Privacy through contract,
not obscurity.
Your identity in PDD is anchored to an Ed25519 cryptographic key pair. Your private key is generated in your browser and is used to sign actions. Your account is protected by a password and, optionally, a cross-device passcode for signing in on other machines.
The server holds your public key, a one-way lookup hash derived from your email and a server-held salt, and your encrypted vault. We cannot reverse the hash. We cannot decrypt your vault without your password.
The PDD server stores your data. Specifically:
Browsing data: URLs, page titles, timestamps, and domain names captured by the Envoy browser extension. This includes the pages you visit while Envoy is active, your browsing history, and your most-visited sites. It is stored per-person in a browsing ledger on the server, for as long as your account exists. You can pause collection at any time, and it is destroyed when you delete your account.
What we do not capture. Envoy records where you go, not what you write. We do not store typed text, the contents of your searches, form entries, or anything you author. Search terms are stripped from addresses at the point of capture, so a query you type never reaches our servers. The record is a map of your activity, not a copy of your communications.
Folders and assignments: The folders you create and which browsing events you assign to them.
Contracts and settlements: Records of agreements between you and organisations, including pricing, scope, and delivery receipts.
Messages: System notices and messages sent between you and PDD inside the platform. Messaging is in-house only. There is no email, and PDD does not capture or store correspondence you have with anyone outside PDD.
Identity records: Your public key, email hash, encrypted vault, and device registrations.
All of this data is yours. You can view it at any time from your home, and download all of it at any time from the Home Data tab, including right before you delete. You can delete your account from the Home Identity tab; what deletion removes, and the few records that must be kept, is set out under Your rights below.
Nothing leaves your account unless you explicitly choose to share it. When you offer a folder of browsing data for sale, the offer is visible to organisations. If an organisation purchases your offer, only the browsing events you assigned to that folder are delivered.
You see the exact data before it is sent. You control which events are in each folder. You set the price. You can cancel before delivery.
The organisation receives exactly what you approved. Nothing more.
Organisations receive only the data you approved. They are bound by the contract's declared limits: the stated purpose, retention period, and use constraints. Violating those terms creates an enforcement surface within PDD.
Organisations do not see your email, your real name, or any identifier beyond the contract's party reference. They cannot correlate your data across contracts unless you choose to engage with them again.
You can join a research study. Joining is something you do deliberately, from your own home page, after reading what the study is about. If you have joined no study, nothing in this section happens.
When you have joined one, Envoy assembles the slice that study is entitled to and sends it from your device straight to the research lab. It does not pass through our servers. We hold the schedule and the receipt; we do not hold the research payload.
What the lab receives is reduced before it leaves your device. Only an explicit list of fields survives: the kind of event, the site's domain, when it happened, and non-identifying details such as scroll depth or time on page. Your address, page title, and event identifiers are dropped, and anything not on the keep list is dropped whether or not we anticipated it. Your identity is replaced by a per-study pseudonym, so the same person in two studies is two unrelated participants, and neither one can be traced back to you.
Some studies ask you to review specific evidence and approve it item by item. In that case only the items you ticked are sent, and the study's site list is deliberately ignored, because a site list would deliver more than you looked at.
Withdrawing from a study stops all further delivery immediately, including for anything you approved earlier.
We use no cookies. No analytics. No tracking pixels. No third-party scripts that profile your behaviour. No advertising infrastructure of any kind.
PDD does not participate in the system it was built to replace.
This site is hosted on Railway. Like all hosting providers, Railway collects standard server log data including IP addresses and request metadata as part of normal infrastructure operation. This is outside our direct control and governed by Railway's Privacy Policy.
We do not access that data for profiling, targeting, or any commercial purpose. Domain services are provided by Cloudflare under their standard terms.
You have the right to see all data we hold about you, at any time, from your home.
You have the right to delete your account, from the Home Identity tab. Deletion does not complete while you have an open contract: a pending contract, not yet delivered, can be cancelled; one already in motion settles first. Once every contract has cancelled or settled, deletion completes. When it completes, the server destroys your account and everything personal to it: your identity records, recovery data, messages and blocked-organisation list, folders and assignments, settings, and your browsing history. PDD has no interest in holding the browsing record of someone who has left. You cannot sign in afterward, and the account cannot be recovered.
You have the right to stop collection at any time. Pause it directly in Envoy, or disable or uninstall the extension entirely.
You have the right to withdraw from any contract before delivery. Cancellation is available at the preview stage. No data is transmitted and no obligation attaches.
A small set of records is kept after deletion, and we will say exactly what and why, because claiming to erase them would be false. Settlement records and the contracts they settled are kept as proof that an agreement existed and was honoured, for accounting, tax, dispute, and audit. When a sale clears, money moves: you are paid, the buyer pays, PDD takes its share, and that record has to survive. It does not contain your browsing data. The link between your account and your Stripe payout account is kept because Stripe carries its own legal retention obligations and the financial records must stay coherent. These kept records still carry your account and payout identifiers; they are not anonymised, and we will not describe them as if they were.
For rights requests under GDPR or CCPA, see Your Rights.
If you believe your data rights have been violated, you may file a complaint with the relevant authority:
United States: Federal Trade Commission (FTC) · California Attorney General (CCPA)
European Union: European Data Protection Board. Find your national data protection authority.
United Kingdom: Information Commissioner's Office (ICO)
You may also contact us directly at contact@publicdigitaldomain.org and we will respond.
Envoy is distributed through the Chrome Web Store and Mozilla Add-ons. It has one purpose: recording your browsing to your own PDD account so that you can license it, contribute it to a study you join, withhold it, export it, or destroy it.
Limited Use. Our collection and use of information received from Envoy adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use the data only to provide that single purpose. We transfer it to a third party only where that transfer is the feature you asked for, which means a research lab whose study you joined, or an organisation whose contract you signed. We do not sell or transfer data to advertising platforms, data brokers, or information resellers, we do not use it for personalised advertising, and we do not use it to determine creditworthiness or for lending.
The extension records where you go, not what you write, and that floor is enforced in its code rather than promised here. A reviewer's account of exactly what is captured, what is dropped, and every outbound destination ships inside the Firefox package as gecko-README.md.
If this policy changes in any material way, the update will be reflected here with a revised date. We will not introduce data collection practices without updating this page first.