Privacy Policy

Our Commitment to Privacy

eIOU is a decentralized peer-to-peer credit network. Privacy isn't bolted on. It falls out of the architecture: there's no central server, your node lives on your own machine (or on infrastructure you've delegated to us, as described below), and the protocol's defaults route traffic over Tor and encrypt everything end-to-end.

This policy describes the small set of situations in which the eIOU organization receives any user data, what we do with it, what we don't have access to, and how the website itself (a separate concern from the node software) handles visitor traffic.

Data Collection

How Data Collection Works

Important: eIOU is a decentralized protocol. Each Docker node operates independently and stores its own data. Your wallet keys, contacts, and obligation history live inside that node, not on any central server.

The eIOU organization receives node data only in the following narrow situations:

• Anonymous analytics (off by default, opt-in): If you explicitly enable analytics on your node, it sends a single anonymized heartbeat once per day over Tor. The submission carries an HMAC-SHA256 anonymous ID that cannot be reversed to your public key or network address, and aggregate counts only (transaction counts, contact count, volume per currency). No individual transaction details, contact information, amounts, counterparties, IP addresses, or private keys are ever included. You can disable analytics at any time through the GUI, CLI, or API. See the Anonymous Analytics documentation for the full specification.
• Hosted nodes (optional onboarding): We offer eIOU-hosted nodes as a convenience for users who'd rather not run their own Docker container. When you use a hosted node, the container runs on infrastructure we operate. We do our best to protect your hosted wallet data, and our long-term goal is to encrypt it so that only you can access it. During the current open alpha we have not yet achieved that goal: we retain administrative access to nodes we host, and we may use that access for internal debugging, support, incident response, and product development. We may also be compelled to share information by a valid government order, in which case we would comply only to the extent the law requires and would notify you unless prohibited from doing so. The strongest sovereignty guarantee comes from running your own node, where the host is yours and no third party (including us) has any access path. See gitlab.com/eiou-org/eiou-docker.
• Contact-form and email submissions: When you fill out the contact form on this website or email one of our addresses, we receive what you sent (name, email, organization if you choose to provide it, topic, message) for the sole purpose of replying.
• MCP alpha tester requests: The dedicated tester flow requires your eIOU node address and records your selected MCP client, confirmation that you control the node, and any optional name or contact email you provide. Cloudflare Workers and Email Routing deliver that request to the eIOU pilot mailbox so we can assess pilot fit and coordinate access. We do not ask for or accept wallet seeds, wallet passwords, bearer keys, or provider credentials. Requests remain in the pilot mailbox only while needed for access coordination, support, security follow-up, and the pilot record; ask privacy@eiou.org to access or delete yours.

What Your Node Stores Locally

Every eIOU node, whether you self-host or use one we host for you, maintains the following data inside its own Docker volumes:

• Obligation Data: The minimum information needed to record eIOU obligations: parties, amount, currency, timestamp
• Contact Data: The peers your node knows about, with whatever profile information they've chosen to share with you. Encrypted end-to-end (ECDH + AES-256-GCM) when it traverses the network, and encrypted at rest via MariaDB Transparent Data Encryption
• Network Data: Addresses used to reach peers (HTTP, HTTPS, or .onion identifiers)
• Cryptographic Material: Wallet private keys, the BIP39 24-word seed phrase from which all keys derive, and encryption keys for at-rest data. All are encrypted at rest, with the seed phrase as the sole root of trust

How Data Is Used

On your node

The data your node stores is used exclusively for:

• Processing and facilitating eIOU obligations within the network
• Maintaining network integrity and preventing fraud (signature verification, chain integrity checks, replay protection)
• Enabling peer-to-peer trust relationships
• Recording obligation history so you can audit and reconcile against your contacts

By the eIOU organization

What eIOU receives or has access to is used only as follows:

• Anonymous analytics (if you opted in) is used to track aggregate ecosystem health: how many nodes are active, rough transaction volume by currency, version distribution. It is never re-identified or cross-referenced against any other data source
• Hosted-node operational data: during the current alpha we retain administrative access to nodes we host. We use that access to keep nodes running, debug issues, respond to support requests, and develop the product. We do not export hosted-node data for marketing, advertising, sale, or any commercial purpose outside operating the service
• Contact-form submissions are used only to reply to your inquiry
• MCP alpha tester requests are used only to review pilot eligibility, coordinate access, support approved testers, and investigate security or abuse reports connected to the pilot

Data Storage & Security

Decentralized by Design: The eIOU protocol has no central server. Obligations are bilateral records held by the two counterparties involved. Each side stores its own copy in its own node. There is no global ledger, no distributed-ledger replication, and no central authority that can rewrite obligation history.

