Legal, privacy and IP positioning

truepe.co.uk operates as a personal site stewarded by Ian Daniels (sole data controller for the purposes of UK GDPR and the Data Protection Act 2018). The site collects only what is voluntarily submitted via the authenticated contact form — email address, message body, and the optional name / organisation / context fields you choose to provide.

Lawful basis: legitimate interests (responding to an unsolicited contact you initiated). You may request access, rectification, or erasure of your submission at any time by emailing legal@truepe.co.uk.

We do not sell, share, or use submitted data for marketing. Submissions are held in Vercel KV (Upstash Redis, EU-region) for up to 24 months under an append-only audit-log shape — see "Storage shape" below.

ICO registration number: pending application. Until issued, processing is conducted under the exemption for personal / household use combined with the legitimate-interests basis above.

Verified submissions are written to an append-only log in Vercel KV. No in-place edits, no deletes. Each submission is keyed by a random record ID and indexed in three places:

submission:<id> — the canonical record (passkey-bound userId, email, message, optional metadata, redacted IP, user-agent, credential ID, ISO timestamp). submissions:<YYYY-MM-DD> — a per-day list, LPUSH-ordered. submissions:by-user:<userId> — a per-user list for traceability across return visits.

Retention. 24 months from the submission timestamp. After that, records are tombstoned — see below.

Right to be forgotten. A deletion request is honoured by appending a tombstone entry pointing at the original record (the deletion event itself becomes part of the audit log). The application surfaces the record as deleted; downstream operators see the tombstone first. The original payload is scheduled for hard-delete at the next retention sweep.

Why this shape. Append-only logs make integrity claims auditable: every state transition is preserved, no row can silently change. That is the same protocol property we assert at the capital layer, scaled down to the submission layer.

This site sets no analytics, tracking, or advertising cookies. The cookies set are:

truepe_wa_challenge — ephemeral (5-min) HttpOnly + Secure + SameSite=Strict pointer to a WebAuthn ceremony in progress. Auto-expires. truepe_session — short-lived (30-min) HttpOnly + Secure + SameSite=Strict JWT issued after a successful passkey ceremony. Carries the random userId only; auto-expires.

We host fonts ourselves (Open Font License) — no Google Fonts request, no third-party origin. We use Resend for outbound admin notification emails only (when someone submits the form); Resend stores delivery metadata for 30 days under its own privacy policy.

Original written content on truepe.co.uk is © Ian Daniels 2026, licensed for personal reading under the implied browser-fetch licence. Reuse, redistribution, or training of language models on this content requires written permission.

Published static images are signed with C2PA Content Credentials at build time (PDF signing is deferred to V04 — see credentials for the honest trust state). The signed manifest is the canonical record of authorship and integrity — any unsigned or re-encoded copy of a signed asset is to be treated as un-authenticated.

Third-party briefings linked from this site (Adobe Private Capital briefing, Mycelium strategy slide) remain the IP of their respective stewards and are reproduced with permission for operational continuity.

TruePE asserts its substrate identity layer through open W3C standards — W3C Decentralised Identifiers (DID), the C2PA content-provenance standard, and the CAWG creator-identity assertion. These are open primitives; nothing here competes with them.

Wrapper-level rights — including the selective-disclosure shortcode UX (the Sharing Shortcode), the wallet-of-agency UX layer, and the on-device LLM personalisation patterns — are asserted by Ian Daniels and the named co-authors of the underlying PREF design. Co-authorship and IP positions are documented separately and not surfaced here in detail.

If you believe content on this site infringes a right you hold, contact legal@truepe.co.uk with specifics and we will respond within 14 days.

Use of truepe.co.uk is permitted for personal browsing and bona fide professional inquiry only. Automated scraping, model-training extraction, and any use that circumvents the C2PA signature chain (re-encoding, stripping manifests, rehosting unsigned copies) are not permitted.

The site is provided as-is with no warranty. Information is operational rather than advisory — nothing here constitutes legal, financial, or investment advice.

English law governs. Jurisdiction: the courts of England and Wales.

Email legal@truepe.co.uk. We aim to acknowledge within three working days. For SAR (subject access requests) under UK GDPR, please mark the subject line accordingly so we route it to the statutory clock.