# PRIVACY REGISTER v2.1 — what the long table keeps, and what it never keeps

*v2.1, 2026-09-16: four rows made truer by the arc-end privacy audit (a session file the room does keep for a while; a second home for the salted tally; the read-aloud cache after a take-down; a second rate limit) — nothing loosened, everything named. v2 re-cut 2026-09-15 to the model the exhibit actually runs: you submit a dinner party by tapping
questions, and it is public and permanent. Supersedes v1's ephemeral framing, which described
erasures the room does not perform and does not need. The placard and the explainer quote this
doc; every window here is a number a fence or a test asserts, except two said in words and marked so: the week a report waits, and 24 kHz.*

**The whole story in a breath:** you tap questions to seat three dead guests; local models play
them; the dinner goes on a public wall and stays there, part of the exhibit. Nothing about you is
collected — no name, no account, no stored address — and there is no free text: nothing at this
table is typed, only tapped. The one thing that expires is a scrambled tally that keeps the room
from being flooded, and it is gone in two days.

*2026-09-17, one row re-cut for the launch-readiness fold (PR-C, the report sheet): what a report leaves on a dinner's entry is now two flags — withheld, and owed a read — beside the class code, and the wall caps how many dinners it holds off at once; a report filed past that cap is kept in full and hides nothing. No other row moved, and nothing loosened.*

Written in the print lab's register shape: one row per thing kept, its home, its window, and who
can remove it. A row nobody can assert is not written.

| what | where | how long | removed by |
|---|---|---|---|
| the dinner — every guest line, the questions you tapped, the follow-ups you chose | the wall on the serving host | **permanent — it is the exhibit** | your own key, within 48 hours of the first course (the words go, a bare receipt stays: three guests, no words); or a person acting on a report. Nothing else, ever — no timer, no sweep. |
| the per-line receipts — model tag, seat alias, card class, tokens, the paragraph's hash, the chip's hash, the checks' verdicts, the marks | the wall, under the hood | with the dinner — permanent | with the dinner |
| the claim key | only its hash, on the entry; the key itself lives only in your browser | with the entry; the key stops working 48 hours after the first course | the key is never written down (you hold it); the hash is a one-way scramble of a key that is useless after its window |
| the rate-limit tally — six dinners a day from one connection, two minutes apart, and three reports | a memory-only mount, salted with a daily salt — and, while you wait for a seat, your place in the queue carries the same salted scramble on the serving host's disk | at most 48 hours; the salt is shredded two days on | the reaper, on schedule; a reboot |
| the read-aloud audio cache — 24 kHz audio of the guest lines shown, keyed by a hash, no text | a memory-only (tmpfs) mount, 0700 | until reboot, or until newer lines push it out (a few hundred lines) — a taken-down line's AUDIO can outlive its words here, unreachable through the room, which mints no read-aloud for a struck line | the reboot, or the cache's own eviction |
| a report | the entry's withheld flag, the flag that a person still owes it a read, and a class code — nothing else. The wall holds only so many dinners off it at once (three, or a twelfth of the wall, whichever is more); a report past that is kept the same way, and its dinner stays readable until the person gets to it | until a person has read it — within a week is the promise; the room keeps no clock for it | the person |
| your seat at a live dinner — a random token your browser holds while the dinner cooks, pointing at that one dinner and the hash of its key | a small file on the serving host, named by the token | until the dinner closes, and at most 48 hours | the reaper, on schedule |
| the edge tally — how many requests one connection made in the last minute | the room's memory only, keyed by the same salted scramble | until the room is quiet a while, at most until a restart | the room |
| when a dinner happened | inside the record only — never on the wall, which is shown in a random order with no dates or times | with the record | — it is never shown, and it names no one |

**What the long table never keeps:** your name, your address (the raw one is never written down —
only a salted, self-expiring tally of your connection, for the rate limit), an account, a session
that outlives your dinner, a browser fingerprint, or a line of free text. There is no way to give one: nothing at this table
is typed.

**Permanent means permanent.** A dinner you submit is public art. No timer deletes it, no sweep
reaches it, and the record store has no delete at all. The only two things that ever remove a
dinner are your own key (within 48 hours of starting) and a person acting on a report. A take-down
inside that window pulls the words and leaves a bare receipt; after 48 hours the dinner belongs to
the exhibit for good.

**What a take-down cannot reach, said plainly:** the nightly off-site snapshot of the serving
host's data directory, which the estate keeps for up to two years; and the read-aloud cache, where a
struck line's audio — never its words — waits until newer lines push it out or the host reboots,
with no way through the room to play it. A dinner taken down inside its
48-hour window lives on in those snapshots for their window, then ages out; a dinner left up is
permanent by design. A take-down is itself visible on the wall as a bare receipt that says so.

**The marks are ours, and we miss some.** The after-dinner check that marks a guest slipping past
their year is a model reading a model; its marks are public, its misses are not counted, and the
door says so.

**Rate limits: six dinners a house, a day.** One dinner cooks at a time, six a day from one
connection, two minutes between them. What the room counts is a salted scramble of your address
that it keeps for at most 48 hours and can never read back; the address itself is never written
down. The day is the UTC day and it resets when the day does.