End-to-end encryption: All contact messages between nodes are encrypted end-to-end with ephemeral ECDH key agreement and AES-256-GCM, with forward secrecy. Every field, including the message type, sits inside the encrypted block, so message types are indistinguishable on the wire.

Encryption at rest: Each node encrypts its database via MariaDB Transparent Data Encryption, with the encryption key kept only in RAM (regenerated on each boot from the master key derived from the BIP39 seed). Wallet private keys, auth codes, and the mnemonic itself are independently encrypted with AES-256-GCM. Automatic backups are AES-256-GCM encrypted as well.

Seed phrase is the root of trust: All cryptographic material (wallet keys, Tor identity, encryption keys, backup keys) derives from a single BIP39 24-word seed phrase generated on first boot. Whoever holds the seed phrase controls the wallet, so storing it offline and outside version control is the most important thing you can do.

No central database: eIOU does not maintain a central database of users, obligations, contacts, or balances. The only data eIOU stores at the organizational level is described in Data Collection above.

Tor & Anonymous Usage

Tor is built in and enabled by default. Every eIOU node starts a Tor daemon and auto-generates an .onion address on first boot. The default transport priority is Tor › HTTPS › HTTP, so nodes prefer the most metadata-private option available without any configuration on your part.

Why Tor matters here: HTTPS encrypts message bodies but leaves source/destination IP addresses, connection frequency, and packet timing visible to network observers. For a financial system, that metadata is enough to reconstruct who-pays-whom from timing patterns alone. Tor's three-hop circuit means no single relay sees both endpoints, so the metadata never reassembles into the network-graph view that pure HTTPS exposes. For the long form, see the SECURITY.md threat-model section.

Some operations are deliberately Tor-only. Most notably, contact status pings emit recognizable timing patterns that would let an HTTPS observer reconstruct the contact graph if they were ever permitted to fall back to HTTPS. If Tor is unavailable, pings simply fail rather than silently downgrading transport privacy.

A VPN is not a substitute for Tor in this threat model: a VPN provider sees both your real IP and every destination you connect to, while Tor distributes that trust across independently-operated relays. A VPN can still be useful as an additional layer for hiding destinations from your local ISP, but do not disable Tor on the assumption that "a VPN covers it."

Data Sharing

We never sell, rent, or trade personal data. Because eIOU is a peer-to-peer protocol, there is very little data flowing to or through the organization in the first place. See Data Collection for the full inventory. The data we do hold is shared only as follows:

• Service providers we depend on: The website is hosted on Cloudflare (Pages, DNS, Workers, Email Routing for the contact and MCP tester forms) and traffic statistics are collected via Google Analytics. These providers receive only what their function requires: request logs for Cloudflare, page-visit telemetry for Google Analytics, and the literal contents of contact-form and tester-request submissions for the email pipeline. See Website Analytics below for the Google Analytics specifics.
• Legal process: If we ever receive a valid legal demand we would comply only to the extent the law requires, and we'd notify the affected user unless prohibited from doing so. The scope of what we can produce depends on what we actually hold. That can include anonymous analytics submissions (HMAC-hashed, not tied to identity), contact-form emails, and MCP tester requests. For users of hosted nodes during the current alpha it additionally includes anything stored inside the node we operate on their behalf, since we retain administrative access to hosted nodes during alpha (see the Hosted nodes bullet under Data Collection). For self-hosted users we hold no obligation history, no contact lists, no wallet balances, and no private keys: none of those ever leave the user's node.
• With your explicit consent: Anything else only with your specific authorization for a specific purpose.

