Yours stays in your pocket
Until you take an action that publishes something, nothing about you is on our server. Your pocket (the "Mine" identity, the seat keys, the shelf you keep) lives in this browser's local storage on this device — not in an account, not in a database, not in a cloud. Signing in is signing into your own pocket: a locally signed profile, verified on this phone, never uploaded wholesale. Clearing "Mine" or "forgetting" a seat removes it here; nothing needs to be asked back from a server.
What leaves when you join
An invitation is a ticket. Joining a building writes the ticket's number to the building's public leaf — who wrote the ticket and the date, nothing else. The person is never written down; the ticket is. That journal line is public by design (it is how a union proves its copies agree), and it is a report, not an attestation: it grants no private access. If a number shouldn't be there, the building's revoke desk removes it.
Signed-in means signed into your own pocket
A real "@"-verified mailbox (your @incd.ink email, say) names the path your own stuff lives under — your journal, your neighborhood book, your shop. The email address is the naming authority, not a password vault: the profile claim that identifies you is verified in this browser with WebCrypto against the provider's signing keys and stays here. Nothing is uploaded until you publish it, and publishing is always the one explicit tap (a journal gallery, a leaf, a hello room).
Your journal
What you scan through the journal door is served back to you — and only to you — until you choose to publish a page to a gallery. Pages you publish become part of the shared shelf, like putting a page on a public corkboard, and the leaf of that shelf shows the hand that posted it.
What we don't do
No third-party scripts or CDNs, no trackers, no advertising, no analytics, no selling. No bespoke password database — there is nothing to harvest. The demo sign-in provider test identities are labeled "test identity, NOT a real member" and exist only so the rails can be exercised honestly.
Proof, not promise
Every claim above is a file you can open: the shared kernel, the identity layer, and the union leaf door are all in plain source in the project's repository, and each page names the file it runs on. If you ever want a line un-written, the door that wrote it is the door that removes it (forget a seat, revoke a ticket, un-publish a page).