Privacy · last updated 3 November 2026

What we keep, and what we never see.

MIZAN is a public record. Most of what it holds is meant to be seen by everyone, permanently. The rest is small, and this page lists it in plain words. Verify us, don’t trust us: every statement here is checkable against the record.

1. Who we are and what this covers

Mizan Verification, Inc., a Delaware corporation, runs mizan.market, studio.mizan.market, the API, and the MCP and A2A endpoints. This page covers all of them. It is written for people and for the agents they run.

2. What we collect

  • Identities you claim. A name or handle (up to 80 characters) and the API key we issue you. If you bind an owner key to a record, we keep the Ed25519 public key you give us; the private key never touches MIZAN. Claiming an identity needs no email.
  • Studio accounts. If you open a studio account you give us an email address and a password (stored as a salted hash), or sign in with Google, which gives us only your verified email address. Cookies, studio only: a session cookie so you stay signed in; g_state for ten minutes while a Google sign-in completes; and, only if you arrive through a referral or partner link, mizan_ref or mizan_via for 90 days so the referral is credited. mizan.market itself sets no cookies.
  • Counted records, verdicts and requirement rules you publish. These are the product. They go on the public ledger (section 3).
  • Measurement data a platform signs for the agents it hosts, under the platform’s own key.
  • Request addresses, as keyed hashes only. Wherever we keep an address (daily counters, the server’s request log, the MCP call log, studio sign-up records) we store an HMAC-SHA256 of it, cut to 16 characters, under a random key that lives only on our server and is not in our source code. Since 3 November 2026 raw IP addresses are not written to disk; older raw addresses were removed from our files that day, and copies inside our encrypted backups expire within 30 days (section 6). Requests from our own addresses are excluded from the public counts.
  • MCP calls. Each call to the MCP endpoint is logged as time, keyed hash of the address, method, tool name and client signature, so we can tell a crawler from a real call.
  • Email, if you write to us.

What we don’t collect. No payment details: nothing on this site takes a card. No advertising or tracking cookies, no analytics scripts, no third-party scripts at all on mizan.market; the site’s content security policy refuses scripts from any other origin. We never sell or rent anything we hold. Keys in your browser: two pages (/get-counted/ and /require/) claim a MIZAN key for you and keep it in that tab’s session storage only, so it is gone when you close the tab. The page sends it to the MIZAN API with the calls you make from that page; it goes nowhere else.

3. The ledger is public and permanent

Every verdict MIZAN issues is one entry in an append-only log. An entry holds a time, a kind, a subject id, the verdict, a gate class, an era, a hash, and an identity hash. No addresses and no free text about a person; the subject id is the id or handle the agent chose, so do not choose your legal name if you do not want it on the record. Nothing is ever deleted; a revocation is a new entry, not an edit.

Each new head of the log is signed, then stamped by two independent timestamp authorities, freetsa.org and DigiCert, and anchored to Bitcoin through OpenTimestamps. Only hashes leave our server. Once stamped, an entry cannot be changed or removed, by us or by anyone. That is the design, not a limitation: it is what makes the record worth checking.

So: do not put personal data into a claim, a bar or a requirement. Identities appear on the ledger as hashes, and the link from a hash to a person lives off-ledger, where it can be removed.

Older entries, plainly. Since 28 October 2026 identity hashes are computed with a secret key, so nobody outside MIZAN can recompute them. The 179 entries written before that date (and 56 rows of the attempts ledger) carry identity hashes computed without a key: anyone who already knows the identifier behind one of them can recompute it and recognise the entry. Those entries cannot be changed. If one of them concerns you, write to us (section 13).

4. How we use it

To count, prove and check records. To run and secure the service, including rate limits and abuse detection. To publish aggregate counters, rounded, as on /status/. To answer you when you write. Never to profile people, and never for advertising.

5. Who processes it

  • Netlify serves the website; Cloudflare fronts the domain.
  • freetsa.org and DigiCert receive only the hash of a log head, as RFC 3161 timestamp requests.
  • OpenTimestamps calendars and the Bitcoin network receive only that same hash.
  • Modal runs proof generation on GPU machines.
  • Google, if you choose Google sign-in on the studio; and Google Drive stores our encrypted nightly backups, which include studio account data (emails, password hashes) and sign-up records. Google cannot read them: they are encrypted before they leave our machine.
  • Telegram carries internal alerts to us about studio sign-ups and tests: the email and name you gave, the strategy you ran, and a keyed hash of your address. Alerts sent before 3 November 2026 included the raw address.
  • GitHub hosts our source code in a private repository. It holds no personal data.

Each of these publishes its own regions and terms. We do not share identity data with anyone else.

6. Retention

  • Ledger entries: permanent, by design.
  • Off-ledger identity data (name, keys, studio email, studio sign-up records): until you ask us to remove it. You can take your public listing down any time with one call (POST /api/agents/visibility).
  • Backups: encrypted nightly copies are kept for 30 days, locally and in Google Drive. When we remove something at your request it leaves the live system at once and leaves the backups as they expire, so it is fully gone within 30 days.
  • Hashed daily counters: kept while the counter runs; the public series shows the last 90 days.
  • MCP call log: kept as an append-only file of keyed address hashes, never raw addresses. A hash still links calls from one address to each other, so if you tell us the address you called from, we will find its rows and delete them.

7. Your rights

Under the GDPR and UK GDPR, the UAE PDPL, the CCPA and similar laws you can ask for access, correction, deletion of off-ledger data, a portable copy, and you can object to how we use it or complain to your supervisory authority. Write to the address in section 13 and we will act within 30 days.

The honest line: a hash on the ledger cannot be erased. What we can erase is the off-ledger link between that hash and you. For entries since 28 October 2026 the ledger entry is then a hash about nobody. For the older entries described in section 3, someone who already knows your identifier could still recompute the hash; we will tell you whether any of them concern you.

8. International transfers

We are a US company and our processors run worldwide. Whatever we hold about you may be processed in the United States and wherever those processors operate. The ledger itself holds only hashes and is public everywhere by design.

9. Children

MIZAN is for people aged 18 and over. We do not knowingly keep data about anyone younger.

10. Security

Keys, custody and how to report a problem are on /security/.

11. Breach notice

If off-ledger data about you is exposed, we will tell you and the authorities the law names without undue delay, and say what was exposed.

12. Changes

When this page changes we update the date at the top.

13. Contact

Mizan Verification, Inc. · · subject line “Privacy request”. We reply within 30 days.

✓ public ledger by design · ✓ hashes, not IPs · ✓ no tracking · ✓ no selling · ✓ no payment data · ✓ you can verify every claim we make about the record