What your own node shares peer-to-peer is separate. When you transact with a counterparty, your node and theirs exchange the obligation data, addresses, and contact details needed to settle. That data flow is between you and your peer; eIOU is not in the path.

Plugins

The eIOU node software supports plugins: optional add-ons that may extend the node by contributing Web GUI sections, CLI subcommands, REST API endpoints, payback-method rail types, and event subscribers. A plugin may also run additional services inside or alongside the node container, expose publicly reachable endpoints that accept requests from people other than you, and transmit data it can access to external services in order to do its work. Plugins are disabled by default; the operator must explicitly enable each one. Plugins fall into two categories with different privacy implications, but those categories determine who is responsible for a plugin, not what it is technically able to do.

Bundled plugins (authored by eIOU and shipped inside the official Docker image): these follow the data practices disclosed by eIOU. Most access only the same on-node data your node already holds and transmit nothing outside the node beyond what this policy discloses. Where a bundled plugin's core function involves transmitting data to an external service or accepting inbound requests on a public endpoint, that behavior is documented and you enable it deliberately. Bundled plugins are open source and verifiable in the eiou-docker repository.

Third-party plugins (anything not bundled, including plugins from a publisher whose signing key you have chosen to trust and eIOU-authored plugins not yet shipped in the official image): the node software enforces a mandatory sandbox on every plugin. Sandboxed plugins run in their own isolated process under their own Unix user, with no filesystem access to wallet secrets, no direct database access to core tables (contacts, transactions, API keys, balances, payback methods, or other plugins' tables), and no ability to read wallet private keys, the BIP39 seed phrase, the master encryption key, or API-key plaintext. The node refuses to install or enable any plugin that has not opted into the sandbox.

Within that sandbox, a plugin can access a controlled, read-only set of queries that it declares in its manifest and the operator approves at install time. Depending on the permissions the operator approves, that access may include contact information (names, pubkey hashes, online status, and, with additional permission grants, the full address book), transaction records (memo, amount, counterparty), wallet balance, payment requests, and payback-method preferences. Any data accessible to a plugin can be transmitted off the node by the plugin's own code. eIOU does not author, audit, sign, or vouch for third-party plugins, and each third-party plugin has its own privacy practices that are entirely between you and the plugin publisher.

Signature verification within the node software is a technical control you use to limit installations to publishers whose signing keys you have chosen to trust; it does not constrain what a plugin does after installation, and it is not an endorsement or audit by eIOU.

Plugins that serve other people: a plugin may expose a publicly reachable endpoint on your node that accepts requests from third parties (for example, a plugin that resells access to a service in exchange for eIOUs). When you enable such a plugin, your node receives and processes input submitted by those users, and the plugin may forward that input to external services to carry out the request. How those users' data is handled is governed by you as the operator and by the plugin's publisher, not by this policy, which describes how your own node handles your own data. Where a plugin's publisher provides its own privacy terms, those terms govern the publisher's handling of that data; where it provides none, this policy's disclosures continue to apply to the extent the plugin processes data on your node. If you operate a service like this, you are responsible for telling its users how their data is used.

What this means for your data: if you run only bundled plugins, the inventory in Data Collection remains accurate. If you enable any third-party plugin, the sandbox protects wallet secrets, but the data you authorize the plugin to access (through the permissions you grant at install time) can be transmitted off the node by the plugin. Review each third-party plugin's manifest, its requested permissions, its documentation, and its source before granting trust. Disabling a third-party plugin does not retroactively undo any data it may already have transmitted off the node.

Website Analytics

This website (eiou.org) can use Google Analytics 4 (measurement ID G-BKZVJNW6GJ) to understand aggregate traffic: which pages are visited, how visitors find the site, what devices and rough geographic regions are common. We use this only to decide where to invest documentation, content, and product effort.

Consent required. Google Analytics is not loaded until you accept the consent banner that appears on your first visit. If you reject (or never respond), no Google Analytics script is fetched, no analytics cookies are set, and no data is sent to Google. Your choice is stored only in your browser's local storage and can be changed at any time via the "Cookie preferences" link in the page footer.

