COPPA & GDPR Compliance

1. Zero-Knowledge and Regulatory Compliance

Regulatory frameworks like the General Data Protection Regulation (GDPR) and the Children's Online Privacy Protection Act (COPPA) are primarily designed to govern the collection, processing, and sale of Personally Identifiable Information (PII).

Hypastack approaches these regulations from a unique architectural standpoint by eliminating the collection of plaintext data altogether. Because my infrastructure relies exclusively on client-side AES-GCM encryption, I am technically and mathematically incapable of processing, identifying, or analyzing the contents of the files uploaded to my network.

2. GDPR (General Data Protection Regulation)

The GDPR imposes strict rules on those who host and process the personal data of EU citizens. Hypastack acts strictly as a data transport and storage conduit for encrypted ciphertext.

• Right to be Forgotten (Erasure): You have the absolute right to delete your data. Because you control the decryption keys, you can unilaterally render the data unreadable at any time by simply destroying your URL. Furthermore, you can actively trigger a deletion of the ciphertext from my edge nodes at any time using my platform tools, fulfilling the right to erasure instantly.
• Data Minimization: I practice absolute data minimization. I collect zero PII. There is no account registration with email, and users authenticate with a username and a cryptographically hashed password. I do not run analytics on your encrypted files.
• Data Processing: Because the server never possesses the decryption keys, I do not "process" your personal data in the traditional sense. I merely route indistinguishable blocks of ciphertext. Any PII contained within your files remains entirely obfuscated from my servers.

3. COPPA (Children's Online Privacy Protection Act)

COPPA regulates the online collection of personal information from children under the age of 13 in the United States.

• Age Restrictions: Hypastack is not directed at children under the age of 13. I do not knowingly collect personal information from children under 13. If you are under 13, you are strictly prohibited from using my services or creating an account.
• No Intentional Collection: I do not monitor or profile the age of my users based on their uploaded content. For website uploads I am technically unable to, since the content is encrypted before it reaches me; for CDN assets and developer API uploads I simply do not. I rely on the assertion that users accessing my tools are of legal age to form a binding contract.
• Remediation: If I obtain actual, verifiable knowledge that an account belongs to a child under the age of 13, I will immediately terminate the account and permanently purge all associated data from my network in compliance with COPPA, whether that data is encrypted ciphertext or not.

4. Submitting a Privacy Request

If you are an EU citizen seeking to execute a Subject Access Request (SAR), or a parent or guardian seeking COPPA remediation, please contact me via https://t.me/t_usekiko.

What I can return depends on how the data reached me, and I would rather set that out precisely than promise something inaccurate:

• Files uploaded through this website: I can provide only the encrypted ciphertext blocks stored on my servers. I cannot provide a decrypted version, nor recover your lost keys, because I do not possess them. This is a genuine technical limitation, not a refusal.
• CDN assets: These are not encrypted. I can provide the files themselves, along with their stored metadata.
• Files uploaded through the developer API: These are not encrypted either. I can provide the actual contents. Where the upload was made through a third party's application, the file resides in that developer's account and that developer is the controller of it — I can confirm what I hold, but requests concerning that content should also be directed to them.

In every case I can provide the account metadata I hold, which is deliberately minimal: no email address, no password, no IP addresses, and a nickname that is itself encrypted in your browser before it reaches me.