Privacy Policy

Sowee is a hackathon demonstration on test networks, but the identity check handles real personal data about you. This page describes what actually happens to it, based on the code in the public repository rather than on what a policy usually says.

Read this part first: some records can never be deleted

Two things Sowee writes are public and permanent. Nobody can edit, correct or delete them — not you, not us, not the network operators.

• The public ledger. Every transaction you sign is stored for good on Hedera testnet or Arc testnet, under your wallet address: listings you open, bonds you fund, asks you post and fill, claims you make, and the eligibility flag that the identity check sets on your wallet.
• The audit topic. Sowee anchors its audit trail to a public Hedera Consensus Service topic that anyone can read. It carries invoice references, the sha256 of an invoice document, the lifecycle event, any logo the issuer attached, and receipts for x402 payments (the endpoint, the payer's Hedera account id, the amount and the settlement transaction). If you pass the Selfie Check, it also carries your wallet address next to your World nullifier, so that the anti-sybil check survives a restart.

Nothing you submit through the identity check is written to either place, except the nullifier described above, which names nobody. Treat every invoice reference, every logo and every wallet address you use here as published forever, because it is. If you would not want something public and permanent, do not put it into this demonstration.

What is collected, and why

• Your wallet address. It is the identifier for everything — your eligibility decision, your holdings, your rate limit. You give it by connecting a wallet, and you prove it by signing a short challenge message.
• Identity data, through Sumsub. Your first and last name, date of birth, country of residence, an identity document and a liveness selfie. The document and the selfie are captured inside Sumsub's own widget and go to Sumsub, not to us.
• Your questionnaire answers. The suitability declarations — residence, US person status, sanctions, investor classification, experience, source of funds, politically exposed person, beneficial owner. The policy needs them to decide.
• A World nullifier, if the Selfie Check step is enabled. It is a pseudonym for a World ID, scoped to our action, so that one World ID cannot pass the anti-sybil check twice. It is not an identity document, it does not name you, and it is not a substitute for the identity check.
• Request metadata. Ordinary server traffic: IP address, path, timestamp. It is used to rate-limit the API and to spot abuse. Paid API calls are metered per payer Hedera account id.

Where it goes

• Sumsub receives your name, date of birth, country, identity document and liveness selfie, filed under your wallet address as the applicant reference. This runs in Sumsub's sandbox environment. Sowee's API reads back only the review result, the reason, your questionnaire answers and the applicant id — never the document or the selfie. Sumsub handles what it holds under its own privacy policy.
• World's Developer Portal receives the Selfie Check proof from your browser through our API and returns the nullifier. World handles it under its own privacy policy.
• The public audit topic and the public ledger receive what is listed above: invoice references, document hashes, lifecycle events, x402 receipts and your eligibility flag.

Nothing is sold, and nothing goes to an advertiser or a data broker. There is no analytics service on this site and no advertising tracker.

What is kept, where, and for how long

• In the API's memory, until it restarts. Your verification state (none, pending, held, blocked, granting, granted), the reason for it, your Sumsub applicant id, the grant transactions, and the rate-limit and metering counters. There is no database. A restart erases all of it, and restarts are frequent in a demonstration. The one exception is the Selfie Check: it is replayed from the topic on start, so a passed check and its spent nullifier come back.
• With Sumsub, for as long as Sumsub keeps it. Your applicant file lives in their sandbox tenant under their retention policy, not ours.
• On the topic and the ledger, forever. See the first section.

What never reaches the chain

No name, no date of birth, no country, no identity document, and no hash of any of them. The chain holds one boolean per wallet address on each bond: eligible, or not. The reason for a decision stays off chain. A company logo is the one image that does go on the topic, because an issuer chose to put it there.

An invoice document attached in the issuer form is hashed in your browser with the Web Crypto API and never uploaded. Only its sha256 is anchored to the audit topic, and a hash cannot be turned back into the document — though anyone holding the same file can prove it matches.

Cross-border processing

Sumsub and World are independent providers who process data on their own infrastructure, in countries we do not choose and cannot tell you in advance. Public ledger and topic data is replicated worldwide by anyone running or reading a node. If that is not acceptable to you, do not complete the identity check.

Asking about your data, and deleting it

Write to support@sowee.site and say which wallet address you are asking about.

• Off-chain state we hold can be cleared on request. In practice it clears itself: it only lives in the running process.
• Your Sumsub applicant file is held by Sumsub. We can ask them to delete it on your behalf, and you can contact them directly.
• On-chain records and topic messages cannot be deleted. Not on request, not by us, not by anyone. There is no mechanism for it and we will not pretend otherwise.

You can also stop at any point. Disconnecting your wallet, or never starting the identity check, leaves us with nothing about you but ordinary request logs.

Children

This demonstration is not for anyone under 18, and we do not knowingly collect anything from a child.

Changes

This policy changes when the project does, and the date at the top moves with it. Every revision is in the public git history.

What the site stores in your own browser is covered separately in the Cookies Policy.