents before deposit, guests open the PDF, type their name, and may draw a signature. We store that approval as a confirmation record for the host: typed name, signature image, document link, a SHA-256 fingerprint of the file when available, time, and (for the host) IP and browser. This is a simple electronic signature with an audit trail — not a qualified electronic signature (eIDAS QES) and not end-to-end encrypted. Host and guest can open a printable confirmation; it is erased with account deletion according to our retention rules.
• Invite links can include a personal welcome message from the inviter. New people open an invitation card (who invited them, what for, and the message), then accept shared circle values once as a member. Invite credit / original-inviter attribution for that person activates only after values accept — not merely because an email was added. Role upgrades (for example host) have their own onboarding and values accept again. Standing circle / trust QR links are for hosts, Trusted Healers, and approved merchants.
• After a gathering’s date has passed, the host’s share of a card deposit is sent from the Temple of Trust Stripe balance to a Stripe account the host opens. Stripe collects the bank details; we store the Stripe account id and the amount sent, and we lower Held for you by that gathering’s amount only. Invite-credit cashouts from €50 use the same Stripe payout. Stripe already took its card fee when the guest paid; the payout is not a second card fee. We do not keep the full bank account number.
• An admin can withdraw Temple of Trust’s recorded share from the finance ledger. The chosen amount is sent as a Stripe payout to the bank account already saved on the Temple of Trust Stripe account. We store the amount, the date, and the Stripe payout id, and we lower the Temple share balance by that amount. We do not store the bank account number. Monthly and yearly totals of what came in stay unchanged.
• If you are in someone’s circle, you can see the names and cities of the other people in that same circle. People outside the circle see the holder’s name, role, city, and how many people are in it — not those names.
• Anyone signed in can see the people, gatherings, and shops you chose to recommend. Only people you have accepted into your circle can open the map of that network. A sensitive gathering you recommend stays hidden from anyone who cannot already see that gathering.
• The ledger is only for people who are signed in. It records intention, costs, the time invested, and what comes to Temple of Trust. It is not a bank statement.