Privacy Policy
APTOGON / homosapience.org
1. Who we are
This privacy notice describes how APTOGON (a service operated under the name homosapience.org) processes personal data.
Data controller: Alexander Tulubyev.
Contact: alt@in2sys.fr
Effective: TBD-publish-date
2. Summary
We collect the minimum data needed to verify a human and to operate the social features of the network. We do not request your name, email, phone number, or government ID. We do not use any third-party analytics or tracking tools. Your private cryptographic key is generated and held only in your browser; we never see it.
3. What data we process
| Data | Source | Storage | Retention |
|---|---|---|---|
| Public DID | Generated in your browser | Redis sessions; PostgreSQL credentials | Until you revoke |
| Private key | Generated in your browser | Browser localStorage (never transmitted) | Until you clear browser data |
| IP address | HTTP requests | Redis session entry | ~1 hour (JWT TTL + 5 min grace) |
| User-Agent (first 120 chars) | HTTP requests | Redis session entry | ~1 hour |
| Display name (optional) | You | PostgreSQL | Until you remove |
| Avatar URL (optional) | You | PostgreSQL | Until you remove |
| Bond relationships | Your actions | PostgreSQL bonds | Until you remove |
| Chat messages | You | PostgreSQL messages | Per chat module policy |
| Uploaded files | You | Server filesystem | 4-day warning, deleted at 5 days |
| Donation amount + transaction ID | CloudTips checkout | CloudTips servers (not ours) | Per CloudTips policy |
4. Legal basis (GDPR Art. 6)
| Processing | Basis |
|---|---|
| Issuing a credential after verification | Contract (Art. 6(1)(b)) — service you requested |
| Maintaining your session (IP, UA) | Legitimate interest (Art. 6(1)(f)) — abuse prevention |
| Storing display name, avatar, bonds | Consent (Art. 6(1)(a)) — optional, you control |
| Processing donations | Contract (Art. 6(1)(b)) — voluntary payment |
| Publishing on-chain hash | Contract (Art. 6(1)(b)) — required for verification mechanism |
5. What we do not process
- The raw gesture trace, motion vectors, or biometric data — these are extracted and discarded in your browser within ~10 seconds.
- Your browsing history. The browser extension does not read page content or report which sites you visit.
- Your name, email address, phone number, or government identifiers.
- Behavioural analytics (no Google Analytics, no Meta Pixel, no Hotjar, no Sentry).
6. Third parties and sub-processors
The following external services may receive data when you use APTOGON:
- Aptos Labs (RPC fullnodes) — receives the on-chain credential lookup request and your IP. aptoslabs.com/privacy
- Gonka Network (decentralised GPU compute) — receives the gesture statistical vector (numeric motion features, no images, no coordinates) for human-pattern classification. gonka.ai
- OpenRouter (fallback AI inference) — receives the same statistical vector when Gonka is unavailable. Acts as a Data Processor under our instructions; a Data Processing Agreement is in progress.
- CloudTips (donation processor) — receives standard payment data (amount, optional name) only when you voluntarily donate. CloudTips is operated from the Russian Federation. cloudtips.ru
- Google Chrome runtime (when using the extension) — standard Chrome storage and messaging APIs. APTOGON does not send any data to Google servers itself.
7. On-chain data
Successful verifications are recorded as a HumanCredential on the Aptos blockchain. On-chain data is public and immutable — once written, it cannot be modified or deleted by us or by you.
What is stored on-chain:
- The SHA3-256 hash of your public DID
- A timestamp of when verification occurred
- The credential's expiry timestamp
What is NOT stored on-chain:
- Your name, email, IP address, or any contact information
- The gesture pattern, motion vectors, or any biometric data
- Your browsing history or pages where you displayed your badge
- Your private key (which never leaves your browser)
Right to erasure (GDPR Art. 17): Because of blockchain immutability, we cannot delete on-chain hashes once written. However:
- The credential automatically expires after 30 days and is no longer accepted by APTOGON services.
- The hash alone does not identify you — only you, holding the matching private key, can prove ownership.
- You can revoke your DID locally; without your continued cooperation, the on-chain hash remains a pseudonymous artefact with no link to identity.
If you are a data subject in a jurisdiction that requires on-chain erasure, please contact us via the address in §10 and we will explain mitigations available.
8. Retention
- Authentication nonces: 60 seconds, single-use.
- Session entries (IP, UA, expiry): JWT TTL + 5 minutes (~1 hour 5 minutes by default).
- Uploaded files: warning at 4 days, automatic deletion at 5 days.
- Credentials, bonds, display name: kept until you revoke or remove them.
- On-chain hashes: permanent (see §7 for limitations).
9. Your rights (GDPR Art. 12–22)
- Access — request a copy of what we hold about you.
- Rectification — correct inaccurate data.
- Erasure — delete your account-side data. On-chain hashes have the limitation described in §7.
- Portability — receive your data in a machine-readable form.
- Restriction — ask us to stop processing while a dispute is resolved.
- Objection — object to processing based on legitimate interest.
- Complaint — lodge a complaint with your local supervisory authority.
10. How to exercise your rights
Email alt@in2sys.fr. We aim to respond within 30 days. If we need more time, we will tell you why.
11. International transfers
Our servers are located in Latvia (European Economic Area). When you use APTOGON, your IP address and session data are processed within the EEA. The Aptos blockchain is a global public ledger; nodes are operated worldwide. Aptos Labs RPC infrastructure may process data outside the EEA. Donations via CloudTips are processed in the Russian Federation; this is a transfer outside the EEA, which you initiate yourself when you choose to donate.
12. Cookies
We set only one cookie: NEXT_LOCALE, which remembers your chosen language. It is set for one year with SameSite=Lax and contains no personal information. We do not set any tracking or advertising cookies.
13. Updates
This policy is versioned via the project's public git history. Material changes will be announced in the extension update notes and on the homosapience.org front page.