05Privacy & control

Personal signals. Considered boundaries.

Sensing deserves a clear explanation of what is handled, where it goes, and what you can choose. Here is where the work stands today.

Illustration of the device boundary: raw windows stay behind it; only feature vectors, pose coordinates and redacted frames cross. Not data.

01Today

Synthetic recordings.
An email you choose to send.

Today the recording path runs end to end on synthetic data and the simulator. No collection has been recorded, and no Cr4dle service handles a person’s signal. The demo console and the mobile app replay simulated sessions and files you open yourself.

Opening a session file
The browser’s local import tools read the file in memory. They do not upload it or save the imported record to browser storage. Leaving or reloading the view clears that import.
Demo preferences
The demo console saves its sign-in email locally in your browser until you sign out. The mobile app stores demo sessions on your phone. The website saves your appearance choice only in this browser; it contains no contact request or measurement. These are local demo features, not a connected account service.
Asking about a collection
The website prepares an email draft in your email app. The site does not send or store the request. You can review, edit, or discard the draft before sending it.
Contact by email
If you send the draft, your email provider delivers the information you chose to include. Avoid including sensitive health information or raw sensor recordings in a message.
02Product direction

Features leave.
Raw signal stays.

Raw neural signal, sEMG and gaze never leave the device; they cross the boundary only as features such as a force estimate or a gaze target. Video and the poses derived from it leave only after faces and bystanders are redacted on the device, and only under consent that is checked at capture and again at export, with revocation.

On the deviceRaw signal and unredacted framesAcquisition, redaction, the raw area
Across the boundaryFeatures and redacted mediaUnder current consent, with a card

Derived data can still be sensitive. A smaller data footprint does not eliminate privacy or security risk. Storage, access, retention, and deletion need their own controls and clear explanations; every exported dataset records its consent lineage and what was redacted on its card.

The current local demos do not upload raw recordings for model training.

03Consent

Consent is checked twice,
on every episode.

A demonstrator’s consent is a record the capture kit reads before a recording starts and the exporter reads again before an episode leaves, with revocation that is forward-looking, as the participant notice says: recording stops and no further release includes the demonstrator. The rule for a release touched by a withdrawn consent is that it is withdrawn and a later version without those episodes replaces it, never an edit in place; no release has been cut, so the rule is written, not yet exercised. Every dataset card carries the consent scheme, the purposes and the export scopes its episodes were recorded under.

The demo console and the mobile app are not consent producers; their permission switches govern phone cues and local files only. They describe the demos available today and do not imply that a collection service, cloud sync or an account service has shipped.

04Before release

The details should be
clear before you opt in.

A released collection service will need a full privacy policy and a participant notice describing the data it handles, the purposes, service providers, retention, and applicable choices. Those details must reflect the actual service, not just the intended architecture.

We will need to communicate those terms before a demonstrator wears the kit in a paid collection (a later phase, ADR-0136) or a research partner receives an episode.

Contact Cr4dle about privacy