The refusals are
the specification.
It is easy to describe what an infrastructure does, and most of it is negotiable under pressure. What defines this one is the shorter list: the things it is designed to be incapable of, even when incapability is inconvenient.
- Privacy-by-Design
- Minimized at the source, not cleaned up later.
- Privacy-by-Consensus
- Trust is validated, never asserted.
- Emotion-by-Consent
- No signal exists without a deliberate yes.
Held from the beginning, not added after a review.
These were fixed before the architecture was, which is why the architecture looks the way it does.
Privacy-by-Design
Minimized at the source, not cleaned up later.
Processing happens locally first. The infrastructure is built so the sensitive version of a signal never needs to travel, rather than travelling and being protected afterwards.
Privacy-by-Consensus
Trust is validated, never asserted.
No single server is the authority on whether something is true. Verification is distributed across independent participants, so privacy does not rest on our good behaviour.
Emotion-by-Consent
No signal exists without a deliberate yes.
Every signal is authorized, scoped and revocable. Consent is a live, enforced state in the architecture — not a checkbox recorded at signup.
Five things, and what we build instead.
- A surveillance infrastructure
A human–machine interaction infrastructure built on consent, transparency and voluntary participation.
- A Web2 lake of personal emotion
Sensitive data kept encrypted and decentralized, never centralized in a conventional database.
- Raw personal data on-chain
Proofs, references, hashes, verifiable states and events on-chain. Nothing readable about a person.
- A closed application
Open infrastructure: other apps, APIs, platforms and devices can contribute authorized signals.
- Another marketplace
EmotiTribe — a community and wellness layer where value returns to the people who created it.
Six statements we expect to be held to.
Written to be checkable. If one of these stops being true, it should be visible from the outside rather than discovered in a filing.
Consent is a live state, not a record
A grant is scoped, expiring and revocable, and it is checked at the moment of use rather than assumed from a signup event. Revoking stops the signal at the source, because there is no second copy to chase.
Data minimization happens at creation
The sensitive form of a signal is reduced on the device that produced it. Nothing is collected in full and trimmed afterwards, because a system that can trim can also choose not to.
The chain holds proofs, never people
Cryptographic proofs, references, hashes, verifiable states and events go on-chain. Nothing readable about a person does, and no future business pressure changes that.
We build to know less over time
Each phase should reduce what EmotiLink itself is capable of seeing. If a design increases our visibility into individuals, it is the wrong design regardless of what it enables.
Analysis is bounded by purpose
Behavioral analysis exists to give applications context, not to build dossiers. The remit of each intelligence layer is defined, and expanding it is a decision made in the open.
Claims are labelled by phase
Anything not yet built is marked as such, here and everywhere else. A roadmap presented as a product is the most common way a privacy promise is broken.
We are not building a surveillance infrastructure. We are building a human–machine interaction infrastructure based on consent, transparency and voluntary participation.
Principles that nobody checks are decoration.
If something on this page is contradicted by something we ship, we would rather hear about it early and loudly than defend it quietly.
No tracking pixel on this page · Consent before signal · Always