Who I am
This site is operated by ZeroWic (individual, not a company). It runs as a subdomain of zerowic.com and demonstrates an experimental authentication concept called Cyber DNA / ID.me.
Data controller contact: zerowic.com/sayhello
What this site is
This is a working prototype — a proof of concept shared with the community to explore an idea. It is not a commercial product or service. You can create a test account to see how the authentication concept works.
What data is collected
When you create an account, the following is stored in the database:
Nick (username) — stored as a one-way hash (SHA-256 + pepper). The original text is never stored.
Email address — stored as a one-way hash (SHA-256 + pepper). Used only to verify ownership during account recovery. Never stored in readable form. Never used for marketing.
ID.me (secret number) — stored as a slow one-way hash (Argon2id). Cannot be reversed or read.
Password — processed through a mixing algorithm and stored as a slow hash (Argon2id) with an encrypted salt. The hash rotates on every login — old hashes are permanently deleted.
Personal story fragments — only hashed fragments of meaningful words are stored. The story text itself is never saved.
Seed phrase — stored as a one-way hash. The phrase itself is shown once at registration and never stored.
IP address — logged temporarily when a failed login attempt occurs (for rate limiting and lockout). Automatically purged after 30 days.
Timestamps — account creation time, last login, last logout, salt rotation time.
No data is stored in readable/reversible form except timestamps. There is no way for me (or anyone with database access) to see your nick, email, password, ID.me, or story.
Why data is collected
Account authentication — to verify your identity when you log in (legitimate interest: security).
Account recovery — to verify ownership if you lose access (legitimate interest: security).
Rate limiting — to prevent brute-force attacks against accounts (legitimate interest: security).
Legal basis: legitimate interest for security purposes (GDPR Article 6(1)(f)), and consent at the point of account creation (GDPR Article 6(1)(a)).
Cookies
This site uses a single cookie:
Session cookie — strictly necessary for the site to function. It keeps you logged in during your session. It is HttpOnly (cannot be read by JavaScript), SameSite=Lax (not sent on cross-site requests), and Secure (encrypted in transit). It expires after 30 minutes of inactivity or when you close your browser.
No analytics cookies. No tracking cookies. No advertising cookies. No third-party cookies of any kind.
Third-party services
This site makes no requests to third-party servers. All assets — fonts, scripts, stylesheets — are self-hosted on this server. There are no analytics, no tracking pixels, no social media embeds, no CDN dependencies. When you visit this site, your browser talks to this server and nowhere else.
Data sharing
Your data is never shared with, sold to, or accessed by any third party. There are no integrations, no analytics platforms, no email marketing tools connected to this site.
Data retention
Account data — kept until you request deletion.
Failed login attempts (IP) — automatically purged after 30 days.
Recovery tokens — expire after 2 hours and are marked as used. Cleaned up periodically.
Your rights
Under GDPR and UK data protection law, you have the right to:
Access — request what data is held about you.
Deletion — request that your account and all associated data be permanently deleted.
Rectification — note: because all data is stored as irreversible hashes, rectification means deleting and re-creating your account with corrected information.
Portability — you can request a copy of the data associated with your account (hashes and timestamps).
Object — you can object to processing at any time by requesting account deletion.
Complaint — you have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or your national DPA in the EU).
To exercise any of these rights, contact me via zerowic.com/sayhello. I will respond within 30 days.
Data security
Security is the entire point of this project. Measures include:
All credentials stored as irreversible hashes (Argon2id, SHA-256)
Salt material encrypted with AES (master key stored on server filesystem, not in database)
Password hashes rotated on every login
Rate limiting and lockout on failed attempts
CSRF protection on all forms
Session cookies hardened (HttpOnly, Secure, SameSite)
TLS encryption in transit (production)
Children
This site is not directed at anyone under 16. I do not knowingly collect data from children. If you believe a child has created an account, contact me and I will delete it.
Changes to this policy
If this policy changes, the "last updated" date at the top will be updated. Because this is a small prototype with no email list, I cannot notify you directly — please check back if concerned.