If you do accept, Google Analytics loads and, by default, sets cookies in your browser and sends Google information including your IP address (truncated by Google), user agent, referrer, and the URL of each page you visit. We do not currently make use of Google Ads, conversion tracking, audience-remarketing, Google Signals, or cross-device identity linking integrations.

This is a website-only data flow. Google Analytics is loaded by the marketing website, not by the eIOU node software. Your node never contacts Google. If you only ever use the node (CLI, GUI on your local Docker container, Tor) without visiting eiou.org from a browser, Google Analytics receives nothing about you.

Additional opt-out options: beyond rejecting the banner, you can use any browser-level tracker blocker (uBlock Origin, Privacy Badger, Brave's built-in shield, Firefox's strict ETP mode), install Google's official opt-out browser add-on, or use Tor Browser, which blocks Google Analytics by default.

Your Rights

Because the node software runs on your own (or your chosen host's) infrastructure, most "data rights" are not things we grant; they are structurally available to you:

• Access your data: Your obligation history, contacts, balances, and settings are queryable directly from your node via the GUI, the eiou CLI, or the REST API
• Take your data with you: The CLI's eiou backup create produces an AES-256-GCM-encrypted database dump you can move to a new host or keep as an offline archive. Volume-level backups (raw tar of MariaDB, config, and backups) are documented in the Docker repository's README
• Delete your node and all associated data: docker compose down -v removes the container and the named volumes. Nothing persists outside Docker
• Operate anonymously: Tor is the default transport, and your node can run entirely over .onion without ever exposing an IP address. Tor Browser also blocks the website's Google Analytics by default
• Opt out of analytics: Node-level anonymous analytics is off by default; if you've turned it on, disable any time via the GUI, CLI, or API. Website-level Google Analytics is gated by the cookie consent banner; revoke at any time via "Cookie preferences" in the footer
• Statutory rights (GDPR / CCPA / etc.): If you're in a jurisdiction that grants statutory data rights, contact privacy@eiou.org. For most users the data we hold is narrow (anonymous analytics submissions, contact-form emails, and any MCP tester request they submitted), so access or erasure requests are quick. Users of hosted nodes during the current alpha should additionally note that we retain administrative access to nodes we host (see Data Collection)

Children's Privacy

eIOU is intended for adults of legal contracting age in their jurisdiction (generally 18+ in the US). Creating and accepting eIOU obligations is a financial act that minors may lack legal capacity to perform.

We do not direct the website at children, do not knowingly collect personal information from anyone under 13 (the threshold defined by the US Children's Online Privacy Protection Act), and would delete any such information promptly on becoming aware of it. If you believe a child has provided personal information through our contact form or another channel, please email privacy@eiou.org and we will remove it.

Changes to This Policy

We may update this Privacy Policy as the protocol and the organization evolve. The "Last Updated" date at the top of the page reflects the most recent revision, and every prior version is preserved on this site, with the version selector near the top of the page linking to each one once material changes have been published.

For material changes (anything that meaningfully expands what data we collect, who we share it with, or how it's used) we'll announce the change on the project's GitLab repository and on the website itself before the change takes effect, so you have time to review and act on it (revoke consent, stop using a hosted node, etc.). Minor copy edits and clarifications don't trigger an announcement.

Contact Us

For questions, concerns, or requests about this Privacy Policy or our privacy practices:

Open Source Transparency

The eIOU node software is open source under the Apache License 2.0 and is currently in open alpha. You don't have to take our word for any claim in this policy. You can verify it directly:

• Anonymous analytics: implementation at files/src/services/AnalyticsService.php, daily cron at files/scripts/analytics-cron.php, and the full specification in docs/ANONYMOUS_ANALYTICS.md
• End-to-end encryption: payload encryption code paths and threat model documented in SECURITY.md
• Tor integration: Tor daemon configuration, hidden-service publication, and circuit-health logic visible in eiou.dockerfile and the related startup.sh
• This privacy policy itself: every prior version is preserved on this site and accessible via the version selector near the top of the page

The node-software repository accepts community contributions at gitlab.com/eiou-org/eiou-docker.