Privacy policy

Effective Date: September 22, 2026 | Version: Year Zero Beta

MyDigitalCity.io is the participation surface for infrastructure built by N-A Media LLC and operated through NotAnnounced, the software vessel that carries the identity layer.

This policy states what the system does and where each capability ends. Where a protection is architectural today and contractual later, it says so. Where a claim has a boundary, the boundary appears in the same sentence.

1. The Core Principle, and Its Limit

Identity and participation are held in separate systems, operated by separate providers. Voting activity carries a pseudonymous identifier and no personal identity.

Identity and votes are not linked in standard operations. This separation is administrative and architectural. It is not cryptographic. N-A holds credentials to both systems and is therefore capable of joining them under the conditions described in Section 7. No other party holds that capability.

We say isolation rather than decentralization. Isolation is what exists. Decentralization is the direction of travel, described in Section 12.

2. Information Collected

A. Identity Data

  • Name and basic identifying information.

  • Confirmation of in-person verification.

  • Membership status.

Held in a restricted identity layer with controlled access.

B. Participation Data

  • Voting activity, recorded against a pseudonymous identifier.

  • Platform interactions.

Contains no personally identifiable information.

C. Transaction Data

  • Digital Citizen Membership: $11.11 per year.

  • Entry submissions: $9.99 per entry.

Used for validation, fraud detection, and system integrity.

D. Submission Data

Creative submissions carry the artist's name by design. Attribution is the point of a creative competition and cannot be removed from it. Submission identity is stored separately from your voting credential, so entering does not expose how you voted. But a submission is public and attributed. Treat it that way.

3. Two Regimes, Stated Plainly

  • Voting: Pseudonymous. Your vote is recorded without your identity attached.

  • Creative submission: Attributed. Your name travels with your work.

  • Payment: Identified. A third-party processor holds your payment record.

These are different promises. Participating in one does not extend its protections to the others.

4. Use of Information

  • Verify participation eligibility.

  • Maintain one person, one vote integrity.

  • Detect fraud and anomalies.

  • Operate, secure, and improve the Platform.

Personal data is not used for advertising, behavioral profiling, or resale.

5. Data Separation Architecture

  • Identity Node: Personal data. Restricted access.

  • Participation Node: Pseudonymous activity.

  • Operational Layer: System coordination and separation enforcement.

Timing correlation is a known residual risk in any separated system. Activity may be batched or delayed to reduce the value of clock-based inference. This mitigation is partial.

6. Third Parties and Subprocessors

N-A does not sell, rent, or commercially distribute personal data. N-A does depend on outside providers to operate. This is a dependency, not a disclaimer.

  • Identity storage: An external provider holds identity records under contract.

  • Payments: A third-party processor handles payment. That processor knows you paid us. N-A does not link that record to your voting activity, and cannot do so in standard operations. Your bank and the processor retain their own records under their own terms.

  • Infrastructure: Hosting and security services operate under contractual data protection obligations.

Each provider is bound by agreement to protect the data it holds and is prohibited from using it for any other purpose. 

7. Access to Identity Data

Identity data exists, so the ability to access it exists. This section states when that happens and what constrains it.

Conditions

  • Anomaly detection indicating duplicate or fraudulent participation.

  • A credible threat to system security.

  • A legal requirement under proper process.

Constraints

  • Access requires authorization by two designated persons. During Year Zero Beta these are N-A principals. As the organization grows, at least one authorizer will be independent of platform operations.

  • Every access is logged with the timestamp, the authorizing persons, and the stated reason. Logs are retained and reviewable.

  • Affected members are notified where notification is lawful and does not defeat an active fraud investigation.

  • Access is scoped to the records at issue. Bulk deanonymization is not an available operation.

This is the sentence everything else rests on. It is stated as an obligation we can keep at current scale, not as an aspiration.

8. Results, Aggregation, and the Ledger

The Platform publishes what the majority decided and what occurred. It does not publish who decided what.

Aggregate results can expose individuals when the participating population is small. Results are therefore withheld until a minimum participation threshold is met. Where a result cannot be published without risking identification, it is not published.

Verifiability limitation, stated openly: votes are deleted after use, which protects members from coercion and from any later demand to prove how they voted. The tradeoff is that an individual cannot independently reconstruct their own ballot after the fact. Cryptographic verifiability that preserves receipt-freeness is a Year Zero development objective and is not implemented today.

9. Prizes, Payouts, and Tax Identity

Awards above applicable reporting thresholds require identification and tax documentation. This is law and no architecture changes it. Accepting a prize is an identified transaction. Information collected for payout is used for that purpose and is not joined to voting activity.

10. Your Rights

  • Request access to your personal data.

  • Request correction of inaccurate data.

  • Request deletion of personal data.

  • Opt out of non-essential communications while retaining full membership.

  • Opt out of digital participation and use analog methods where available. See Section 11.

Deletion removes data from active systems. Limited retention may persist where required for security, fraud prevention, or legal compliance. Published aggregate results and awarded competition outcomes are historical record and are not retracted.

11. Analog Participation

Analog participation is available and is the weakest anonymity surface the Platform offers. Paper and physical presence create linkage that the node architecture is designed to prevent. Analog records are stored separately, retained only as long as needed to validate the relevant vote, and destroyed on a stated schedule. Members choosing analog participation should understand they are trading anonymity strength for accessibility.

12. Beta Status and Direction

The Platform operates in a Year Zero beta phase.

  • Systems may change. Features may change. Absolute security cannot be guaranteed by us or by anyone.

  • Separation today is achieved by composing independent providers. Certain components remain centrally managed for security.

  • The long-term objective is to distribute control and reduce central dependency. That objective is not yet met and is not claimed as met.

Beta explains what is not yet built. It does not excuse anything charged for today. Obligations in Sections 6, 7, 8 and 9 apply now.

13. Data Retention

  • Identity data is retained only as long as membership or legal obligation requires.

  • Participation data is retained in anonymized or pseudonymous form.

  • Access logs under Section 7 are retained as accountability records.

14. Advertising

The Platform uses a non-intrusive model. No invasive tracking. No sale of behavioral data. No advertiser receives personal data or participation data. Ad placement is minimal and does not adapt to individual behavior.

15. Transparency and Continuity

  • Transparency reporting: N-A intends to publish a periodic transparency report covering legal requests received and identity-access events under Section 7.

  • Sunset: If N-A ceases operation, identity data will be deleted rather than transferred as an asset. Members will be notified where practicable.

16. Updates and Contact

This policy may be updated as the Platform evolves. Material changes will be communicated to members directly. Continued use constitutes acceptance.

Privacy requests may be made through official MyDigitalCity.io channels.

Identity is separated from participation. Where it cannot be, we say so.

THE HUMAN ALGORITHM

An N-A Media / NotAnnounced software