Safety & Privacy

1 · What this statement is

The estate's Guildmaster keeps this page: a plain account of what the Ember Guildhall collects, what it does not, and what it will never do. It covers every surface the estate runs — the public pages, the members' market and the commons behind it, and the teaching wing when it opens. Written to the truth of September 2026: where a thing is not built yet, this page says so rather than describing it in the present tense. It changes only in the open: when it changes, the date above changes with it.

2 · What is collected, and when

Today. The estate's public pages are plain pages: reading one is logged by no one but the host, described below.

The front page. guildhall.inc is a plain page — no scripts, no cookies, no forms, no analytics, nothing that watches a reader. It asks you for nothing and stores nothing about you. The public face of guildhall.trade is a plain page in the same spirit — its one script is the page's own stage dressing (the door, the hour, the fit of the scene to your window), running entirely in your browser: it stores nothing, sets no cookies of ours, and calls no third party. One thing happens anyway, as at every website: the company hosting the page (GitHub, for the front page) keeps the ordinary records a web server keeps — the network address a request came from among them — under its own privacy terms, not ours. The estate adds nothing to them and reads nothing from them.

The members' door, and the commons behind it. The market at guildhall.trade has two parts.

The door. Signing in is handled by a managed gatekeeper whose own page does the asking, not ours — a third-party service, named to members in the letter that carries their invitation. Because they do the asking, they hold your email address and the times you sign in, and they email you a one-time code each time. That is the whole of it: no password exists, so there is none to hold or to lose, and we keep no member table of our own. The sign-in leaves a session in your browser at their address; it expires on its own.

The commons. Behind that door, the trading square is a private repository on GitHub — a shared, permissioned folder of files — so GitHub holds your account there and the roster of who has access. The house keeps one record of its own: an append-only ledger of what was offered, by which hall (a hall is a member's own guild — their files, on their own machine), when, and whether it was taken up — a market's log, not a profile. It records trades, never people, and holds no hall's own work.

Camp and Party. Neither wing is open, and nothing is collected at either. Before that changes, this statement changes first.

3 · What is never done

• No payment surface exists anywhere on the estate, in any wing, in any phase of its design.
• No trackers, no analytics, no advertising, no profiles. Readers are not measured.
• No phone-home, and no reach-in. The estate cannot see inside a member's hall: no telemetry, no live link, nothing reporting back uninvited.
• A steward never acts for you. A steward is the AI assistant a member runs inside their own hall; it never posts, sends, or buys on anyone's behalf. Anything that leaves a hall leaves by its member's own hand.
• Nothing is sold, rented, or passed onward. There is no data business here, and no third party receives anything about you from us.

4 · Minors

There are no minor accounts on this estate, and the reason is architecture rather than policy: the estate's own surfaces hold no accounts at all, and the single door that asks for a sign-in is adults-only and by invitation. Public material is read-only — a reader is asked for nothing, so nothing is gathered from anyone, of any age. No minors' data exists to govern, because none is ever created.

The teaching wing is built on the same frame: an academy adults attend and trust, and are fine sharing with their kids at their own discretion, because they learned in it themselves — a place a family's adults can vouch for, not one intended for children. A young person learns inside a parent's own hall, under that parent's eye: the parent's account, the parent's own AI tools, whose vendors' terms and age rules apply rather than ours.

All of that describes an absence. If the estate ever proposes something that reaches minors directly — an account, a consent flow, an age rule — that provision goes to a lawyer before it ships, and this page changes before it exists.

5 · Unasked mail

A sign-in code or login link you did not just request is never from us. That half of the rule is absolute and does not change, whatever the estate builds later: no confirm your account, no someone has sent you an offer — sign in to view it. If one reaches you, someone else is trying the handle. Do not type it anywhere — and if you are a member, tell the keeper on the channel you already have with him.

The other half exists to keep the first half worth trusting: today the estate sends you nothing you did not ask for, and no class of message will ever reach you unless you said yes to that exact class in advance.

6 · What a door can and cannot do

A gate governs entry, never what follows: a member who is let in can copy what they find and pass it onward, and no lock anyone can build reaches that act. Past the door the only governor is the decorum of invited friends — real, and never counted by us as enforcement.

So the rule for what may enter is stricter than the rule for who may: keep off the estate anything that would harm you if it traveled. The estate deliberately offers no vault — no place for credentials, critical secrets, or deeply personal work; anything that needs one goes person-to-person, off the estate. Declining to build a vault is what keeps the other promises honest.

7 · When the estate must run diminished

The estate is kept by one person, and standing law covers the times he cannot act rather than leaving them to be discovered: an away window is announced to members before it begins, never after. While such a window holds, the trust layer freezes — nothing minted, verified, revoked, or merged, and no one else granted those powers in his place. Work already posted stays reachable — or, if anything looks wrong, the market pauses entirely; either way new proposals queue, and the honest answer to anything needing the keeper's hand is it waits. Members are told which state holds at the time, never left to discover it.

8 · When something goes wrong

For members. There is a form for saying so, and it is blameless by design: a standing incident report whose purpose is to diagnose and repair the system that let a thing happen, never to assign fault to a person — anyone named in one appears only to help resolve it. The record is append-only: corrections are new entries that say what they correct, never quiet rewrites. The route is the one you already have — the channel that carried your invitation carries a report.

On reaching us at all. The estate publishes no contact address, and that is a choice rather than an oversight: it widens by invitation and hand-carried kits, and the people who need the keeper already know how to find him. There is no form here for strangers and none is planned while the estate is this young — nothing on this page should be read as an invitation to write.

The Ember Guildhall — kept by Rob Ruud, its Guildmaster · co-signed by the Majordomo of the Ember Guildhall.