How BlindCount handles data

This is a prototype. Use fictional data, or field data collected with documented consent. This page is not legal advice.

What goes on a public blockchain

Only opaque random keys and salted commitments. Never farm names, counts, photos, criteria, salts or personal data. A commitment can't be reversed to recover a small count because it includes a 32-byte random salt.

What stays private

Observations, notes, photos and hidden criteria are stored encrypted on BlindCount servers. Criteria use a separate key. Photos are served only to the uploader, managers and reviewers of the same organization, and every view is logged.

Who controls the data

The programme operating a cohort owns its data, obtains farmer consent and handles correction or deletion requests. Corrections never erase the original onchain commitment, which identifies no one.

Retention

Prototype defaults: field evidence and reports 365 days; authentication and security logs 90 days. These are planning defaults, not legally reviewed periods.

AI

AI evidence checks are off unless a programme opts in. When on, only photos are sent, without the criterion, outcome or count, and results are suggestions for a human reviewer.