docs/PRIVACY.md

# Clanker — Data & Privacy

Plain-language promises about how this pet handles your data. These are hard rules the
implementation must uphold.

## Identity is recognition-only
- If you choose to sign in (optional — everything works anonymously), your account is used
  for **one thing only: so the creature can recognize you across visits** and remember how
  it feels about you.
- **Account names are never shown publicly.** No leaderboard of users, no public display of
  who said what, no exposing one visitor's identity to another.
- Identity is **not** used for tracking, profiling, advertising, or any purpose beyond
  recognition. Internally, prefer an **opaque/hashed user id** over storing raw usernames.

## Conversation logging is for engine improvement only
- What you type is logged to a **private** dataset **solely to improve the Clanker VADUGWI
  formulas** — e.g. to find words or phrases the engine misreads (reads neutral when it
  shouldn't) and fix the deterministic rules.
- It is **not sold, not shared, not surfaced publicly**, and not used to build a profile of
  you. Clanker is deterministic linguistic physics, not an ML model trained on your chats.

## Storage
- The audit log (`deucebucket/clanker-audit`) and the soul state
  (`deucebucket/clanker-soul-state`) are **private** HF Datasets, readable only by the owner.
- The write token lives **only** in the Space's encrypted secret store — never in the repo,
  the deployed files, or any document.

## Scope
These rules bind every milestone. Anything that records a person or their words must:
private storage + recognition/improvement purpose only + never public attribution.