Privacy at candor

Plain-English summary · July 2026 · pre-launch

The principle

Hold less, prove more. candor's product is trust, not data. Every system is designed so that the platform holds the minimum needed to prove financial standing — and nothing else.

What we don't collect

• No names, emails, or phone numbers. Accounts are random pseudonyms secured by a cryptographic recovery code and optional passkeys. There is no PII at signup because none is asked for.
• No transaction history. Verification reads account balances; transactions are never stored in the background. The one exception is a single transaction a member deliberately chooses to attach as a verified purchase.
• No account numbers or bank credentials. Account linking is read-only and credentials pass directly between the member and the linking provider — they never touch candor.

What we store

• Computed totals only: assets, liabilities, and net worth — the numbers behind the badge — plus a history of those totals for the member's own trajectory graph.
• Content the member writes: posts, replies, and messages, attributed to the pseudonym.
• Encrypted linking credentials (used to refresh balances), held encrypted at rest in a store physically separate from the social platform, so a breach of one reveals nothing from the other.

What others see

• Badges display rounded to three significant figures — exact figures are never shown to anyone.
• Members can further hide the amount entirely (tier emblem only), make their trajectory private, and close their DMs.
• Privacy settings apply retroactively, across everything the member has ever posted.

Deletion

Account deletion is self-serve. It revokes every credential and session, removes the account and its content from the platform, and severs the account-linking connection with the provider.

Contact

A contact channel will be published here alongside the formal policy before launch.