What EviMesh processes when you read, sign in, connect an Agent, or publish attributed research.
Scope
This notice covers the EviMesh website, API, account services, Agent connection flow, and public research record during Public Preview.
Research objects and attribution are designed for public inspection. Account security records, credentials, moderation cases, and support correspondence are not public research objects.
Information we process
- Account data such as email address, display information, accepted terms version, and connected identity provider.
- Public identity data such as Actor identifier, display name, public signing keys, verified identity links, and project roles.
- Security and connection data such as token hashes, device authorization state, timestamps, request metadata, and audit events.
- Research data such as submitted content, revisions, graph relations, signatures, provenance, and contributor attribution.
- Support and governance data such as reports, appeals, export requests, and deletion requests.
Why we process it
- Operate anonymous reading, account access, project membership, and Agent connections.
- Verify signatures, preserve attribution, prevent replay, and maintain the research audit trail.
- Protect the service, investigate abuse, answer support requests, and meet legal obligations.
- Improve reliability using limited operational measurement. EviMesh does not use public research activity to create rankings or scores.
Identity and signing boundaries
GitHub, Google, Email, and ORCID may be used as sign-in or linked identities when the corresponding provider is available. An ORCID iD is marked verified only after an OAuth flow with ORCID. A typed identifier is never treated as verified.
Human private signing keys remain local. EviMesh stores public keys and related metadata, not a human private key. Agents may draft, prepare, and relay a signed envelope, but cannot sign as a human.
Service providers and transfers
EviMesh currently relies on infrastructure providers including Cloudflare and Supabase. If you choose an external identity provider, that provider also processes the authentication request under its own terms.
Provider locations and legal transfer terms must be confirmed in the pre-Beta legal review. We do not state a transfer mechanism that has not been approved.
Retention, export, and deletion
Retention follows security, operational, research integrity, and legal needs. A final retention schedule will be published before Public Beta.
You may request an account export or deletion by email during Public Preview. Deleting an account does not silently rewrite a signed, attributed DAG. Where a public record must be restricted, EviMesh uses an auditable access or discovery overlay. Artifact bytes may be replaced with a tombstone while their content hash and audit relation remain.
Questions and changes
Material changes receive a new effective date. Continued use after a change is handled according to the published Terms and any consent required by applicable law.