This is a draft. No lawyer has reviewed it, and it may change before it is final. Where something is not settled yet, it says so.
នេះជាសេចក្តីព្រាង ហើយមានជាភាសាអង់គ្លេសតែប៉ុណ្ណោះនៅពេលនេះ។ មិនទាន់មានមេធាវីពិនិត្យទេ ហើយវាអាចផ្លាស់ប្តូរមុនពេលចុងក្រោយ។
Draft of 9 November 2026.
Who runs this service. The organization that operates earth.heartbank.net will be named in the final version. Contact: miss.aquarius@heartbank.ceo
When you thank someone on a HeartBank® app, this service keeps an encrypted note that it happened. A fingerprint of that note is timestamped to a public ledger. You can open your own notes at earth.heartbank.net/you and download them. Nothing is paid here, and this service moves no money.
| What | Where it comes from | Why |
|---|---|---|
| A private ID for you, which the apps you use cannot read or link | HeartBank's log-in service, login.333.eco | So your thanks across different apps are recorded as yours |
| One entry for each thank: which app, Kiitos or Kiitti, a code for your side and the other side, the amount from the published rule, the time rounded to the minute, and (for Kiitti) whether it was a thing, a plant or an animal and which way the thanks went | The app you used | To keep the record and work out your aura color |
| Your running state: your entries so far, and limits such as how recently you returned to something | Worked out here | To apply the published rule |
| A log of each time your record is read: when, why, and by which part of the service | Written by this service | So reads of your record can be checked |
What your record does not hold. The words you wrote. Any amount of money or length of time. Your name, email or phone number. Your location. The app you used keeps its own records.
The other person. Each entry links two people. We hold that link, encrypted. We never show one person who the other is, on this page or in your download.
Every entry and every person's state is encrypted, and reading any of it needs a separate request to a key service. Each read is logged first, and that log is checked daily against the key service's own count.
We hold the keys. Someone with both our keys and our database could read everything, and a lawful demand can reach it. Our logging makes a read visible afterward. It does not make a read impossible.
A 32-byte fingerprint of each entry goes into a public, permanent log at log.333.eco/ledger, mixed with random padding and published once a day. Nobody can open a fingerprint without the private entry, which we hold encrypted and each party can download. No name, amount or text is in it. Fingerprints cannot be removed from the public log.
Each day we publish a picture of the world made from these thanks: for each area about 100 km across, how far it sits from zero and how often it has crossed zero. It holds no name, no person and no single thank, and it is at earth.heartbank.net.
Your place is your choice, and only yours. An app may offer to put your side of a thank on the map. If you say yes, your phone turns your location into the number of the area you are in and throws the location away. The exact location never reaches us. We add your side to that area's daily count, and nothing connects that count to you or to the thank. If you say no, your side is counted in the open sea, with no place at all. The other person's choice is theirs.
An area appears once at least two sides have been counted in it. So a very quiet area could show as few as two thanks. A place shown on the map is what a phone said, not a proof of where anyone was.
| Provider | What for |
|---|---|
| Google Cloud (Singapore) | Runs this service, stores the encrypted entries, holds the keys |
| Cloudflare | Stores the public log and the locked copy of the daily read log |
| Timestamp services and the Bitcoin network | Receive only a hash of each day's log |
The log-in uses one cookie, __Host-you, which holds only the temporary secrets of that log-in. It lasts at most 10 minutes and is removed when you arrive back. There is no session: when you leave your record, you need your passkey to open it again. Your log-in itself is handled by login.333.eco, which will have its own policy.
On your device we store your language and light or dark choice.
On the front page only, visits are counted: Cloudflare Web Analytics, and a beacon to thonly.org that records the page, the address you came from, the links you click, your browser's description, your time zone, and a random ID stored in your browser. It sets no cookies. We have not yet set a limit on how long the beacon's records are kept. Your record page counts nothing.
Our hosting keeps ordinary request logs (IP address, browser, time, address requested) for 30 days. Key-service audit logs, which name our own systems and not you, are kept for 400 days.
Your entries are kept with no end date. On 7 January every balance restarts from zero, and your entries stay. The working copy of the read log expires after 30 days; a locked copy is kept permanently, and it names a person only by an opaque tag, and only for reads a person or a study starts.
Any other rights you have under the law where you live, and how to use them, will be set out in the final version. Until then, write to the contact above.
We may study this data only in advance-registered batches where only totals leave the service, never a row, a pair or a person. That is not built yet.
The minimum age, and how a parent's consent works, will be set before any child's entries exist.
We will post changes here with a new date.