Trace Commons

Privacy posture

Trace Commons is privacy-preserving by design. Three properties of this site you can rely on:

  1. Opt-in attribution. A contributor's handle only appears on this site if they have explicitly opted in via the public_attribution consent scope. The default is private. Their pseudonymous identifier is never published.
  2. Aggregate-only analytics. Corpus dashboards apply a minimum-cell threshold before publication, and publication is refused unless that threshold and a tenant-cohort minimum are both met. No per-trace details, no raw trace bodies, no per-handle trace timelines. Aggregates are not currently perturbed by a calibrated differential-privacy mechanism; see the data policy for what the noise setting does and does not guarantee.
  3. Withdrawal. Withdrawing public attribution takes effect immediately in the register: the contributor's profile is marked withdrawn and excluded from every subsequent snapshot. A handle already present in the most recently published snapshot is removed when that snapshot is next recomputed, which is an operator-triggered action rather than a fixed interval. Database rows persist as soft-deletes so the audit chain stays intact, but no public surface displays them.

What is shown

  • Self-declared handle.
  • Self-declared bio (optional, ≤280 bytes).
  • The contributor's aggregate counts: accepted submissions, credit, rolling windows.
  • The date the contributor first opted in.

What is not shown

  • Raw envelope content. Ever.
  • Per-trace tool sequences linked to a handle.
  • Anything about contributors who have not opted in.
  • Tenant identifiers or operator-secret material.
  • Real-name identity. Handles are self-declared.

Withdrawing

The profile page exposes a "withdraw public attribution" action. It takes effect in the register immediately and excludes the handle from every later snapshot. To have a handle cleared from the currently published snapshot without waiting for the next recompute, ask the pilot operator.