Public Digital Domain Public Digital Domain Under construction

Your browsing data built the world. Now it can build yours.

Your world to build. Yours to keep.

Sell it.  Share it.  Keep it.

For a person

Your own record, and what you can do with it.

Envoy collects your browsing record as you go, and it is held in your name. Nothing leaves your account until you send it. From there you have three things you can do with it, and doing nothing at all is a fourth.

The marketplace board: rows of data on offer, their markets, prices, price against the floor, and totals.

The marketplace board.

For a business

Buy it from the person who has it.

This is an arm's length market. You post what you are looking for, people decide whether to sell it to you, and the sale is a contract between the two of you that PDD clears and enforces. No broker sits in the middle holding a copy.

For research

A cohort that consented, on the record.

Recruit participants who agreed to take part, and receive their data on a schedule you set. Nothing here is bought. Participation is unpaid and sits outside the market entirely, which is the point.

Getting started

Five steps from account to market.

  1. Make an account.
  2. Install Envoy.
  3. Connect your bank through Stripe.
  4. Make a contract.
  5. Put it on the market.

Limitations

What PDD cannot do.

Every system has an edge. These are ours, stated plainly rather than left for you to discover.

  • Envoy collects on laptop and desktop only, on Chromium browsers and on Firefox. Not Safari. Phones cannot install it yet.
  • Envoy records where you go, not what you write. Typed text, form values, and authored content are cut at the point of capture, not filtered out afterward.
  • Sensitive domains are held out of sale by default, and the rule fails closed: flagged entries are stripped before delivery.
  • PDD cannot reach into a buyer's systems and delete data already delivered. It obligates the buyer to delete it at term end, requires confirmation, and records that confirmation or its absence.
  • PDD records a deletion confirmation. It cannot verify that the deletion actually happened.
  • PDD is in early operation. Settlement is live, but nothing here is promised to be permanent while the system matures.

No surprises

What every side should know before entering.

A person

Sell

  • The person keeps 60% of gross. PDD takes 40% and pays the Stripe and processing fees out of that, so the 60 is 60% of gross, not of what is left after fees.
  • Every offer sits against a floor the market sets.
  • More sensitive data prices higher. That is payment for a disclosure the person chose to make.
  • Selling requires a bank account and an age of 18 or older. Both are enforced at sign-up by Stripe, and Stripe is not available in every country.
  • A sale is final. Data delivered does not come back.

Share

  • Giving to research, or to a nonprofit or public-interest cause, happens outside the market. No price, no payment.

Keep

  • The data is held in-house on PDD servers. No third party ever holds it.
  • The person chooses what to list, what to withhold, and which buyers to block. Blocking is private: no organization is told what was blocked, or that anything was.
  • Collection itself can be paused or switched off at any time.

Delete

  • Download everything, at any time.
  • Delete the account at any time. Collection stops immediately, active contracts are fulfilled first, then the data is erased. It cannot be undone.
  • Settlement records, contract records, and the Stripe payout link are kept, because tax and audit law requires it. PDD does not describe that as anonymized.
  • Deleting the account does not reclaim data already sold.

A business

Buy

  • Undeclared use is not permitted. Incomplete declarations do not clear, and what an organization names in its declaration binds it once they do.
  • Any person may block an organization, and no reason is owed for it.

Keep

  • Data is delivered once and kept. The right to use it is bounded by a use term set on the contract: 12, 24, or 36 months, 24 by default.
  • A model trained on the data before the term ends may be kept afterward. The raw data may not.
  • PDD stops serving the data at term end. It does not reach into a buyer's systems and delete anything.

Delete

  • At term end the data must be deleted from the buyer's systems, including working copies and backups in its control.
  • Deletion is the buyer's obligation, and the buyer must confirm it through PDD. An unconfirmed deletion past term is a breach. The record of the confirmation, or its absence, is kept.
  • Download and account deletion are available.

Research

Recruit

  • Participants join a study by code, and see who runs it, the institution behind it, the sites it covers, and the kinds of activity it collects before they decide.
  • Research works with what participants share, outside the market and outside any price.

Receive

  • Deliveries are de-identified, with page addresses and titles stripped. PDD records that a delivery happened, not its contents.
  • A participant may withdraw at any time, which stops all future delivery.

Delete

  • Download and account deletion are available.

Where people meet business and research.