Privacy

We collect a mobile number and a preferred language to create the account and issue a session. No other personal data is collected in this build.

The session is held in HttpOnly cookies that page scripts cannot read, and no advertising or tracking technology is used.

Sensitive actions are written to an audit log by identifier only, and provider evidence references are encrypted in the database.

Provider evidence identifiers and uploaded documents are business records, held in restricted storage and shared with no external party other than the approved SMS processor that delivers your sign-in code.

This page describes the boundaries of the current pilot build; it is not a final legal document.